Definition
Security operations centre
SOC
In one sentence
A security operations centre (SOC) is the team, processes and technology responsible for monitoring an organization's environment for cyber threats, investigating alerts and coordinating the response to incidents, typically around the clock.
SOC as a serviceSecurity information and event managementManaged detection and responseMean time to detect
Security Operations Centre Explained
A SOC is a function more than a place. Its analysts collect signals from endpoints, identity systems, email, cloud services and network devices; triage alerts to separate real threats from false positives; investigate incidents; contain attackers; hunt for threats that did not trigger alerts; and continually tune detections. Typical tools include a SIEM, EDR or XDR, SOAR automation and threat intelligence.
Running a SOC around the clock is resource intensive. Covering every hour of the year with even one analyst on shift requires several people once vacations, holidays, sick days and training are considered, plus senior analysts, management and tooling. For this reason, most Canadian organizations with fewer than about 1,000 employees use an outsourced SOC or MDR service rather than building their own.
Key measures of SOC performance include mean time to detect (MTTD) and mean time to respond (MTTR). When evaluating a provider, ask how these are defined and reported, and who has authority to take containment action.
General information for Canadian organizations, not legal advice.