SOC / Blue Team · 4 min
What Is a SOC?
The team that watches, investigates, and responds
This lesson explains the concept, then checks your understanding in a short interactive exercise.
What a SOC does
A Security Operations Center (SOC) is a team responsible for monitoring an organization's systems, detecting suspicious activity, and coordinating a response.
- Monitoring systems and networks
- Triaging and investigating alerts
- Escalating confirmed issues
- Coordinating incident response
- Maintaining detection logic and threat intelligence
No two SOCs look the same
SOC size, structure and staffing vary a lot. Some organizations run 24/7 in-house teams with multiple tiers of analysts. Others outsource monitoring to a managed provider, or run a small team that handles everything.
- Some SOCs have Tier 1, 2 and 3 analysts
- Some are fully outsourced (MSSP)
- Some blend in-house staff with outside vendors
Loading the interactive lesson…