Foundations of SOC Operations
What the exam tests
This domain covers how a security operations center actually runs: tiered roles, the alert-to-case lifecycle, escalation and shift handover, documentation standards, and the metrics leadership uses to judge the SOC.
Core rules
- Tier 1 triages and disposes; Tier 2 investigates and contains; Tier 3 hunts, engineers detections, and runs major incidents. Escalation criteria live in the runbook, not in individual judgement.
- Severity describes technical impact (malware on a domain controller is high). Priority describes business urgency (a regulated system offline is urgent). They are separate ticket fields.
- Every alert gets a documented disposition: true positive, false positive, benign true positive, or undetermined. Closing with an empty note is itself a finding against the analyst.
- MTTD measures detection, MTTA acknowledgement, MTTR response. A fast MTTR sitting behind slow detection is not a healthy SOC.
- Handover must carry open cases, pending containment, and time-bound actions, for example a host quarantined for 24 hours needs a named owner before the shift ends.
Worked example
EDR flags rundll32.exe loading a DLL from C:\Users\Public\. Tier 1 confirms the host is patched and the user is in finance. Correct disposition: escalate to Tier 2, not close as benign. Reasoning: rundll32 is a signed Windows binary, the load path is user-writable, and DLL side-loading is a standard execution technique. Patch status is irrelevant because no vulnerability is being exploited. Tier 1 records the process tree, parent process, and DLL hash, then assigns the case.
Traps
- Closing because the user said it was nothing, with no telemetry corroboration.
- Conflating severity and priority in the ticket, which corrupts reporting.
- Reporting raw alert counts as success; volume measures noise, not detection coverage.
- Escalating everything to Tier 2, which destroys the tier model and delays real incidents.