Module
Inside the SOC: Roles, Shifts, Tooling
Sit down at the start of a shift, read the queue and the handover, and say for every open item who owns it, which clock is running on it and which console you would open first. At the end of the shift, write the handover the next analyst needs.
70 min · Beginner
Start Inside the SOC: Roles, Shifts, Tooling
What you will learn
- Trace one alert from the detection firing to the ticket closing, naming its state and its owner at each step
- Name the seat that owns the next decision on an alert, and what has to be handed to it
- Pick the console that answers the question you are asking, and know what that console cannot see
- Read a ticket's timestamps and say which clock is running and whether it is met, at risk or breached
- Receive a shift handover and write one that gets the next shift through its first six minutes
Lessons
The Queue Is the Job
Nobody watches anything. Detections create records, records are owned and closed, and the record's state is the only proof anyone looked.
Who Owns the Next Decision
A tier is a decision boundary, not a rank. Escalation is a change of owner, not a cry for help.
The Analyst Toolkit
One question, one console. The SIEM is where the alert surfaces; the answers live in the EDR, the identity provider and the mail gateway.
Clocks and SLAs
The clocks a SOC is held to are acknowledge and triage. Closing fast is how a queue gets gamed.
Shifts and the Handover
What 24/7 costs, how Straylight staffs it, and the handover you receive at 07:00 and write at 19:00.