SOC (security operations centre)
security operations center · security operations centre · security monitoring · MDR · managed SOC · managed detection and response
The team and tools that monitor the information system around the clock to detect security incidents, assess them and trigger the response.
In practice
The SOC collects logs and alerts (firewalls, EDR, email, cloud) in a SIEM, triages alerts, weeds out false positives and escalates real incidents. Analysts are often organised in tiers, from initial triage to in-depth investigation. Few SMEs can afford a 24/7 team, so they rely on an outsourced SOC or an MDR service. For the most sensitive needs, ANSSI, the French national cybersecurity agency, qualifies security incident detection providers (PDIS).
Fictional case: at 3 a.m., a provider’s SOC spots an administrator login from a country where the company does no business, followed by the antivirus being switched off. The analyst isolates the server remotely and calls the on-call engineer: the attack is stopped before encryption.
