The SOC, SIEM & Log Management¶

The Security Operations Center (SOC) is where detection and response happen. This is where most cybersecurity careers begin.

What a SOC Does¶

Monitor systems and networks 24/7.
Detect suspicious activity from telemetry.
Triage & investigate alerts.
Respond to and contain incidents.
Improve detections over time.

SOC Analyst Tiers¶

Tier	Role
Tier 1	Alert triage, initial investigation, escalation
Tier 2	Deeper investigation, incident handling
Tier 3	Threat hunting, advanced forensics, detection engineering

Logs — The Raw Material¶

You can only detect what you can see. Critical log sources:

Endpoint: process creation, Sysmon, EDR telemetry.
Authentication: logons, MFA events, failures.
Network: firewall, DNS, proxy, NetFlow.
Application & cloud: web server logs, cloud audit trails (CloudTrail).
Identity: directory and SSO logs.

Logging hygiene: ensure clocks are synced (NTP), logs are centralized, and they're tamper-resistant — attackers delete logs to hide. Forward logs off the host in real time.

SIEM — Security Information & Event Management¶

A SIEM centralizes, normalizes, and correlates logs to surface threats.

Sources → [ Collect ] → [ Normalize ] → [ Correlate / Rules ] → [ Alert ] → Analyst

Capabilities: search, correlation rules, dashboards, alerting, retention. Examples: Splunk, Microsoft Sentinel, Elastic SIEM, Wazuh (open-source).

Correlation Example¶

A single failed login is noise. But:

50 failed logins → 1 success → privilege change → data download

...correlated together is a likely account-takeover. The SIEM's job is to connect these dots across sources.

Beyond SIEM: SOAR, UEBA, XDR¶

SOAR — Security Orchestration, Automation & Response: automates repetitive response steps via playbooks (e.g., auto-isolate a host, enrich an IP).
UEBA — User & Entity Behavior Analytics: ML baselining to flag anomalies (impossible travel, unusual data access).
XDR — unifies detection/response across endpoint, network, identity, and cloud.

Reducing Alert Fatigue¶

SOCs drown in alerts. Combat it with tuning (cut false positives), prioritization (risk-based), enrichment (auto-add context), and automation (SOAR) — so analysts focus on what matters.