Chapter 1 — What a security operations centre does
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 Purpose"]
N3["1.3 Functions"]
N4["1.4 Relationships"]
N5["1.5 Frameworks"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 Purpose"]
N3["1.3 Functions"]
N4["1.4 Relationships"]
N5["1.5 Frameworks"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The case]
|
v
[1.2 Purpose]
|
v
[1.3 Functions]
|
v
[1.4 Relationships]
|
v
[1.5 Frameworks]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) describe the purpose of a SOC; (2) name the main SOC functions; (3) explain how the SOC relates to IT and management; (4) use the case that runs through the book.
1.1 The case
Carlos Mendes has just joined the small security operations centre at the fictional Northgate Borough Council as a trainee analyst. His lead is Aisha Rahman. On his second morning, at 09:04, the monitoring system shows 46 failed logons from one internet address, 203.0.113.80, against the council's remote-access portal, followed at 09:09 by a successful logon to "parks01", a shared account used by the parks department. This book follows Carlos as he learns to handle events like this one. The 46 failures and the single success, five minutes apart, become the thread that later chapters keep returning to.
1.2 Purpose
A SOC watches an organisation's systems for signs of attack or misuse, decides which signs matter, and coordinates the response. Zimmerman's "Ten Strategies of a World-Class Cybersecurity Operations Center" (MITRE, 2014) and its successor "11 Strategies" by Knerler, Parker and Zimmerman (MITRE, 2022) describe the SOC as a team with a clear mission, authority and resources rather than a room full of screens. At Northgate, mission and authority are written down: the SOC may disable accounts and block addresses on its own, but isolating servers needs the IT manager. That split shapes what Carlos can do at 09:09 without waiting for anyone else to approve the first containment step.
1.3 Functions
Typical functions are monitoring and triage, incident response, threat intelligence, detection engineering, vulnerability awareness and tool maintenance. At Northgate, four analysts cover all of these with help from the IT team. With four analysts, nobody specialises fully, so Carlos meets every function in his first weeks. Monitoring raised the 09:04 alert, triage and response handled parks01, and threat intelligence checked whether other councils had seen 203.0.113.80. Detection engineering later wrote the rule that would catch the same pattern faster next time. Small size means the same analyst may triage an alert and then write the rule that tunes it.
1.4 Relationships
The SOC does not own most systems. It needs IT to change firewall rules, reset passwords or rebuild machines, and it needs management to accept risks and approve major actions. Good relationships are part of the job. In the parks01 case Carlos could disable the account himself, but IT had to create named accounts for the gardeners and the IT manager owned the MFA change on the portal. Without good working relationships, each of those steps would have waited in someone else's queue while the parks team could not log timesheets.
1.5 Frameworks
NIST Cybersecurity Framework 2.0 (CSWP 29, 2024) groups security outcomes into Govern, Identify, Protect, Detect, Respond and Recover. Most SOC work sits in Detect and Respond but depends on the others. The parks01 case touches far more than two of the six CSF functions. Govern sets who may disable an account, Identify lists the shared account in the asset records, and Protect is where MFA on the portal belongs. Detect and Respond cover the morning itself, and Recover covers named accounts for the gardeners. Seeing the whole framework stops the SOC treating every problem as a detection problem when the fix belongs elsewhere.
Worked example
Aisha asks Carlos to map the morning's event to SOC functions. Monitoring raised the alert; triage must decide if the parks01 logon was the attacker; incident response may disable the account; IT must reset it; threat intelligence may check the address; detection engineering may tune the rule that fired.
Synthetic case. Northgate Borough Council, its staff and events are invented.
Errors and limits
SOCs differ widely in size and scope; Northgate's is small and generalist.
Exercises
- EX001 — SOC purpose. In one sentence, what is a SOC for? Rubric: 3 = watch, decide what matters, coordinate response; 2 = partial; 1 = vague; 0 = none.
- EX002 — Morning event. Summarise the 09:04–09:09 events. Rubric: 3 = 46 failures from 203.0.113.80, then parks01 success at 09:09; 2 = partial; 1 = wrong; 0 = none.
- EX003 — Who changes systems. Why does the SOC depend on IT? Rubric: 3 = SOC does not own most systems; IT makes changes; 2 = partial; 1 = vague; 0 = none.
- EX004 — CSF functions. Which two CSF 2.0 functions hold most SOC work? Rubric: 3 = Detect and Respond; 2 = one; 1 = vague; 0 = none.
Synthesis
A SOC watches, decides and coordinates; it relies on IT, management and clear frameworks.