Soc Operations

SOC Operations

Purpose

Define SOC structure, analyst workflows, tier responsibilities, escalation paths, shift handovers, and SOC performance metrics. Build a high-performing security operations team that effectively detects, triages, investigates, and responds to security incidents.

Agent Protocol

Trigger

• "SOC", "security operations center", "SOC analyst", "SOC tier", "Tier 1", "Tier 2", "Tier 3"
• "security monitoring", "alert triage", "SOC workflow", "SOC runbook"
• "shift handover", "SOC dashboard", "SOC metrics", "MTTD", "MTTR"
• "escalation path", "security incident escalation", "SOC manager"
• "24/7 security coverage", "follow-the-sun", "SOC staffing"

Input Context

• Organization size, industry, and regulatory environment
• Existing security tools (SIEM, EDR, SOAR, email security)
• Current team size and skill levels (if any)
• Incident volume: alerts per day, incident types
• Coverage hours: 8x5, 24x7, follow-the-sun
• Compliance requirements for incident response

Output Artifact

SOC structure definition, tier workflows, escalation matrices, shift handover templates, metrics dashboards.

Response Format

## SOC Structure
{Role definitions, tier responsibilities, reporting lines}

## Workflow
{Alert triage flow, escalation criteria, investigation process}

## Metrics
{MTTD, MTTR, alert volume, false positive rate with targets}

Completion Criteria

• SOC structure defined with clear tier responsibilities and ratios
• Escalation paths documented with objective criteria
• Shift handover process defined with template
• Metrics defined with targets and measurement methods
• Runbook structure defined for top incident types
• Training and skill progression plan documented

Architecture / Decision Trees

SOC Structure Decision Tree

What is the organization size?
├── < 500 employees → MSSP (outsourced) or hybrid (managed EDR + internal triage)
├── 500-2000 employees → Hybrid SOC (Tier 1 internal, Tier 2/3 MSSP or part-time senior)
├── 2000-10000 employees → Internal SOC (Tier 1-2 internal, Tier 3 on-call senior)
└── > 10000 employees → Full internal SOC (Tier 1-3, threat intel, detection engineering)

What is the security maturity?
├── Level 1: Initial → Reactive, no SOC → Build Tier 1 triage capability
├── Level 2: Defined → Basic monitoring → Add Tier 2 investigation, SOAR automation
├── Level 3: Managed → Proactive detection → Add threat hunting, detection engineering
├── Level 4: Measured → Metrics-driven → Add purple team, threat intel integration
└── Level 5: Optimized → Predictive → Full SOC with all tiers, automation, intelligence

What are the coverage requirements?
├── 8x5 (business hours) → 3-5 analysts for single-shift coverage
├── 16x5 (extended hours) → 6-10 analysts for two shifts
├── 24x7 (follow-the-sun) → 12-15 analysts for three shifts + global coordination
└── 24x7 (internal night shift) → 15-20 analysts for four shifts (incl. night differential)

Sourcing Model Decision Tree

What is the budget for SOC?
├── High budget → Build internal SOC (all tiers)
│   └── Best for: Regulated industries, large enterprises, IP-sensitive companies
├── Medium budget → Hybrid (internal Tier 1, MSSP Tier 2/3)
│   └── Best for: Mid-size companies, growing security team
└── Low budget → Fully outsourced MSSP
    └── Best for: Small companies, startups, limited security requirements

Is retention of institutional knowledge critical?
├── Yes → Internal SOC (knowledge stays in-house)
└── No → MSSP or Co-managed SOC

Are there data sovereignty requirements?
├── Yes → SOC must be in-region (internal or regional MSSP)
└── No → Any sourcing model

Workflow

Step 1: SOC Tier Structure

Tier 1 — Triage Analyst: Role: First line of defense. Monitor alert queue, validate alerts, close false positives, escalate confirmed events.

• Skills: Basic security knowledge, SIEM query, log analysis, runbook following
• Ratio: 60-70% of SOC headcount
• Metrics: Alerts triaged per shift, triage accuracy, time to triage
• Escalation: Tier 2 for confirmed positives

Tier 2 — Incident Responder: Role: Deep investigation of confirmed incidents. Scope determination, containment, evidence collection.

• Skills: Advanced SIEM, EDR investigation, malware analysis, host/network forensics
• Ratio: 20-25% of SOC headcount
• Metrics: Investigation time, containment time, incidents handled per week
• Escalation: Tier 3 for complex incidents, APT, novel attack patterns

Tier 3 — Senior Investigator / Threat Hunter: Role: Advanced forensics, reverse engineering, threat hunting, detection engineering, tool tuning.

• Skills: Memory analysis, reverse engineering, Python scripting, threat intel, malware analysis
• Ratio: 10-15% of SOC headcount
• Metrics: Threat hunting hypotheses tested, detection rules created, investigation depth
• Escalation: CISO / Legal / PR for major incidents

SOC Manager: Role: Team management, resource planning, SLA monitoring, reporting, governance.

• Skills: Management, reporting, process improvement, vendor management
• Metrics: SOC maturity score, SLA compliance, team retention, budget adherence

Additional Roles (larger SOCs):

• Detection Engineer: Writes and tunes correlation rules, manages SIEM content
• Threat Intel Analyst: Manages intel feeds, produces CTI reports, supports hunting
• SOAR Engineer: Develops and maintains automation playbooks
• Forensic Analyst: Deep dive forensics (disk, memory, mobile, cloud)
• SOC Trainer: Maintains training program, runbook updates, tabletop exercises

Step 2: Alert Triage Workflow

Alert Generated by SIEM/EDR
          ↓
    Tier 1 Triage Queue
          ↓
 ┌──────────────────────────────────────────────┐
 │ Validate Alert                               │
 │ - Is the alert a true positive?              │
 │ - Is there supporting evidence?              │
 │ - Is this a known false positive?            │
 └──────────────────────────────────────────────┘
      ├── False Positive → Document reason → Close
      ├── Benign with context → Add note → Close
      └── True Positive → Assign Severity
                ↓
 ┌──────────────────────────────────────────────┐
 │ Determine Severity                           │
 │ - Affected asset criticality (CMDB)          │
 │ - User privilege level                       │
 │ - Attack stage (recon vs exfiltration)       │
 │ - Business impact                            │
 └──────────────────────────────────────────────┘
                ↓
 ┌──────────────────────────────────────────────┐
 │ Escalation Decision                          │
 │ - CRITICAL → Immediate Tier 2/3 escalation   │
 │ - HIGH → Tier 2 investigation within SLA     │
 │ - MEDIUM → Tier 2 investigation, non-urgent  │
 │ - LOW → Log for trend analysis               │
 └──────────────────────────────────────────────┘
                ↓
    Tier 2 Investigation Queue

Triage SLA Targets:

Step 3: Incident Investigation Process

Investigation Methodology (P.E.A.C.E.):

1. Prepare: Gather context — affected systems, users, data, timeline
2. Enumerate: Collect evidence — logs, memory, network captures, file systems
3. Analyze: Correlate evidence — process tree, network connections, user activity, lateral movement
4. Contain: Stop the spread — isolate endpoints, block IoCs, disable accounts
5. Eradicate: Remove threat — clean systems, patch vulnerabilities, rotate credentials

Tier 2 Investigation Playbook Template:

investigation_playbook:
  incident_type: "Unauthorized Access - External"
  
  phase1_initial_triage:
    - "Confirm alert validity from SIEM alert details"
    - "Identify affected user account(s) and resource(s)"
    - "Check if user reported suspicious activity"
    - "Determine authentication method and source IP"
    queries:
      siem_example: "index=windows EventCode=4625 AccountName=<username> | stats count by Source_Network_Address"
  
  phase2_enrichment:
    - "GeoIP lookup on source IP addresses"
    - "Threat intel check on source IP (VirusTotal, AlienVault)"
    - "Asset criticality lookup in CMDB"
    - "User's recent activity timeline (last 24h)"
    - "Check for related alerts from same source"
    queries:
      siem_correlation: "index=* source_ip=<ip> | timechart count by sourcetype"
  
  phase3_investigation:
    - "Review authentication logs for brute force patterns"
    - "Check for successful login after failed attempts"
    - "Review privileged access changes for affected account"
    - "Check mail forwarding rules (if email account)"
    - "Review API access tokens and OAuth grants"
    - "Check for lateral movement from affected endpoint"
  
  phase4_containment:
    - "HIGH priority: Disable compromised account"
    - "Revoke active sessions and tokens"
    - "Block source IP on firewall/WAF"
    - "Force password reset for affected user"
    - "Enable MFA if not already enabled"
    - "Check if other accounts are similarly exposed"
  
  phase5_eradication:
    - "Identify root cause: weak password, no MFA, credential stuffing"
    - "Implement compensating controls"
    - "Update detection rules for similar patterns"
    - "Rotate credentials accessed by compromised account"
  
  phase6_recovery:
    - "Verify account security: password reset, MFA enforced"
    - "Restore any modified configurations"
    - "Monitor for 48 hours post-remediation"
    - "Close incident with lessons learned"

Step 4: Escalation Matrix

escalation_criteria:
  tier1_to_tier2:
    triggers:
      - "Confirmed true positive (any severity)"
      - "Alert involving C-level executive or sensitive system"
      - "Alert correlation across 3+ data sources"
      - "Potential data exfiltration"
      - "User-reported phishing that evaded email security"
    method: "Assign in SOAR case management system"
    sla: "15 minutes"

  tier2_to_tier3:
    triggers:
      - "Confirmed APT or nation-state actor"
      - "Novel malware or zero-day exploit"
      - "Incident spanning 10+ endpoints"
      - "Evidence of data exfiltration"
      - "Ransomware with encryption in progress"
      - "Unable to determine scope with available tools"
      - "Legal or compliance notification required"
    method: "Page senior investigator + open bridge call"
    sla: "5 minutes for CRITICAL, 30 minutes for HIGH"

  soc_to_management:
    triggers:
      - "Confirmed data breach with PII exposure"
      - "Ransomware impacting business operations"
      - "Regulatory notification requirement (GDPR, CCPA)"
      - "Law enforcement involvement"
      - "PR-sensitive incident"
      - "Incident exceeding 4 hours containment SLA"
    method: "Notify CISO, Legal, PR via incident channel"
    sla: "Immediate for data breach, 15 minutes for other"

  soc_to_engineering:
    triggers:
      - "Application vulnerability identified during investigation"
      - "Misconfiguration in cloud infrastructure"
      - "EDR/SIEM coverage gap preventing investigation"
    method: "Create ticket, assign in incident review"
    sla: "Next business day"

Step 5: Shift Handover Process

Handover Structure (15-minute overlap minimum):

SHIFT HANDOVER REPORT
Date: 2026-06-01
Shift: Day (08:00-16:00) → Evening (16:00-00:00)
Handover By: Analyst Name
Handover To: Analyst Name

## Open Incidents
| ID | Severity | Type | Status | Owner | Next Action |
|----|----------|------|--------|-------|-------------|
| SOC-2026-042 | HIGH | Phishing | Investigating | jdoe | Review sandbox report |
| SOC-2026-043 | MEDIUM | Port Scan | Triaged | jdoe | Confirm source IP owner |

## Key Events This Shift
- 09:30 - Phishing campaign detected targeting finance dept (10 emails)
  - 5 emails deleted from inboxes, 5 users trained
  - Indicator blocked on email gateway
- 11:15 - Port scan detected from 203.0.113.50
  - Source is an MSSP scanner — added to allowlist
  - Tuned SIEM rule to exclude MSSP ranges
- 14:00 - EDR alert: suspicious PowerShell on HR-DB-01
  - Investigation in progress
  - Endpoint not yet isolated (DB server during business hours)
  - Next action: isolate at 18:00 if investigation not conclusive

## Pending Actions
- [ ] Update phishing rule to include new subject line patterns
- [ ] Request CMDB update for HR-DB-01 asset criticality
- [ ] Tune EDR exclusion for Nintex workflow tool (false positive)

## Threat Intelligence Highlights
- New Ryuk ransomware variant observed targeting healthcare
- Indicators: {ip_list, hash_list} in threat intel platform
- Please review relevant detection coverage on night shift

## Tools / System Status
- SIEM: Green (ingestion normal)
- EDR: Green (all endpoints reporting)
- Email Security: Yellow (delay in reporting — vendor ticket open)
- SOAR: Green

## Notes for Next Shift
- Infrastructure maintenance window: 02:00-04:00 (firewall firmware)
  - Expected: increased firewall logs, possible brief connectivity issues
- Incident response drill tomorrow 10:00 (phishing scenario)

Handover checklist:

• All open incidents have documented next actions and owners
• False positives from the shift are documented with tuning recommendations
• Tools and infrastructure status communicated
• Threat intelligence updates shared
• Maintenance windows and known issues communicated
• Runbooks and documentation updated with new findings
• Shift report saved to shared SOC knowledge base

Step 6: SOC Metrics and KPIs

Key Performance Indicators:

SOC Dashboard:

# SOC Dashboard Data Model
soc_dashboard = {
    "current_alerts": {
        "critical": 2,
        "high": 8,
        "medium": 15,
        "low": 34
    },
    "alerts_trend": {
        "last_24h": 240,
        "last_7d": 1680,
        "avg_per_day": 240,
        "change_vs_last_week": "+12%"
    },
    "false_positive_rate": {
        "current": "28%",
        "target": "< 30%",
        "trend": "improving"
    },
    "incident_response_metrics": {
        "mttd": {
            "avg": "45 min",
            "target": "< 60 min",
            "p95": "120 min"
        },
        "mtta": {
            "critical": "3 min",
            "high": "12 min",
            "medium": "45 min"
        },
        "mttr": {
            "critical": "22 min",
            "high": "2.5 hours",
            "medium": "8 hours"
        }
    },
    "sla_compliance": {
        "current": "96.5%",
        "target": "> 95%",
        "breached_today": 0
    },
    "team_capacity": {
        "analysts_online": 4,
        "alerts_per_analyst": 60,
        "backlog": 45,
        "oldest_uninvestigated": "2h 15m"
    }
}

Step 7: Shift Scheduling and Staffing

Staffing Ratios:

• Single SOC (8x5): 3-5 analysts for coverage, 1 manager
• Extended SOC (16x5): 6-10 analysts, 1-2 managers, rotation every 2 weeks
• 24x7 SOC (follow-the-sun): 12-15 analysts across 3 time zones, 1 SOC manager per region
• 24x7 SOC (in-house): 15-20 analysts for 4 shifts, shift differential pay

Optimal Shift Patterns:

Staffing Calculation:

Analysts Needed = (Hours per day × Days per week) / (Hours per shift × Shifts per week per analyst)

Example (24x7 coverage, 8-hour shifts, 40-hour week):
Analysts = (24 × 7) / (8 × 5) = 168 / 40 = 4.2 → 5 analysts minimum
With PTO, sick leave, training: 5 × 1.5 = 8 analysts recommended

Step 8: Knowledge Management and Training

SOC Knowledge Base Structure:

SOC-KB/
├── 01-Runbooks/
│   ├── phishing.md
│   ├── malware.md
│   ├── ransomware.md
│   ├── unauthorized-access.md
│   ├── data-exfiltration.md
│   ├── ddos.md
│   └── insider-threat.md
├── 02-Playbooks/
│   ├── soi-engineering/ (SOAR playbook documentation)
│   └── automation-flows/
├── 03-Tool-Guides/
│   ├── siem-query-library.md
│   ├── edr-investigation.md
│   ├── email-security.md
│   └── forensic-tools.md
├── 04-Cheat-Sheets/
│   ├── mitre-attack-mappings.md
│   ├── log-sources-reference.md
│   ├── ioc-extraction-patterns.md
│   └── splunk-kql-queries.md
├── 05-Lessons-Learned/
│   ├── incident-post-mortems/
│   └── quarterly-trend-reports/
└── 06-Training/
    ├── new-analyst-onboarding.md
    ├── tier-1-to-tier-2-progression.md
    └── certification-track.md

Training Program:

• Month 1-2: New analyst onboarding (tool training, runbook study, shadowing senior analysts)
• Month 3-4: Supervised triage (reviewed by Tier 2, accuracy tracking)
• Month 5-6: Independent triage (all alert types, escalation decisions)
• Ongoing: Weekly training session (1 hour: new techniques, tool updates, incident reviews)
• Quarterly: Tabletop exercise (simulated incident, team response validation)
• Annual: Certification support (SANS, CISSP, Security+, CEH)

Step 9: Tabletop Exercises and Drills

Exercise Types:

Tabletop Scenario Template:

scenario: "Ransomware Attack - Initial Access via Phishing"
participants: [Tier 1, Tier 2, SOC Manager, IT Engineering]
duration: 90 minutes

phase1_injection:
  time: "T+0"
  inject: "EDR alerts: PowerShell executing encoded command on workstations 3-5"
  expected_actions:
    tier1: "Validate alert, check process tree, escalate to Tier 2"
    tier2: "Investigate parent process, check email gateway for related phishing"

phase2_expansion:
  time: "T+15"
  inject: "Files with .encrypted extension appearing on share drive"
  expected_actions:
    tier2: "Confirm ransomware, isolate affected endpoints, initiate IR"
    soc_manager: "Declare incident, assemble response team"

phase3_containment:
  time: "T+30"
  inject: "Domain controller showing anomalous activity"
  expected_actions:
    tier2: "Isolate all affected systems, block C2 IPs on firewall"
    tier3: "Analyze ransomware sample, determine encryption method"

phase4_recovery:
  time: "T+60"
  inject: "Backup team confirms clean backups available"
  expected_actions:
    tier2: "Verify no lateral movement, begin restore process"
    soc_manager: "Update stakeholders, prepare incident report"

phase5_debrief:
  time: "T+90"
  inject: "Scenario complete"
  expected_actions:
    all: "Lessons learned, detection gaps, process improvements"

Common Pitfalls

Pitfall 1: Insufficient Tier 1 Training

Tier 1 analysts without adequate training miss true positives and escalate false positives. Invest 4-6 weeks of onboarding before independent triage.

Pitfall 2: No Clear Escalation Criteria

Without documented escalation criteria, analysts either escalate everything (overwhelming Tier 2) or escalate nothing (missing incidents). Define objective criteria with examples.

Pitfall 3: Alert Fatigue

Too many alerts desensitize analysts and cause real incidents to be missed. Invest in tuning to reduce alert volume. Target: < 100 alerts per analyst per day.

Pitfall 4: Burnout from Shift Work

Night shifts, rotating schedules, and high-pressure environments cause burnout. Rotate shifts every 2 weeks, provide shift differential, enforce PTO. Monitor for burnout indicators.

Pitfall 5: No Knowledge Transfer

Institutional knowledge lost when analysts leave. Maintain runbooks, document investigation techniques, record shift handovers. Require knowledge base contributions.

Pitfall 6: Measuring Wrong Metrics

Tracking volume only (alerts processed) without quality (accuracy, containment time) rewards speed over effectiveness. Balance volume and quality metrics.

Pitfall 7: Ignoring Threat Intelligence

SOC disconnected from threat intelligence misses relevant threats. Integrate CTI feeds into SIEM, brief analysts on current threats at shift start.

Pitfall 8: No Career Progression

Without growth path, good analysts leave. Define Tier 1→2→3 progression with clear criteria. Support certifications and conference attendance.

Pitfall 9: Runbooks Not Updated

Outdated runbooks cause investigation delays. Runbooks reviewed quarterly and updated after each major incident. Version-controlled in knowledge base.

Pitfall 10: Understaffing During Peak Times

Staffing for average volume fails during incidents or campaigns. Build in 30% capacity buffer. Have on-call escalation for surge events.

Best Practices

• Implement clear tier structure: Tier 1 (triage), Tier 2 (investigation), Tier 3 (advanced/specialized)
• Automate triage for common alerts: known FPs auto-closed, known IoCs auto-escalated
• Maintain runbooks for top 20 incident types with step-by-step investigation procedures
• Conduct bi-weekly purple team exercises to validate detection and response
• Track analyst progression with skill matrix: SIEM, EDR, forensics, cloud, malware analysis
• Implement shift handover with mandatory 15-minute overlap for knowledge transfer
• Measure what matters: MTTA, MTTR, triage accuracy, false positive rate, SLA compliance
• Invest in training: weekly 1-hour sessions, quarterly tabletops, annual certifications
• Build knowledge base: document every investigation, update runbooks, share lessons learned
• Use threat intelligence in operations: brief analysts on current threats, integrate into SIEM
• Plan for analyst burnout: rotate shifts, enforce breaks, monitor workload
• Budget for 30% capacity buffer above average alert volume for surge events

Performance Considerations

• Triage capacity: experienced Tier 1 handles 50-100 alerts per 8-hour shift
• Investigation time: Tier 2 investigation averages 30-60 minutes per confirmed incident
• MTTR improvement: automation reduces containment time 40-60% for playbook-covered incidents
• False positive reduction: mature tuning program reduces FP rate from 50%+ to under 30% in 6 months
• Tool integration: integrated SIEM+SOAR reduces average investigation time 25-35%
• Training ROI: well-trained analysts have 20% higher triage accuracy and 15% faster MTTA

SOC Maturity Model

Rules

• Every alert must be triaged within SLA based on severity (CRITICAL: 5min, HIGH: 15min, MEDIUM: 1h, LOW: 24h)
• Tier 1 must not investigate for more than 15 minutes — escalate if not conclusive
• All investigation steps must be documented in the case management system
• Shift handover must include open incidents, pending actions, and tool status
• Runbooks must be updated within 5 business days after each major incident
• False positive rate must be tracked per rule and per analyst
• No alert should be closed without a documented disposition reason
• Escalation criteria must be objective and documented — never subjective
• Weekly SOC meeting: review top incidents, tuning opportunities, threat intel updates
• Monthly trend report: alert volume, incident types, SLA compliance, team performance
• Quarterly tabletop exercise with all tiers to validate processes

References

• references/soc-metrics.md — SOC Metrics and Reporting
• references/soc-operations-advanced.md — Soc Operations Advanced Topics
• references/soc-operations-fundamentals.md — Soc Operations Fundamentals
• references/soc-runbooks.md — SOC Runbook Templates
• references/soc-structure.md — SOC Structure
• references/threat-hunting.md — Threat Hunting in SOC
• references/triage-procedures.md — Alert Triage Procedures

Handoff

Output artifacts can be handed to devops-monitoring for SIEM integration, or management for org planning.