A SOC is a function, not necessarily a room. The classic image is a dark room with big screens, and some SOCs look like that. What matters is that a defined team watches your environment, decides what is real and acts on it, every hour of every day.
What Does a SOC Actually Do?
| Activity | What it involves |
|---|---|
| Monitoring | Collecting events from endpoints, identity, email, cloud, firewalls |
| Triage | Deciding which alerts are real and which are false positives |
| Investigation | Working out what happened, what is affected and how far an attacker got |
| Containment | Isolating devices, disabling accounts, blocking addresses |
| Threat hunting | Looking for attacker activity no rule has caught |
| Tuning | Improving detections so analysts see fewer pointless alerts |
| Reporting | Explaining incidents and trends to management |
Most SOCs organize analysts into tiers. Tier 1 handles initial triage, tier 2 investigates confirmed incidents, and tier 3 handles complex cases, hunting and detection engineering.
What Tools Does a SOC Use?
- A SIEM to collect and correlate logs.
- EDR or XDR for endpoint visibility and response.
- SOAR or other automation to handle repetitive steps.
- Threat intelligence feeds.
- Case management for tracking incidents.
Increasingly, AI is used to correlate signals and summarize alerts. That speeds things up, but someone with experience still needs to make the call on whether to shut down a CFO's laptop during month-end close.
How Is a SOC Measured?
Two numbers matter most. Mean time to detect (MTTD) is how long it takes to notice an attack. Mean time to respond (MTTR) is how long it takes to contain it. Ask any provider how they define and report these.
Does a Small Business Need a SOC?
You need what a SOC does: someone watching around the clock who can respond. You almost certainly do not need to build one. Staffing a 24/7 SOC takes several analysts once you account for shifts, vacations, sick days and turnover, plus tools and management. For a 100-person company in Edmonton, that is far beyond what the risk justifies. See In-house SOC vs outsourced SOC for the full comparison.
What Is SOC as a Service?
SOC as a service means a provider runs the SOC for you: the people, the platforms and the processes. You get 24/7 monitoring without hiring. The scope varies. Some services cover endpoints only, some include Microsoft 365, cloud and firewalls, and some include a SIEM for compliance log retention.
What Is the Difference Between a SOC and MDR?
They overlap heavily. MDR is a packaged service focused on detection and active response, typically built around EDR. SOC as a service often covers a wider set of log sources and compliance reporting. In practice, the labels matter less than three questions: what data is watched, who responds, and how fast. Our article What is MDR? explains the MDR side.
At Cyberphore, AI handles correlation and triage at machine speed, while experienced human analysts investigate every meaningful alert and make every response decision. Analysts work in shifts so the service is staffed 24/7/365. Client monitoring data is stored in Canadian data centres by default; other regions are used only if a client asks..