A security operations center (SOC) is a team of security specialists that monitors an organisation's IT environment day and night. The SOC collects signals from laptops, servers, accounts and cloud, assesses which alerts are real and steps in as soon as an attack is under way. That can be an in-house team or a service you buy.
That is the SOC explained in three sentences.
The first SOC service is, of course, continuous monitoring of systems, applications, employees (accounts), cloud and network. A SOC collects logs and signals from these entities and brings them together in a SIEM (Security Information and Event Management). This is a central platform where all these logs come together and where the system can also learn what is normal for your organisation.
Sunday, 13:35. A mailbox suddenly creates a whole set of forwarding rules to external email addresses. On their own, those are just a few log lines among millions. But a SOC sees this because someone is watching and because it is set up to monitor for exactly this, also at weekends and during the Christmas holidays.
Most alerts are noise. Think of an employee logging in from their holiday address in Spain, or an administrator running a script late in the evening to test something quickly.
Triage is the decision: is this a real threat or not? The analyst puts the alert in context. Who is this user, which device is it, have we seen this pattern before? A false alarm is closed and a real threat goes straight to investigation. This is the largest part of the work in a SOC and the part where experience and knowledge make the difference.
Once an attack is confirmed, every minute counts. Incident response therefore starts with containment: blocking the account, revoking sessions, isolating the device from the network, removing malware. Next, the threat has to be eliminated by removing the malware from the systems and restoring accounts. After that comes recovery and evaluation. Everything is recorded, so you know later what happened and can back up any report you have to file.
Triage waits for an alert, but threat hunting does not. A threat hunter starts from an assumption/hypothesis: suppose someone is already inside and not a single rule has fired. Where would that person leave traces?
Threat hunting is about proactively searching for threats, but also about searching for traces after a cyber attack or attempt. There are often separate teams within the SOC that take on this work.
A SOC does not only work with what it sees in your environment. Threat intelligence is knowledge from outside: which hacker groups are active right now, which techniques they use, which domains and IP addresses they use, which vulnerability is being exploited this week. That way a SOC can recognise an attack that has already been seen at another company before it does damage at yours.
A SOC is people's work, even though there is a lot of software and AI around it. And because an attack does not keep office hours, there is usually always someone on duty or on call outside office hours. But beyond analysts, a SOC often has many more roles.
The analysts are the core. A SOC often works with tiers (although it does not have to): a tier 1 analyst assesses incoming alerts and escalates, a tier 2 analyst does the deeper investigation and determines how big an incident is. Good analysts combine knowledge of attack techniques with knowledge of the environment they monitor.
As soon as an analyst confirms a real incident, the incident responder takes over. Here too: this is not a must. The SOC analyst may also take on this role. Beyond that, an incident responder makes sure the attack is contained, finds out how far the attacker got and makes sure malware is eliminated. A large part of the work is communication: with management, with your IT provider and sometimes with other parties as well. A responder also builds the timeline you need if you have to report an incident.
A SOC is only as good as its detection rules. Detection engineers write those rules and fine-tune them. Too broad and the analysts drown in false alerts. Too strict and a real attack may slip through. Their work is therefore endless fine-tuning, based on what the analysts report back and what threat intelligence delivers.
At Peakproteqt, more than 200 unique detection rules run as standard and we are continuously improving them. Attacks change, become outdated, or the systems the logs come from change. That is why it is important to keep testing and fine-tuning where needed.
The SOC manager keeps everything running: rosters, priorities, escalations and reporting. They steer on metrics such as mean time to detect (MTTD) and mean time to recover (MTTR) and are the point of contact when a client or management wants to know where things stand.
This is by no means the full list of roles you find in a SOC, but these are the most common ones. A SOC is a complex process in which much more happens than most people think.
Your own security operations center gives you maximum control. Your team knows every server, every user and every odd process that turns out to be normal after all. But there is a lot on the other side of the scale. For 24/7 coverage you need five to six analysts, plus a team lead (SOC manager) and a security engineer. Building it up easily takes 6 to 12 months. In our article in-house SOC vs Managed SOC we calculate that your own SOC costs between €400,000 and €700,000 a year.
The Dutch NCSC factsheet SOC inrichten: begin klein (Setting up a SOC: start small) states: "Setting up a full SOC from scratch is a challenging task." For example, there are few experts to be found.
You can outsource it as SOC-as-a-Service. You then buy the analysts, tooling and service and pay per workstation instead of per salary. At Peakproteqt that is €15.72 per workstation per month, excluding VAT, and the monitoring runs on your environment within two to four weeks.
Our position is clear. For an SME with 20, 50 or 150 employees, outsourcing is as a rule the only realistic way to be properly monitored. Your own SOC only starts to make sense at around 250 employees, and even then the question remains whether you can find the right people.
