SOC (Security Operations Center)

Definition

• A SOC is a team that continuously monitors an organization's network, servers, cloud, and applications for security threats.
• It sits after infrastructure is running and before incident response, watching logs, alerts, firewalls, and SIEM tools.

What Problem It Solves

Detects attacks quickly instead of waiting until damage is noticed.

What Happens If Not Used

Attacks may remain hidden for days or months, causing greater damage.

Easy Wording

A SOC is the security control room of a company.

Layman Example

Like CCTV guards watching cameras and calling police when they see suspicious activity.

Technical Example

Flow: User → Website → Firewall → Server → Logs → SIEM → SOC → Alert → Security Team.

Limitation: SOC mainly reacts to alerts. If an attacker avoids triggering alerts, they may remain undetected, leading to Threat Hunting.