What a SOC actually does
A Security Operations Center watches telemetry 24/7, triages alerts, investigates incidents, and feeds detections back into the estate. Tiers:
- Tier 1 — Triage: monitor queue, classify alerts (true positive / benign positive / false positive), follow playbooks, escalate.
- Tier 2 — Incident Responder: deep-dive investigations, containment actions, timeline building.
- Tier 3 — Hunter/Forensics: proactive threat hunting, malware analysis, IR leadership.
The SIEM pipeline
Collect (agents/syslog/APIs: endpoints via Sysmon+EDR, firewalls, AD, proxies, email gateway) → Normalize (CIM/ECS field mapping) → Correlate (rules: "5 failed logons then success from same source", "new admin group member + mailbox forward rule") → Alert → Respond (ticket + playbook).
Open-source stacks you can practice on at home, free: Wazuh (full SIEM+XDR), Elastic Security (free tier), Security Onion (NSM+IDS+SIEM in one), Graylog. Build a home lab: one VM generating logs, one Wazuh manager — that lab is your interview portfolio.
The triage decision loop
- Context first: who/what/when/where — asset criticality, user role, is this normal FOR THIS ENTITY (baseline!)?
- Enrich: threat intel on IPs/hashes/domains (VirusTotal, AbuseIPDB, internal feeds), historical alerts for the same entity.
- Decide: TP → playbook + escalate; BP → tune the rule; FP → document & tune.
- Document everything — the ticket IS the legal record.
Alert fatigue is the enemy. A SOC that clears 400 alerts at 2 minutes each is a SOC that misses the real one. Measure MTTD/MTTR, tune relentlessly, automate the boring 80%.