What a SOC does, and how to know if you need one.

A security operations centre, or SOC, is a team and a set of tools that watch for attacks and respond to them.

What it does

• Collects logs and alerts from endpoints, firewalls, email, identity and cloud.
• Correlates them in a SIEM or similar platform, to find patterns.
• Triages alerts and discards false positives.
• Investigates real incidents and decides on containment.
• Responds or advises, and records lessons learned.
• Reports on trends and improvements.

Hours and coverage

Whether coverage is round the clock, business hours or on call depends on the client, the risk and the contract. Terms are set in a service level agreement, with documented procedures that describe how each alert type is handled.

Options

• Build your own: highest control and highest cost; needs people on shifts.
• Managed SOC or MDR: a provider watches and responds for you.
• Co-managed: your team and the provider share the work.
• Not yet: if your estate is small, good basics plus endpoint protection and tested backups may come first.

Signs you are ready

You have logs worth watching, a defined contact for incidents and authority to act. Without these, monitoring only produces unread alerts.

Questions to ask

What is monitored? Who responds and with what authority? What are the response targets? What do you get in reports? Can the scope be tailored to our systems and hours?