SOC Processes: normalisation, cases, automation and metrics
Domain 5 covers SOC processes in Cortex Cloud: how cloud findings become triaged, owned and closed incidents, and where automation may act. The exam frames this around detection and response - normalisation, correlation, case management and playbooks - rather than writing detection logic from scratch.
From alert to issue to case
Cloud runtime and posture signals land in the platform's data layer, are normalised, and correlation rules group related alerts into a single issue with severity and a suggested playbook. An analyst promotes an issue to a case when coordination is needed: owner, SLA, tasks, war room and audit trail. Notification-only flows such as email, Slack or webhook sit below this - useful for awareness, unsuitable as a system of record.
Automation
Playbooks run as entrypoint, task and condition graphs and call commands, including XQL queries, enrichment lookups and containment actions. Containment in cloud runtime means quarantining a container, killing a process or blocking a hash through policy; disruptive actions belong behind an approval task. Threat intelligence and sandbox verdicts enrich issues automatically so severity reflects known malicious behaviour.
Worked example
A Defender detects a known miner hash in a Kubernetes pod. The correlation rule raises one High issue covering the image across three namespaces rather than forty duplicate alerts. A playbook runs an XQL query to list every pod on the affected image, opens a case, posts to the incident channel, requests approval, then quarantines the pods and files a Jira ticket for the image owner. Mean time to respond is measured from issue creation to case closure.
Traps
Forwarding raw alerts into the SOC platform without deduplication - analysts drown and metrics inflate. Letting playbooks contain production workloads without an approval step. Measuring performance by alert count rather than issue closure and time to respond. Suppressing a noisy policy at the alert rule instead of scoping or fixing the policy, which hides genuine findings later.