What a SOC Actually Does

A Security Operations Center is the team and tooling responsible for monitoring, detecting, and responding to threats around the clock. Its currency is the alert, and its enemy is noise.

Typical tiers: Tier 1 analysts triage alerts and escalate. Tier 2 analysts investigate and contain. Tier 3 / threat hunters proactively search for what the alerts missed.

The core loop is Detect → Triage → Investigate → Contain → Eradicate → Recover → Learn. Every mature SOC obsesses over MTTD (mean time to detect) and MTTR (mean time to respond).

A good analyst asks three questions of every alert: Is it true? Is it bad? Is it spreading? Everything else is detail.