# 【7-2】 Inside a Security Operations Center (SOC): Roles and Workflows
*How Defensive Security Operates in Practice*

---

## Introduction

A **Security Operations Center (SOC)** is where defensive cybersecurity happens day to day.
It is a centralized team responsible for monitoring, detecting, analyzing, and responding to security threats across an organization.

SOCs operate continuously, often 24/7, and are designed to ensure that suspicious activity is identified and addressed as quickly as possible.

This section explores how a SOC is structured, the roles within it, and the workflows that keep it running.

---

## What Is a SOC?

A **Security Operations Center** is a combination of:
- People
- Processes
- Technology

Working together to defend an organization’s digital assets.

The SOC serves as the central hub for:
- Security monitoring
- Incident triage
- Investigation and response
- Communication and escalation

---

## Core Responsibilities of a SOC

SOC teams are responsible for:
- Continuous monitoring of logs and alerts
- Investigating suspicious activity
- Responding to confirmed incidents
- Coordinating with IT and DFIR teams
- Maintaining visibility across systems

Their mission is to **reduce attacker dwell time**.

---

## SOC Roles and Responsibilities

### Tier 1: SOC Analyst (Alert Triage)

Tier 1 analysts are the first line of defense.

Responsibilities include:
- Monitoring alerts from SIEM and EDR tools
- Filtering false positives
- Performing initial analysis
- Escalating validated incidents

Speed and accuracy are critical at this level.

---

### Tier 2: SOC Analyst (Incident Investigation)

Tier 2 analysts handle deeper investigations.

Responsibilities include:
- Correlating logs and data sources
- Analyzing indicators of compromise
- Investigating suspicious behavior
- Supporting containment actions

Tier 2 focuses on **analysis and context**.

---

### Tier 3: SOC Analyst (Threat Hunting and Advanced Analysis)

Tier 3 analysts handle advanced threats.

Responsibilities include:
- Threat hunting
- Malware and memory analysis
- Detection engineering
- Improving SOC processes

Tier 3 analysts focus on **proactive defense**.

---

### SOC Manager

The SOC manager oversees operations.

Responsibilities include:
- Managing staff and schedules
- Defining procedures and priorities
- Coordinating with leadership
- Ensuring compliance and reporting

Leadership ensures consistency and quality.

---

### Supporting Roles

Other roles may include:
- Incident responders
- Threat intelligence analysts
- Detection engineers
- DFIR specialists

SOCs are collaborative by design.

---

## SOC Workflow Overview

A typical SOC workflow follows these steps:

1. Alert generation
2. Alert triage
3. Investigation
4. Containment and response
5. Documentation and reporting
6. Improvement and tuning

This cycle repeats continuously.

---

## Alert Triage Process

Most alerts are benign or false positives.

SOC analysts must:
- Validate alert context
- Check asset criticality
- Assess severity
- Decide whether to escalate

Effective triage prevents alert fatigue.

---

## Investigation and Escalation

When an alert is confirmed:
- Analysts gather evidence
- Correlate across systems
- Identify scope and impact
- Escalate to incident response if needed

Clear escalation paths are essential.

---

## Communication and Coordination

SOC teams must communicate with:
- IT operations
- Management
- Legal and compliance
- External partners

Clear communication reduces confusion during incidents.

---

## Metrics and Performance

Common SOC metrics include:
- Mean time to detect (MTTD)
- Mean time to respond (MTTR)
- Alert volume and false positives
- Incident severity trends

Metrics drive improvement.

---

## Common Challenges in SOC Operations

- Alert fatigue
- Tool overload
- Skill gaps
- Communication breakdowns
- Burnout

Process and automation help mitigate these challenges.

---

## Reflection

1. Why is alert triage critical in SOC operations?
2. How do different SOC tiers support each other?
3. Why is communication as important as technical skill in a SOC?

---

## Summary

- A SOC is the operational center of defensive security
- Roles are divided by responsibility and depth
- Workflows emphasize detection, investigation, and response
- Metrics and communication drive effectiveness
- SOC operations are continuous and adaptive

> In the next section, you will explore **【7-3】 SIEM and Log Management**, where SOC teams gain visibility into security events.