Table of Contents Link to heading

• Security Operations Centre (SOC)
• Security Information and Event Management (SIEM)
  • SIEM Core Functions
  • Common SIEM Platforms
• Incident Response Lifecycle
  • Phase 1: Preparation
  • Phase 2: Detection and Analysis
  • Phase 3: Containment
  • Phase 4: Eradication
  • Phase 5: Recovery
  • Phase 6: Post-Incident Activity
• Threat Intelligence
  • Intelligence Types
  • Threat Intelligence Feeds and Sharing
• Key Metrics for Security Operations

Security Operations Centre (SOC) Link to heading

A Security Operations Centre is the team and facility dedicated to continuous monitoring, detection, and response to security threats. The SOC operates 24/7 on the principle that attackers do not respect business hours.

SOC functions:

• Monitoring: Continuous collection and analysis of security events from across the environment
• Detection: Identifying anomalies, correlating events, and surfacing potential security incidents
• Response: Containing, investigating, and remediating confirmed incidents
• Threat hunting: Proactively searching for threats that automated detection has not identified
• Vulnerability management: Tracking and prioritising remediation of known vulnerabilities
• Threat intelligence: Consuming and applying intelligence about current threats to improve detection

SOC tiers reflect investigative depth:

Security Information and Event Management (SIEM) Link to heading

A SIEM platform aggregates, normalises, and correlates security event data from across the IT environment, enabling centralised detection and investigation. It is the core tool of a SOC.

SIEM Core Functions Link to heading

Log aggregation: Collects logs from security controls (firewalls, IDS/IPS, endpoint agents), infrastructure (switches, servers, DNS), applications, and cloud services into a centralised, searchable store.

Normalisation: Converts logs from different formats (syslog, JSON, Windows Event Log, CEF) into a common schema so that rules and queries work consistently across source types.

Correlation: Applies rule-based or ML-based logic to detect patterns across multiple events — for example, detecting a brute-force attack (many failed logins from one source) followed by a successful login from that same source.

Alerting: Generates alerts when correlation rules fire, with severity levels and supporting context to aid triage.

Case management: Tracks investigations from initial alert through to resolution, maintaining an audit trail for compliance and post-incident review.

Dashboards and reporting: Provides operational visibility (current alert queue, open incidents) and compliance reporting (failed login counts, policy violation trends).

Common SIEM Platforms Link to heading

Incident Response Lifecycle Link to heading

The incident response (IR) lifecycle defines the structured approach to handling security incidents. NIST SP 800-61 is the authoritative reference; most IR frameworks follow the same six phases.

Phase 1: Preparation Link to heading

Preparation occurs before any incident. It determines how effective the response will be when an incident occurs.

• IR plan: A documented, tested plan that defines roles, responsibilities, communication procedures, and decision authorities
• Runbooks: Step-by-step playbooks for specific incident types (ransomware, data breach, account compromise, DDoS)
• Tools and access: Ensure responders have access to forensic tools, out-of-band communication channels, and necessary system permissions before they need them under pressure
• Training and exercises: Tabletop exercises and simulations build muscle memory for coordination decisions that are harder to make in a real incident
• Retainer agreements: Pre-negotiated agreements with external IR firms reduce time-to-engagement when internal capacity is exceeded

Phase 2: Detection and Analysis Link to heading

Detection identifies that an incident may have occurred; analysis confirms it and determines scope.

Detection sources:

• SIEM alerts (correlation rules)
• Endpoint Detection and Response (EDR) alerts
• User reports (“I think I clicked a phishing link”)
• Threat intelligence matches
• Anomaly detection (unusual data volumes, unexpected remote access)

Analysis activities:

• Triage: Is this a true positive or false positive?
• Scoping: Which systems are affected? What data is at risk?
• Classification: What type of incident is this? What is the severity?
• Timeline reconstruction: When did the threat actor first gain access? What did they do?

Phase 3: Containment Link to heading

Containment stops the incident from spreading while preserving evidence for investigation.

Short-term containment: Immediate actions to limit damage:

• Isolate affected systems from the network (without powering off — volatile memory contains forensic evidence)
• Block malicious IP addresses and domains at the perimeter
• Revoke compromised credentials
• Disable affected user accounts

Long-term containment: Implement temporary mitigations that allow the business to continue operating while eradication proceeds:

• Deploy clean replacement systems for critical services
• Apply emergency patches
• Enhanced monitoring on perimeter and internal systems

Phase 4: Eradication Link to heading

Eradication removes the threat from the environment completely.

• Identify and remove all attacker-placed artefacts: malware, backdoors, scheduled tasks, persistence mechanisms, rogue user accounts
• Identify the root cause — the initial access vector — and close it
• Patch the exploited vulnerability
• Remove compromised credentials and rotate secrets

Eradication without root cause identification is ineffective — the attacker will regain access through the same vector.

Phase 5: Recovery Link to heading

Recovery restores affected systems to normal operation and verifies they are clean.

• Restore from verified clean backups or rebuild from known-good images
• Verify system integrity (hash checks, EDR scans) before returning to production
• Monitor restored systems closely for signs of reinfection during the initial recovery period
• Document what was restored and when

The recovery phase ends when affected systems are functioning normally and confidence in their integrity is established. Do not rush this phase — returning a compromised system to production too quickly risks perpetuating the incident.

Phase 6: Post-Incident Activity Link to heading

The lessons-learned phase converts incident experience into improved defences.

• Post-incident report: Formal documentation of the incident timeline, root cause, impact, response actions, and findings. The primary artefact for management communication, regulatory reporting, and insurance claims.
• Lessons-learned meeting: Structured discussion (within 2 weeks of containment) covering what went well, what did not, and what would be done differently. Blameless — focused on system improvements, not individual fault.
• Remediation tracking: Convert identified gaps into tracked action items with owners and deadlines. Feed into the risk register and security roadmap.
• Detection improvement: Add or tune detection rules to identify similar activity faster in future.

Threat Intelligence Link to heading

Threat intelligence transforms raw threat data into actionable knowledge about who is attacking, how, and why — enabling proactive rather than purely reactive defence.

Intelligence Types Link to heading

Tactical intelligence is the most immediately actionable but also the shortest-lived — IPs and domains are rotated frequently by attackers. Strategic intelligence guides long-term security investment decisions.

Threat Intelligence Feeds and Sharing Link to heading

STIX/TAXII: Structured Threat Information eXpression (STIX) is the standard format for threat intelligence; Trusted Automated eXchange of Indicator Information (TAXII) is the transport protocol. Most enterprise threat intelligence platforms support both.

ISACs (Information Sharing and Analysis Centres): Sector-specific organisations that aggregate and distribute threat intelligence among members. Examples: FS-ISAC (financial), H-ISAC (healthcare), E-ISAC (energy).

MITRE ATT&CK: A knowledge base of adversary tactics, techniques, and procedures (TTPs) derived from real-world incident observations. Used to map detected activity to known attack patterns, identify detection gaps, and improve defensive coverage.

ATT&CK Tactic → Technique → Sub-technique
Example:
Initial Access → Phishing (T1566) → Spearphishing Attachment (T1566.001)

Key Metrics for Security Operations Link to heading

Mature SOCs track these metrics continuously and use them to drive improvements in detection engineering, process efficiency, and tooling investment.