Security Operations (SOC)

Introduction

A Security Operations Centre — a SOC — is the team responsible for continuously monitoring an organisation's technology environment for signs of cyberattack, compromise, misuse, and suspicious behaviour. It's where most of the concepts covered so far in this course actually converge: a SOC analyst may need to understand networking, Windows, Linux, Active Directory, Entra ID, authentication, IAM, endpoints, firewalls, proxies, email, cloud infrastructure, APIs, malware, logs, threat intelligence, and incident response — often all in the same investigation.

A modern enterprise can generate millions or billions of security events every day, so a SOC can't simply have people manually reading logs. Technology collects, processes, correlates and prioritises events so analysts can focus on what might actually be a real incident. Modern platforms increasingly blend SIEM, endpoint, identity, network, cloud and automation capabilities — Microsoft pairs Sentinel with Defender XDR, while Elastic Security, Google Security Operations, IBM QRadar and others provide overlapping SIEM, detection and response capabilities.

By the end of this module, you should understand not just what a SOC is, but what actually happens when an alert lands on an analyst's screen, and how that analyst figures out whether it's a real attack.

Learning Objectives

By the end of this module (all 6 lessons plus the lab pack), you should be able to explain what a SOC does and how enterprise SOCs are structured and staffed; explain SIEM, EDR and XDR and how they relate to each other; describe the main detection approaches and MITRE ATT&CK; triage an alert methodically and distinguish false positives, benign positives, and false negatives; read and interpret Windows, Linux, network, cloud and SaaS logs; investigate a multi-stage incident and build a timeline from raw telemetry; and describe SOAR, threat hunting, SOC metrics, and where AI fits into modern security operations.

1👁️ What Is a Security Operations Centre?

A SOC is the central function responsible for monitoring and responding to cybersecurity events. Large organisations — banks, airlines, telcos, tech companies, retailers, governments, multinationals — may run a SOC 24 hours a day. A simple SOC workflow:

An employee's laptop logs powershell.exe started — probably normal on its own. Seconds later, the endpoint reports PowerShell downloaded a file from an unknown domain. Identity reports the employee's account authenticated from an unusual IP. Email security reports they recently opened an attachment from an external sender. None of these four events is individually alarming — together they could mean phishing → malware execution → credential theft → account compromise. Correlation is one of the most important capabilities of modern security operations, and it's the thread running through this entire module.

2👥 How Enterprise SOCs Are Structured

SOC structures vary enormously — a small company might have two or three security engineers doing everything; a multinational bank might employ hundreds across several countries. A traditional SOC often uses tiers:

Not every organisation uses this Tier 1/2/3 model — some run multidisciplinary teams where one analyst owns an investigation start to finish. Others outsource some or all monitoring to an MSSP (Managed Security Service Provider) or MDR (Managed Detection and Response) provider.

3🌐 The Global SOC

Multinationals often run a follow-the-sun model — when London finishes, responsibility hands off to New York, then Singapore, and back around. A global SOC has to account for:

A large company therefore usually runs a mixture of technologies rather than one perfectly standardised platform — extremely common in real enterprises, however clean the vendor diagrams look.

4🏗️ SOC Architecture

A simplified enterprise SOC architecture:

Security depends on visibility. If the organisation doesn't collect the relevant telemetry, the SOC may never see the attack at all.

5📡 Security Telemetry

Security telemetry is information generated by systems describing activity in the environment — and it comes from almost everywhere:

Lesson 4 goes deep on what each of these actually looks like in practice.

📦 Download the SOC Investigation Lab Pack

Lesson 5 walks through how to use it, and mirrors a couple of its labs inline so you can see the investigation pattern before diving into the full pack.

📚 Lessons in This Module

Work through these in order — each builds on ideas from the last. Every lesson has its own "Mark lesson complete" button; your progress across all six is tracked below.