Security Operations Center (SOC) Operations and Automation
Security Operations Center (SOC) Operations and Automation
This domain tests how a SOC runs as a production function: tiered triage, documented disposition, measured performance, tuned detection content and automation that does not create new risk. Expect scenario questions about what an analyst should do next and what a metric actually measures.
Tiering and the alert lifecycle
The usual model is Tier 1 triage, Tier 2 investigation and response, Tier 3 hunting, detection engineering and complex response, with engineering and threat intelligence supporting all tiers. Every alert follows: ingest, enrich (asset criticality, identity context, threat intelligence), triage against the playbook, escalate or close with a recorded disposition, then document. Closing an alert as benign requires evidence in the ticket, not an opinion.
Metrics and SLAs
- MTTD: time from event occurrence to detection.
- MTTA: time from alert generation to analyst acknowledgement.
- MTTR: time from detection to containment or resolution.
- Also track false-positive rate per rule, escalation accuracy, backlog age and automation coverage. SLAs should be set by severity, and severity by business impact and asset criticality, not by alert volume.
Detection content and automation
Use cases move through requirement, log onboarding, parsing and normalisation to a common schema, correlation rule, testing, tuning, documentation and periodic review. Automation via SOAR handles enrichment, ticket creation, notification, evidence gathering and containment with approval gates for destructive actions. Automate the repetitive and reversible; require human authorisation for isolation, account disablement and blocking at scale.
Worked example: a user reports a suspicious invoice email. The playbook extracts headers and URLs, detonates attachments in a sandbox, checks sender domain age and authentication results (SPF, DKIM, DMARC), and queries how many mailboxes received it. Two mailboxes clicked and one submitted credentials on a lookalike page. The playbook resets that credential, revokes sessions, purges the message from all mailboxes after approval, and blocks the domain. The ticket records each action, the message identifiers and the affected accounts.
Traps: closing as benign without recorded evidence; tuning a rule by disabling it; measuring MTTR from ticket creation instead of from detection; automating containment without an approval gate or rollback; ignoring time-zone normalisation when correlating logs.