Security Operations Fundamentals
Security Operations Fundamentals is the foundation domain of the Cisco CyberOps Professional (350-201 CBRCOR) blueprint. It tests how a SOC converts raw telemetry into validated, prioritized incidents, and whether you understand the operational hygiene that makes detection and response trustworthy.
The SOC pipeline
- Telemetry sources: Cisco Secure Firewall/FTD and IPS logs, Umbrella DNS and proxy events, Secure Endpoint telemetry, ISE/Duo identity events, NetFlow from Secure Network Analytics, cloud audit logs, and application logs.
- SIEM processing: collection, parsing/normalization to a common schema, enrichment (asset criticality, geoIP, threat intelligence), correlation, alerting, and retention.
- Tiering: Tier 1 triage, Tier 2 investigation, Tier 3 hunting/IR. Escalation criteria belong in documented playbooks, not in individual judgment alone.
- Severity vs priority: severity is technical impact; priority adds asset value, data sensitivity, and business context.
- Operational metrics: MTTD, MTTR, dwell time, alert fidelity/false-positive rate, and escalation accuracy.
- Hygiene: NTP time sync, UTC normalization, log integrity (hashing/checksums), source health monitoring, and retention aligned to policy.
Worked example
Umbrella flags a DNS query to a newly registered domain from a finance laptop. FTD shows no IPS hit. Reasoning: enrich the domain with age and reputation, check Secure Endpoint for the process that made the query, confirm asset criticality, and compare proxy logs. If endpoint telemetry shows an Office macro spawning PowerShell, escalate to Tier 2 and isolate the host. If it was only a browser prefetch and the domain is benign, close with a tuning note. The single DNS alert alone is not proof of compromise.
Traps that cost marks
- Treating a SIEM correlation alert as confirmed compromise.
- Ignoring timezone or NTP drift, which breaks timelines.
- Closing on a single source without enrichment or asset context.
- Confusing severity with priority.
- Forgetting that log retention and integrity affect later forensic use.
Key points
- The SOC pipeline is collect, normalize, enrich, correlate, alert, triage, escalate.
- Severity is technical; priority is business-aware.
- MTTD and MTTR measure detection and response performance.
- NTP and UTC normalization are prerequisites for reliable timelines.
- Single-source alerts require enrichment before escalation or closure.