A [[Security Operations]] centre (**SOC**) is an organisational unit dedicated to monitoring networks, systems, and devices for security threats or attacks. Structurally, a SOC (usually pronounced "sock") often *exists as its own separate unit or within a [[Computer Security Incident Response Teams|CSIRT]]*. You may be familiar with the term blue team, which refers to the security professionals who are responsible for defending against all security threats and attacks at an organization. A SOC is involved in various types of blue team activities, such as network monitoring, analysis, and response to incidents. ![[SOC.png]] #### Tier 1 SOC analyst The first tier is composed of the least experienced SOC analysts who are known as level 1s (L1s). They are responsible for: - Monitoring, reviewing, and prioritising alerts based on criticality or severity - Creating and closing alerts using ticketing systems - Escalating alert tickets to Tier 2 or Tier 3 #### Tier 2 SOC analyst The second tier comprises the more experienced SOC analysts, or level 2s (L2s). They are responsible for: - Receiving escalated tickets from L1 and conducting deeper investigations - Configuring and refining security tools - Reporting to the SOC Lead #### Tier 3 SOC lead The third tier of a SOC is composed of the SOC leads, or level 3s (L3s). These highly experienced professionals are responsible for: - Managing the operations of their team - Exploring methods of detection by performing advanced detection techniques, such as malware and forensics analysis - Reporting to the SOC manager #### SOC manager The SOC manager is at the top of the pyramid and is responsible for: - Hiring, training, and evaluating the SOC team members - Creating performance metrics and managing the performance of the SOC team - Developing reports related to incidents, compliance, and auditing - Communicating findings to stakeholders such as executive management #### Other roles SOCs can also contain other specialised roles such as: - *Forensic investigators*: Forensic investigators are commonly L2s and L3s who collect, preserve, and analyse digital evidence related to security incidents to determine what happened. - *Threat hunters*: Threat hunters are typically L3s who work to detect, analyse, and defend against new and advanced cybersecurity threats using threat intelligence.