Simple definition
A team or function to monitor, detect and treat cybersecurity events.
Technical definition
Security Operations Center combines analysts, processes and tools such as SIEM, EDR, middleware and response procedures.
What is it used for ?
Ensure ongoing monitoring and coordination of response to incidents.
Practical example
The SOC can analyze an alert EDR then isolate the position if the activity is confirmed malicious.
Common issues
- Too many warnings
- Lack of a business context
- Insufficient climbing procedures
Related terms
Key takeaway: This entry explains the general operation of the term. Exact settings may vary depending on software, vendors and environments.