Security Operations Center (SOC)
A security operations center (SOC) is a team of security professionals, together with its processes and technology, that monitors an organization's systems to detect, investigate, and respond to cyber attacks and incidents.
Updated
Overview
A SOC combines people, processes, and technology. It is run from a central location by a team of information security professionals, including security engineers, security analysts, and threat hunters. Its role is to limit the damage to an organization by detecting and responding to cyber attacks that get past preventive security controls.
The SOC collects and analyzes security and event data from across the environment, including on-premises devices, cloud services, industrial control and OT systems, remote systems, and mobile devices. It uses that data to find abnormal activity and indicators of compromise, assigns severity ratings to threats, and generates alerts. When it identifies a threat, the SOC investigates, acts to contain it, works out the root cause, and supports recovery of the affected systems and data. Lessons learned feed back into detection capabilities and response procedures.
SOCs vary widely in scope. Besides detection and response, a SOC can run vulnerability assessments, penetration testing, threat hunting, and audits for regulatory compliance. NCSC guidance states that there is no one-size-fits-all SOC. The design follows from the threats the organization faces, the assets it has, and the resources available.
Similar Terms
2 termsSIEM
A SIEM is a software platform. A SOC is the team, processes, and technology that carry out detection and response, and guidance for setting one up recommends an event management solution such as a SIEM platform to support alert triage, analysis, and incident management.
Threat Hunting
Threat hunting is one activity a SOC can take on. The SOC's core work is detecting and responding to attacks through its monitoring and alerting, while threat hunting proactively looks for adverse activity that has evaded those existing controls.
Frequently Asked Questions
What does SOC stand for?→
In cybersecurity, SOC stands for security operations center, spelled security operations centre in British and Canadian English.
What does a SOC do?→
A SOC monitors and detects threats by collecting and analyzing security and event data from across the organization, then responds when it finds one. It investigates, contains and mitigates the threat, identifies the root cause, and helps restore affected systems and data.
What is SOC as a service?→
SOC as a service (SOCaaS) is a subscription model in which a third-party provider runs SOC functions for an organization. It is an option for organizations with limited resources. Some organizations take a hybrid approach and keep core functions such as monitoring and incident response in-house while outsourcing specialized work such as penetration testing or malware analysis.
Can AI replace SOC analysts?→
Canadian Centre for Cyber Security guidance says AI tools can help with alert triage, log analysis, threat hunting, and incident investigation, but should complement human decision-making rather than replace it. AI output can be incomplete or inaccurate, so SOC analysts should validate it.
Related
Tool categories
Career roles
Glossary terms
Sources
Definitions follow the government and standards body sources listed above. This site is not affiliated with the agencies or organizations cited.