SOC work builds on foundations from Year 1:

Opening Framing: From Theory to Practice

You've learned how systems work, how networks communicate, and how attacks unfold. Now you step into the defender's seat. Security Operations is where all that knowledge becomes action—where you watch for threats in real-time and respond when they appear.

Think of a Security Operations Center (SOC) as mission control for cybersecurity. Analysts monitor dashboards, investigate alerts, coordinate responses, and hunt for threats that automated tools miss. It's demanding, fast-paced work that requires both technical skill and clear thinking under pressure.

This course transforms you from someone who understands security to someone who practices it daily. By the end, you'll have the skills to work as a SOC analyst—one of the most in-demand roles in cybersecurity.

Key insight: Security operations isn't about preventing every attack— that's impossible. It's about detecting threats quickly, responding effectively, and continuously improving defenses.

1) What is Security Operations?

Security Operations encompasses all activities involved in defending an organization in real-time:

Security Operations Functions:

Monitoring:
- Watch for suspicious activity 24/7
- Review alerts from security tools
- Track security metrics and trends

Detection:
- Identify potential threats
- Distinguish real attacks from false positives
- Recognize attack patterns and indicators

Response:
- Contain active threats
- Investigate incidents
- Coordinate remediation efforts

Improvement:
- Learn from incidents
- Tune detection rules
- Close security gaps

The Security Operations Cycle:

    ┌─────────────────────────────────────────┐
    │                                         │
    ▼                                         │
┌────────┐    ┌────────┐    ┌────────┐    ┌───┴────┐
│Monitor │───>│ Detect │───>│Respond │───>│Improve │
└────────┘    └────────┘    └────────┘    └────────┘
    │                                         ▲
    │                                         │
    └─────────────────────────────────────────┘

This cycle runs continuously, 24/7/365

Why Security Operations Matters:

Without SecOps:
- Attacks go undetected for months
- Small incidents become major breaches
- No coordinated response capability
- Lessons never learned, mistakes repeated

With mature SecOps:
- Threats detected in minutes/hours
- Rapid containment limits damage
- Coordinated, effective response
- Continuous improvement over time

Industry statistics:
- Average time to detect breach without SOC: 287 days
- Average time with mature SOC: under 24 hours
- Cost difference: millions of dollars

Key insight: Security tools alone don't protect organizations— skilled people operating those tools do. Technology enables detection; humans provide judgment.

2) The Security Operations Center (SOC)

The SOC is the organizational hub for security operations:

SOC Components:

People:
- Analysts (Tier 1, 2, 3)
- Incident responders
- Threat hunters
- SOC manager
- Threat intelligence analysts

Process:
- Alert triage procedures
- Incident response playbooks
- Escalation procedures
- Communication protocols
- Shift handoff procedures

Technology:
- SIEM (Security Information and Event Management)
- EDR (Endpoint Detection and Response)
- SOAR (Security Orchestration and Response)
- Threat intelligence platforms
- Ticketing systems

SOC Analyst Tiers:

Tier 1 - Alert Analyst:
- First responder for alerts
- Initial triage and classification
- Follow documented procedures
- Escalate complex issues
- High volume, fast decisions

Tier 2 - Incident Responder:
- Deep investigation of escalated alerts
- Incident containment and remediation
- Malware analysis (basic)
- Develops detection rules
- Mentors Tier 1 analysts

Tier 3 - Threat Hunter / Senior Analyst:
- Proactive threat hunting
- Advanced malware analysis
- Detection engineering
- Incident response leadership
- Process improvement

Career progression:
Tier 1 (6-12 months) → Tier 2 (1-2 years) → Tier 3 (2+ years)
                                            ↓
                                    Specialization paths:
                                    - Threat Intel
                                    - Incident Response
                                    - Detection Engineering
                                    - SOC Management

SOC Models:

Internal SOC:
- Fully staffed by organization
- Complete control and visibility
- High cost (24/7 staffing expensive)
- Best for large enterprises

Managed SOC (MSSP):
- Outsourced to security provider
- Lower cost, faster deployment
- Less organizational context
- Good for mid-size organizations

Hybrid SOC:
- Internal team + managed services
- Balance of control and cost
- Follow-the-sun coverage
- Common model for many organizations

Virtual SOC:
- Remote/distributed team
- Cloud-based tools
- Flexible staffing
- Growing post-pandemic

Key insight: The SOC model matters less than its effectiveness. A well-run small SOC beats a poorly managed large one.

3) Security Data Sources

SOC analysts work with data from across the organization:

Network Data:
- Firewall logs (allowed/denied connections)
- IDS/IPS alerts (detected attacks)
- NetFlow (connection metadata)
- DNS logs (domain queries)
- Proxy logs (web access)
- Packet captures (full traffic)

Endpoint Data:
- Windows Event Logs (authentication, process, etc.)
- Sysmon (detailed system activity)
- EDR telemetry (process, file, network activity)
- Antivirus logs (detections, quarantine)
- Application logs

Identity Data:
- Active Directory logs (authentication, changes)
- VPN logs (remote access)
- SSO/MFA logs (authentication events)
- Privileged access logs

Cloud Data:
- Cloud provider logs (AWS CloudTrail, Azure Activity)
- SaaS application logs (O365, Google Workspace)
- Container/Kubernetes logs
- Serverless function logs

Application Data:
- Web server logs (access, errors)
- Database logs (queries, authentication)
- Custom application logs

Log Volume Reality:

Typical enterprise generates:
- Firewall: 10-100 million events/day
- Windows events: 1-10 million events/day per DC
- DNS: 50-500 million queries/day
- Proxy: 10-100 million requests/day

Total: Billions of events per day

Challenge: Find the 10-100 that matter

This is why we need:
- Aggregation (collect in one place)
- Normalization (common format)
- Correlation (connect related events)
- Alerting (surface important events)
- Retention (keep for investigation)

Key insight: More data isn't always better. The skill is knowing which data sources matter for which threats, and how to find signals in the noise.

4) The Detection Pyramid

Not all indicators are equal. The Pyramid of Pain shows why:

                    △
                   /T\        TTP (Tactics, Techniques, Procedures)
                  /T T\       - How attackers operate
                 /-----\      - Hardest to change
                / Tools \     - Most valuable detection
               /---------\
              / Artifacts  \  Network/Host Artifacts
             /---------------\ - Registry keys, file paths
            /   Domain Names   \ - Useful but changeable
           /---------------------\
          /     IP Addresses       \  - Easy for attackers to change
         /---------------------------\
        /        Hash Values           \ - Trivial to change
       /-----------------------------------\

Bottom of pyramid:
- Easy to detect
- Easy for attacker to change
- Low long-term value

Top of pyramid:
- Hard to detect
- Hard for attacker to change
- High long-term value

Detection Examples by Level:

Hash Values (trivial):
- Block known malware hash
- Attacker recompiles, new hash
- Detection value: hours

IP Addresses (easy):
- Block known C2 IP
- Attacker switches servers
- Detection value: days

Domain Names (simple):
- Block malicious domain
- Attacker registers new domain
- Detection value: days-weeks

Artifacts (annoying):
- Detect specific registry key
- Attacker modifies tool
- Detection value: weeks-months

Tools (challenging):
- Detect Mimikatz behavior
- Attacker uses different tool
- Detection value: months

TTPs (tough):
- Detect credential dumping technique
- Attacker must change approach
- Detection value: long-term

Detection Strategy:

Layered approach:
1. Use IOCs (hashes, IPs, domains) for known threats
   - Fast to implement
   - Catches commodity attacks
   - Low false positives

2. Use behavioral rules for techniques
   - More complex to build
   - Catches novel attacks
   - May have false positives

3. Hunt for TTPs manually
   - Most resource intensive
   - Catches advanced threats
   - Requires skilled analysts

Balance depends on:
- Team maturity
- Threat landscape
- Available resources

Key insight: Investing in behavioral detection (TTPs) provides lasting value. Hash-based detection is necessary but insufficient.

5) Day in the Life of a SOC Analyst

What does SOC work actually look like?

Shift Start (Example: 7:00 AM):
- Review shift handoff notes
- Check overnight incidents
- Review open tickets
- Scan threat intel feeds
- Check dashboard for anomalies

Morning:
- Triage incoming alerts (queue of 50-200)
- Investigate suspicious alerts
- Escalate confirmed incidents
- Document findings in tickets
- Tune noisy rules

Afternoon:
- Continue alert triage
- Deep dive on escalated incidents
- Attend team standup
- Review new threat intel
- Work on detection improvements

Shift End:
- Clear or escalate remaining alerts
- Update tickets with status
- Prepare handoff notes
- Brief incoming analyst

Alert Triage Reality:

Typical alert breakdown:
- True Positive: 5-10% (real threats)
- Benign True Positive: 10-20% (real but authorized)
- False Positive: 70-85% (incorrect alerts)

Analyst goal:
Find the 5-10% that matter among hundreds of alerts

Time per alert:
- Quick triage: 1-2 minutes
- Initial investigation: 5-15 minutes
- Deep investigation: 30-60+ minutes

Volume:
- Tier 1 might handle 50-100 alerts per shift
- Quality matters more than quantity

Common Challenges:

Alert fatigue:
- Too many alerts, most false positives
- Important alerts get missed
- Solution: Better tuning, prioritization

Context switching:
- Constantly jumping between alerts
- Hard to focus on deep investigation
- Solution: Dedicated investigation time

Tool sprawl:
- Multiple consoles to check
- Data in different formats
- Solution: SIEM/SOAR integration

Knowledge gaps:
- New attack techniques emerge
- Environment constantly changing
- Solution: Continuous learning, documentation

Key insight: SOC work is mentally demanding. Success requires both technical skill and the discipline to follow process even when tired or overwhelmed.

Real-World Context: SOC in Action

Security operations responds to real threats daily:

Ransomware Response: When ransomware hits, the SOC coordinates the response—identifying patient zero, determining scope, containing spread, and supporting recovery. Speed matters: every minute of delay means more systems encrypted.

Phishing Campaigns: Users report suspicious emails. The SOC analyzes them, identifies malicious links or attachments, searches for other recipients, and blocks the threat across the organization—often within minutes of the first report.

Active Intrusion: An alert fires showing suspicious PowerShell activity. The SOC investigates, finds evidence of an attacker moving laterally, and coordinates with IT to isolate affected systems while preserving evidence.

MITRE ATT&CK Relevance:

• All Tactics: SOC must detect across the full attack lifecycle
• D3FEND: Defensive techniques mapped to ATT&CK
• Detection Coverage: Measure which techniques you can detect

Key insight: SOC analysts are the human element in defense. Automated tools detect patterns; analysts provide judgment and coordination that tools cannot.

Guided Lab: Exploring Security Data

Let's explore the types of security data a SOC analyst works with.