A SOC is a security operations center, a centralised facility in an organisation for monitoring the organisation's security posture, escalating or dealing with any security problems that arise.
Questions tagged [soc]
28 questions
41
votes
3 answers
What is the meaning of Triage in Cybersec world?
I searched Google about this term, but the definitions that I found was related to the medical world, and nothing related to IT. I think that is some kind of procedure of documenting something maybe? Note that I heard this word for the first time in…
![](../../users/profiles/173189.webp)
victor26567
- 503
- 4
- 6
8
votes
2 answers
Setting up own enterprise SOC
The other day I was talking with a service provider (MSSP) who has experience with operating SOC (security operations centre) 24x7. Their price was rather steep (in the millions range). I don't understand why it would be so steep. My impression of a…
![](../../users/profiles/60935.webp)
dorothy
- 715
- 1
- 7
- 18
7
votes
1 answer
Security Operation Center (SOC)
I am looking for resources and details on establishing a security operation center (SoC) or network operation center (NoC) based on ITIL or any other applicable regulations. Where can I find good details or experiences of others except for hiring…
![](../../users/profiles/2070.webp)
Yasser Sobhdel
- 309
- 1
- 8
6
votes
4 answers
What is the difference between a SIEM and a SOC?
What is the difference between a SIEM (Security Information and Event Management) and a SOC (Security Operations Centre)?
Do they work together? And if independent when to use which?
![](../../users/profiles/95429.webp)
whatever489
- 838
- 3
- 9
- 21
6
votes
1 answer
Is there a certification AICPA grants to qualified auditors?
We are in the process of hiring an auditor in order to become SOC 2 compliant and would like to know if there's some kind of official auditor listing available, or at least a certification or AICPA endorsement we should be looking for.
![](../../users/profiles/129910.webp)
rebagliatte
- 201
- 2
- 3
5
votes
2 answers
Incident Responders: Can you give some examples of Incidents / types of incidents that are suitable for fully or partly automated response?
You setup security monitoring - either a full commercial SIEM/SOC or something home-cooked (e.g., rsyslog -> OSSIM / MozDef / Splunk / ...).
You also setup some rules so that some event triage is done - and you only get alerts for potential…
![](../../users/profiles/149485.webp)
Sas3
- 2,638
- 9
- 20
4
votes
1 answer
Steps to become SOC 2 compliant?
Are there any specific steps one must follow to achieve SOC 2 compliance? Or should one just get a checklist from a specialized auditor?
Some context:
We are a small company and need to become SOC 2 compliant in order to integrate with a partner's…
![](../../users/profiles/129910.webp)
rebagliatte
- 201
- 2
- 3
3
votes
1 answer
How many people are required to build your own 24x7 security operations center (SOC)? Rough costs?
I have received this question from a few clients, but I have 0 experience building a 24x7 SOC.
![](../../users/profiles/22.webp)
Tate Hansen
- 13,714
- 3
- 40
- 83
3
votes
4 answers
SOC and generic log parsing
I am making a conceptual work-flow of a SOC so if we suppose that a SIEM solution is integrated inside an organization's in-house SOC. Also, if the team of the SOC is the one managing the SIEM solution.
My question is when we will face a log format…
![](../../users/profiles/171859.webp)
Hilo21
- 33
- 3
2
votes
1 answer
What is the difference between a SOC and a CSIRT?
So, from a summary of what I have found on the internet,
a SOC collects information and the CSIRT makes conclusions based on that info.
However, from what I see in labs/challenges websites like BlueTeam Labs Online, those lines aren't that defined…
![](../../users/profiles/260344.webp)
Néstor Llop
- 23
- 5
2
votes
0 answers
Hardware Secure Element
After checking multiple suppliers and reading about HW secure elements, I would like to understand the use of this type of electronic components.
Maybe I´m wrong, but it seems a HW secure element provides a Root of Trust for a certain data. This is,…
![](../../users/profiles/231702.webp)
LazyTurtle
- 93
- 5
2
votes
2 answers
How should we mitigate threats that are keep coming to our security monitoring system?
We have continuous cybersecurity threat feeds that coming to our SOC on a daily basis from different sources that provide all the new CVEs, new malware variations and more. We just don't know how to handle these alerts in the right way and not only…
![](../../users/profiles/188315.webp)
Filipon
- 1,204
- 10
- 22
2
votes
1 answer
SOP for SQL Injection Attack
What should (or) how an Incident Handler do (or) follow when an SQL injection attack is reported?
Initial Response
Analysis
Action
Aiming to make a procedure guide to follow for myself and my team. Brief or detail, anything would help.
![](../../users/profiles/91682.webp)
suspect01
- 21
- 5
1
vote
0 answers
Anatomy of a Cyber exercise and SOC
What exactly entails an incident response exercise (like a Red/Tiger team excercise)? How does it add value to a security operations center? Is there any good resource I can read up on how to set up a 24x7 security operations center SOC? I am also…
![](../../users/profiles/60935.webp)
dorothy
- 715
- 1
- 7
- 18
1
vote
1 answer
What are the (two?) definitions of SOC?
On one hand "Security Operations Centre", but SOC is seemingly used in the reporting and certification domain, where does this come from? Is there another (or more) definitions of SOC in Information Security Compliance Certification, or do these…
![](../../users/profiles/250518.webp)
PlasticCasio
- 93
- 7