Module 8 of 20 — Threats & Response

Security Operations & Monitoring (SOC)

Security Operations Centers are the nerve center of cybersecurity defense. They provide continuous monitoring, threat detection, and incident response capabilities. Modern SOCs leverage automation, threat intelligence, and advanced analytics to stay ahead of attackers.

Core SOC Components

A modern SOC relies on multiple integrated technologies working together to detect, analyze, and respond to threats efficiently.

SIEM (Security Information & Event Management)

Aggregates and analyzes log data from multiple sources to identify security events.

Examples:

Splunk, QRadar, Elastic Stack, Azure Sentinel, AWS Security Hub

Use Case:

Correlate firewall logs, authentication events, and endpoint alerts to detect intrusions.

SOAR (Security Orchestration, Automation & Response)

Automates incident response workflows and integrates security tools.

Examples:

Palo Alto Cortex XSOAR, Splunk Phantom, IBM Resilient

Use Case:

Automate phishing response: quarantine email, reset credentials, notify users.

EDR (Endpoint Detection & Response)

Provides real-time monitoring and response capabilities on endpoints.

Examples:

CrowdStrike, SentinelOne, Microsoft Defender ATP, Carbon Black

Use Case:

Detect fileless malware, live response to isolate infected endpoints.

IDS/IPS (Intrusion Detection/Prevention)

Monitors network traffic for malicious signatures and anomalous behavior.

Examples:

Snort, Suricata, Zeek (Bro), Cisco Firepower

Use Case:

Block SQL injection attempts, detect port scans, alert on exploit patterns.

SOC Performance Metrics

Measuring SOC effectiveness requires tracking key performance indicators that reflect detection capability, response speed, and operational efficiency.

MTTR (Mean Time to Respond)

< 1 hour for critical alerts

Measures response efficiency

MTTD (Mean Time to Detect)

< 24 hours for breaches

Reflects detection capability

False Positive Rate

< 5%

Avoids analyst fatigue

Alert Volume

Tuned to analyst capacity

Prevents overload

Incident Resolution Time

Tier-dependent (1-7 days)

Tracks improvement

Proactive Threat Hunting

Threat hunting moves beyond reactive alert response to actively search for hidden threats. It assumes adversaries are already in the network and looks for evidence.

Hypothesis

Based on threat intelligence, TTPs, or anomalous behavior, form hypotheses about potential compromise.

Example: After learning of new APT backdoor, hypothesize it may exist in network.

Investigation

Use SIEM queries, EDR investigations, and log analysis to search for evidence.

Example: Query for unusual PowerShell execution patterns matching TTPs.

Analysis

Analyze findings to confirm or refute hypotheses, identify scope of impact.

Example: Identify 5 systems with matching IoCs indicating compromise.

Response

Contain, remediate, and document findings. Share intelligence with team.

Example: Isolate affected endpoints, block malicious IPs, update detection rules.

Essential SOC Tools

Log Aggregation

Splunk, ELK Stack, Graylog

Centralize log collection and search

Packet Analysis

Wireshark, Zeek, tcpdump

Deep network traffic inspection

Threat Intel

MISP, ThreatConnect, OTX

Manage and share threat intelligence

Case Management

TheHive, RTIR, JIRA

Track incidents through resolution

Key Takeaways

  • SOC is technology + people + process working together for continuous defense.
  • MTTR/MTTD metrics measure detection and response effectiveness.
  • Threat hunting assumes breach and proactively seeks hidden adversaries.
  • Tool integration through SOAR enables efficient, automated response.
Module 8 of 20
Incident ResponseNext: Quiz 2