31. SOC, SIEM and Incident Response
31.1 What a SOC Is
A Security Operations Centre (SOC) is the team that watches an organisation's systems around the clock, detects attacks and responds to them.
| Tier | Role | Typical work |
|---|---|---|
| L1 | Alert monitoring / triage analyst | Watches the SIEM dashboard, checks each alert, closes false positives, escalates real ones |
| L2 | Incident responder | Investigates escalated alerts deeply, contains the threat, collects evidence |
| L3 | Threat hunter / senior analyst | Hunts for hidden attackers, writes detection rules, handles major incidents |
| SOC manager | Lead | Processes, reporting, coordination with management and legal |
Other terms you will hear: MSSP (a company that runs a SOC for many clients), playbook or runbook (step-by-step instructions for a type of alert), ticket (each alert or incident is tracked as a ticket), shift (SOCs often run 24x7 in shifts).
Ravindra Bagale's Tip
Freshers think a SOC is just watching screens. No! The real L1 skill is deciding quickly "is this alert real or false?". For that you need to understand networking (Chapters 1-3), Linux logs (Chapters 5-6) and attacks (Part 10). What you learned earlier is used here.
Ravindra Bagale's Tip – मराठी
Freshers ना वाटते SOC म्हणजे फक्त screen बघणे. नाही! L1 चे खरे skill म्हणजे "हा alert खरा आहे की खोटा?" हे पटकन ठरवणे. त्यासाठी networking (Chapter 1-3), Linux logs (Chapter 5-6) आणि attacks (Part 10) समजून घेणे गरजेचे आहे. जे तुम्ही आधी शिकलात ते इथे कामाला येते.
Ravindra Bagale's Tip – हिंदी
Freshers को लगता है SOC मतलब बस screen देखना. नहीं! L1 का असली skill है "यह alert असली है या झूठा?" यह जल्दी तय करना. इसके लिए networking (Chapter 1-3), Linux logs (Chapter 5-6) और attacks (Part 10) समझना ज़रूरी है. जो आपने पहले सीखा वह यहाँ काम आता है.
Practice task
Write in your own words what an L1 analyst does when an alert "Multiple failed SSH logins from one IP" appears. List three questions they should answer before escalating.