Inside the SOC

What Is a SOC?

A Security Operations Center (SOC) is the central nervous system of an organization's cybersecurity defense. It's a dedicated team — and often a physical room — where security professionals monitor, detect, analyze, and respond to cyber threats around the clock.

Think of it this way: if a company's network is a city, the SOC is the police headquarters. It has surveillance cameras everywhere (log sources), a central dispatch system (the SIEM), and officers at different ranks (analyst tiers) who respond to incidents based on severity.

Every modern organization with valuable digital assets operates a SOC, whether in-house, outsourced to a Managed Security Service Provider (MSSP), or as a hybrid model. The SOC's mission is simple but critical:

Detect threats early. Respond fast. Minimize damage.

The SOC's Core Functions

The Three Analyst Tiers

Not every alert needs the same level of expertise. SOCs organize their analysts into tiers, each with distinct responsibilities and skills. Understanding this structure is essential because it tells you exactly what's expected of you at each career stage.

Click to enlarge

Tier 1 — Alert Analyst (Where You Start)

The L1 analyst is the frontline defender. You're the first human eyes on every alert that the SIEM generates. Your job is speed and accuracy:

• Monitor the alert queue — new alerts arrive constantly, and they need to be acknowledged
• Initial triage — is this alert a True Positive (real threat) or False Positive (noise)?
• Classify and prioritize — assign severity, tag the alert type (malware, brute force, phishing, etc.)
• Escalate or close — if it's beyond your scope, escalate to L2 with context; if it's a false positive, document why and close it

Day in the life of an L1: You arrive at your shift. There are 47 unacknowledged alerts in the queue. You open each one, check the source IP, destination, rule that triggered, and cross-reference with recent threat feeds. In 2 hours you've triaged 30 alerts — 26 false positives, 3 true positives (escalated to L2), and 1 you're still investigating.

Tier 2 — Incident Responder

When L1 escalates an alert, it lands on the L2 analyst's desk. The L2 takes over and performs a deep investigation:

• Root cause analysis — how did the attacker get in? What vulnerability was exploited?
• Scope assessment — are other systems affected? Is this an isolated event or part of a campaign?
• Containment — isolate compromised endpoints, block malicious IPs, disable compromised accounts
• Evidence collection — gather forensic artifacts (memory dumps, disk images, network captures)
• Incident documentation — build a timeline, map to MITRE ATT&CK, write the incident report

L2 analysts need deeper technical skills: memory forensics, network packet analysis, reverse engineering basics, and strong familiarity with the entire tool stack.

Tier 3 — Threat Hunter & Engineer

L3 is the most proactive tier. Instead of waiting for alerts, L3 analysts go looking for threats that slipped past the automated detections:

• Threat hunting — hypothesis-driven searches through logs and telemetry for hidden adversary activity
• Detection engineering — writing new SIEM rules (Sigma, YARA) to catch threats that weren't previously detected
• Tool development — building automations, playbooks, and custom scripts to improve SOC efficiency
• Adversary emulation — simulating attacks to test the SOC's detection capabilities
• Mentoring — guiding L1 and L2 analysts, reviewing escalations, sharing threat intelligence

How SOC Shifts Work

Attackers don't work 9-to-5. Neither does the SOC. Most SOCs operate on a 24/7/365 rotation, ensuring there's always at least one pair of eyes on the alert queue.

Click to enlarge

Common Shift Models

The Handoff: Most Critical Moment

The shift handoff is where incidents fall through the cracks if done poorly. A good handoff includes:

1. Open incidents — status, current actions, what's pending
2. Escalated alerts — anything waiting on L2/L3 response
3. Ongoing investigations — where you left off, what to check next
4. System/tool issues — "Suricata was down for 20 minutes, we may have gaps in network logs"
5. Notable observations — "Seeing unusual DNS queries from the marketing subnet, not confirmed malicious yet"

Most SOCs use a shared handoff document, a dedicated Slack/Teams channel, or a 15-minute verbal briefing at the start of each shift.

The SOC Data Flow

Understanding how data flows through the SOC is fundamental. Every tool you'll learn in this course sits somewhere in this pipeline:

Click to enlarge

Step-by-Step Flow

1. Data Sources Generate Logs

Everything in the environment produces logs: Windows endpoints write Event Logs, firewalls log allowed/blocked connections, email gateways log incoming messages, DNS servers log every domain query, and cloud services log API calls.

2. Logs Are Collected and Normalized

Agents (like the Wazuh agent) or syslog forwarders ship these logs to a central location. Raw logs come in many different formats — Windows XML, JSON, CEF, plain text. The collection layer normalizes them into a consistent format so they can be searched and correlated.

3. The SIEM Correlates and Alerts

The SIEM (in our platform, Wazuh) applies thousands of detection rules against the incoming log stream. When a rule matches — say, "5 failed logins followed by a successful login from the same IP within 10 minutes" — it generates an alert.

4. Alerts Enter the Queue

Alerts are prioritized by severity (Critical, High, Medium, Low, Informational) and appear in the analyst's dashboard. This is where your work begins.

5. Analyst Investigates

You open the alert, examine the raw logs, check the source against threat intelligence (MISP), investigate the endpoint (Velociraptor), and make a decision: close as false positive, or escalate.

6. Incident Response

If confirmed malicious, a case is opened in TheHive, containment actions are taken, and the full incident lifecycle begins. Automation tools like Shuffle can accelerate repetitive steps.

Where You Fit In

As you begin this course, you're training for the L1 Alert Analyst role — the most in-demand position in cybersecurity. Here's what that means:

By the end of this course, you won't just know what a SOC is — you'll have the skills of an analyst who's been working in one. Every module builds directly on this foundation.

What's Next

Now that you understand the SOC structure and how it operates, the next lesson dives into The Attack Landscape — the adversary's perspective. You'll learn the frameworks (Kill Chain, Diamond Model) that SOC analysts use to understand and categorize the attacks they see every day. Understanding the attacker's playbook is essential for recognizing their moves in the alert queue.