Lesson 1.1: What a SOC does
A security operations centre (SOC) is the team that watches an organisation's systems around the clock, decides which alerts matter and responds. Its core loop is triage: look at an alert, decide quickly whether it's real, how serious it is and what belongs together, then close it or escalate it. In the lab you start a night shift at Northwind's SOC with fourteen alerts in the queue. You sort them by severity, group them into incidents, set aside documented false positives, and write the handover note that sends the right two problems to the right people.
15 min
You will learn to
- Describe a SOC's roles and tiers
- Explain the alert lifecycle
- Triage a queue by severity
- Group related alerts into incidents
- Write a useful shift handover
Key terms
- SOC
- Security operations centre: the team, processes and tools that monitor, detect and respond to security events.
- SIEM
- Security information and event management: collects logs from many sources, normalises them, correlates them and raises alerts.
- Triage
- Quickly deciding whether an alert is real, how serious it is and what to do next.
- Tiers (L1/L2/L3)
- L1 triages alerts, L2 investigates and responds, L3 hunts threats and builds detections.
- True / false positive
- An alert about real malicious activity, or about something harmless.
- MTTD / MTTR
- Mean time to detect and mean time to respond: how quickly the SOC notices and acts.
All lessons · Cloud models and shared responsibility →