Awesome SOC

An operational handbook and knowledge base to build, run and mature a SOC (including CSIRT). Covering:

• SOC basics
• detection engineering
• threat intelligence
• SOC metrics/KPI
• SOC automation
• AI use cases and best practices
• SOP (SOC playbooks)

Those are my view, based on my own experience as SOC/CSIRT analyst and team manager, as well as well-known papers. Focus is more on SOC than on CERT/CSIRT.

My motto is: without reaction (response), detection is useless.

NB: Generally speaking, SOC here refers to detection activity, and CERT/CSIRT to incident response activity. CERT is a well-known (formerly) US trademark, managed by CERT-CC, but I prefer the term CSIRT as it precisely refers to incident response.

Table of Contents

• Must read
• Fundamental concepts
• Mission-critical means (tools/sensors)
• SOC internals/core
• AI (ML, LLM, GenAI, Agentic AI)
• IT/security Watch
• SOAR
• Detection engineering
• Threat intelligence
• Playbooks/SOP
• SOC metrics (KPI/SLA)
• SOC Management
• HR and training
• IT achitecture
• To go further (next steps)
• Appendix

Must read

For a SOC

• SOC build:
  • MITRE, 11 strategies for a world-class SOC (or use local file): part 0 (Fundamentals).
  • FIRST, Building a SOC
  • NCSC, Building a SOC
  • Gartner, SOC model guide
  • Splunk, State of Security 2025
  • Microsoft, Secure your business with 365
• SOC training for interview:
  • LetsDefend SOC analyst interview questions
• SOC management:
  • FIRST, ISO 27035 Practical value for CSIRT and SOCs
  • SANS, 2025 SOC survey
  • SOC CMM, SOC Metrics
• SOC assessment:
  • CMM, SOC-CMM
  • Rabobank CDC, DeTTECT
  • SANS, Continous purple teaming

For a CERT/CSIRT

• Global overview:
  • SANS, Incident Response
  • FlexibleIR, IR phases
• CSIRT build:
  • FIRST, CERT-in-a-box
  • FIRST, CSIRT Services Framework
• Security incident response management:
  • ENISA, Good practice for incident management
  • EE-ISAC Incident Response whitepaper
  • LinkedIn Pulse, Security incident management according to ISO 27035
  • Microsoft/EY/Edelman, Incident response reference guide
  • Microsoft, IR lessons on cloud ID compromise
• Forensics:
  • NIST, SP800-86, integration forensics techniques into IR
  • ForensicsArtefacts
  • ForensicsWiki
• Incident response playbooks & methodology:
  • Kaspersky, Incident Response Playbook: Dark Web Breaches
  • CISA, Incident Response playbooks

Globally (SOC and CERT/CSIRT)

• Processes and concepts:
  • PAN, What is SecOps?
  • Flavio Queiroz, SecOPS vs. OPSEC
  • Shubham, Security 360
  • Vilius Benetis, CSIRT, SOC, ISAC and PSIRT definitions
  • Thomas Roccia, Visual Threat Intelligence
  • SentinelOne, What is SecOps
  • Purp1eW0lf, Blue Team Notes
  • PAN, Security orchestration for dummies
  • ThreatConnect, SIRP / SOA / TIP benefits
  • Medium, Compromise assessment methodology
  • Hunt.io, Threat hunting framework (PEAK)
• Incident response specific process/lifecycle:
  • NIST, SP800-61 rev3, incident handling guide
• CSIRT build:
  • ENISA, How to set-up a CSIRT and SOC
• Frameworks and materials:
  • MITRE, ATT&CK: Getting started

Fundamental concepts

Concepts, tools, missions, attack lifecycle, red/blue/purple teams

MITRE references

• 11 strategies for a world-class SOC, Strategy 5: Prioritize Incident Response, pages 125-150,

Prepare for handling incidents by defining incident categories, response steps, and escalation paths, and codifying those into SOPs and playbooks. Determine the priorities of incidents for the organization and allocate the resources to respond. Execute response with precision and care toward constituency mission and business.

🔗 Dedicated page

Cf. SOC/CSIRT Basic and fundamental concepts.

Mission-critical means (tools/sensors)

MITRE reference

• 11 strategies for a world-class SOC, Strategy 7: Select and Collect the Right Data, pages 179-240,

Choose data by considering relative value of different data types such as sensor and log data collected by network and host systems, cloud resources, applications, and sensors. Consider the trade-offs of too little data and therefore not having the relevant information available and too much data such that tools and analysts become overwhelmed.

🔗 Dedicated page

Cf. Mission-critical means

SOC internals

MITRE reference

• 11 strategies for a world-class SOC, Strategy 8: Leverage Tools to Support Analyst Workflow, pages 241-284,

Consolidate and harmonize views into tools and data and integrate them to maximize SOC workflow. Consider how the many SOC tools, including SIEM, UEBA, SOAR, and others fit in with the organization’s technical landscape, to include cloud and OT environments

🔗 Dedicated page

Cf. SOC internals/core

AI

MITRE reference

• 11 strategies for a world-class SOC, Strategy 8: Leverage Tools to Support Analyst Workflow, pages 241-284,

Consolidate and harmonize views into tools and data and integrate them to maximize SOC workflow. Consider how the many SOC tools, including SIEM, UEBA, SOAR, and others fit in with the organization’s technical landscape, to include cloud and OT environments

🔗 Dedicated page

Cf. AI (ML, LLM, Agentic AI...)

IT/security Watch

MITRE reference

• 11 strategies for a world-class SOC, Strategy 6: Illuminate Adversaries with Cyber Threat Intelligence, pages 151-176,

Tailor the collection and use of cyber threat intelligence by analyzing the intersection of adversary information, organization relevancy, and technical environment to prioritize defenses, monitoring, and other actions.

🔗 Dedicated page

Cf. Watch

SOAR

MITRE reference

• 11 strategies for a world-class SOC, Strategy 8: Leverage Tools to Support Analyst Workflow, pages 241-284,

Consolidate and harmonize views into tools and data and integrate them to maximize SOC workflow. Consider how the many SOC tools, including SIEM, UEBA, SOAR, and others fit in with the organization’s technical landscape, to include cloud and OT environments.

🔗 Dedicated page

Cf. SOAR

Detection engineering

MITRE references

• 11 strategies for a world-class SOC, Strategy 1: Know What You Are Protecting and Why, pages 27-40,

Develop situational awareness through understanding the mission; legal regulatory environment; technical and data environment; user, user behaviors and service interactions; and the threat. Prioritize gaining insights into critical systems and data and iterate understanding over time.

• 11 strategies for a world-class SOC, Strategy 7: Select and Collect the Right Data, pages 179-240,

Choose data by considering relative value of different data types such as sensor and log data collected by network and host systems, cloud resources, applications, and sensors. Consider the trade-offs of too little data and therefore not having the relevant information available and too much data such that tools and analysts become overwhelmed.

• 11 strategies for a world-class SOC, Strategy 11: Turn up the Volume by Expanding SOC Functionality, pages 319-356,

Enhance SOC activities to include threat hunting, red teaming, deception, malware analysis, forensics, and/or tabletop exercises, once incident response is mature. Any of these can improve the SOCs operating ability and increase the likelihood of finding more sophisticated adversaries.

🔗 Dedicated page

Cf. detection engineering.

Threat intelligence

MITRE reference

• 11 strategies for a world-class SOC, Strategy 6: Illuminate Adversaries with Cyber Threat Intelligence, pages 101-123,

Tailor the collection and use of cyber threat intelligence by analyzing the intersection of adversary information, organization relevancy, and technical environment to prioritize defenses, monitoring, and other actions.

🔗 Dedicated page

Cf. threat intelligence.

Playbooks

Based on experience, I propose a few SOP (Standard Operating Procedures), that one may want to call playbooks.

🔗 Dedicated pages

• Windows malware critical controls
• Microsoft 365 and Entra ID compromise assessment
• Web server compromise assessment

Management

MITRE references

• 11 strategies for a world-class SOC, Strategy 1: Know What You Are Protecting and Why, pages 27-40

Develop situational awareness through understanding the mission; legal regulatory environment; technical and data environment; user, user behaviors and service interactions; and the threat. Prioritize gaining insights into critical systems and data and iterate understanding over time.

• 11 strategies for a world-class SOC, Strategy 2: Give the SOC the Authority to Do Its Job, pages 41-50

Empower the SOC to carry out the desired functions, scope, partnerships, and responsibilities through an approved charter and the SOCs alignment within the organization

• 11 strategies for a world-class SOC, Strategy 3: Build a SOC Structure to Match Your Organizational Needs, pages 101-123

Structure SOCs by considering the constituency, SOC functions and responsibilities, service availability, and any operational efficiencies gained by selecting one construct over another

• 11 strategies for a world-class SOC, Strategy 9: Communicate Clearly, Collaborate Often, Share Generously, pages 285-298

Engage within the SOC, with stakeholders and constituents, and with the broader cyber community to evolve capabilities and contribute to the overall security of the broader community.

• 11 strategies for a world-class SOC, Strategy 11: Turn up the Volume by Expanding SOC Functionality, pages 319-356

Enhance SOC activities to include threat hunting, red teaming, deception, malware analysis, forensics, and/or tabletop exercises, once incident response is mature. Any of these can improve the SOCs operating ability and increase the likelihood of finding more sophisticated adversaries.

🔗 Dedicated page

Cf. Management.

SOC metrics (KPI/SLA)

MITRE reference

• 11 strategies for a world-class SOC, Strategy 10: Measure Performance to Improve Performance, pages 301-318

Determine qualitative and quantitative measures to know what is working well, and where to improve. A SOC metrics program includes business objectives, data sources and collection, data synthesis, reporting, and decision-making and action

🔗 Dedicated page

Cf. SOC metrics (KPI/SLA)

HR and training

MITRE reference

• 11 strategies for a world-class SOC, Strategy 4: Hire AND Grow Quality Staff, pages 101-124

Create an environment to attract the right people and encourage them to stay through career progression opportunities and great culture and operating environment. Plan for turnover and build a pipeline to hire. Consider how many personnel are needed for the different SOC functions.

🔗 Dedicated page

Cf. HR and training.

IT achitecture of a SOC

Have a single and centralized platform ('single console')

As per NCSC website:

Indications of an attack will rarely be isolated events on a single system component or system. So, where possible, having a single platform where analysts have the ability to see and query log data from all of your onboarded systems is invaluable. Having access to the log data from multiple (or all) components, will enable analysts to look for evidence of attack across an estate and create detection use-cases that utilise a multitude of sources. By creating temporal (actions over a period of time) and spatial (actions across the estate) use-cases, an organisation is better prepared to address cyber security attacks that occur system wide.

Disconnect (as much as possible) SOC from monitored environment

The goal is to prevent an attacker from achieving lateral movement from a compromised monitored zone, to the SOC/CSIRT work zone.

Enclave:

• Implement SOC enclave (with network isolation), as per MITRE paper drawing:

• only log collectors and WEF should be authorized to send data to the SOC/CSIRT enclave. Whenever possible, the SOC tools pull the data from the monitored environment, and not the contrary;

• on top of a SOC enclave, implement at least a level 2 of network segmentation;

SOC’s assets should be part of a separate restricted AD forest, to allow AD isolation with the rest of the monitored AD domains.

Endpoints hardening:

• SOC/CSIRT's endpoints should be hardened with relevant guidelines;
  • My recommendations: CIS benchmarks, Microsoft Security Compliance Toolkit

To go further

📚 Must Read

Essential resources to build, run, and mature your SOC/CSIRT.

Frameworks & Methodologies

• MITRE, 11 strategies for a world-class SOC (PDF included in the repository) – Comprehensive MITRE guide to building a high-performance SOC.
• Microsoft, SOC/IR hierarchy of needs – Framework for SOC/IR maturity.
• Hunt.io, PEAK threat hunting framework – Framework for advanced threat hunting.
• PwnDefend, AD post-compromise checklist – Checklist for Active Directory compromise assessment.
• ANSSI (FR), EBIOS RM methodology – French risk management methodology.
• GMU, Improving Social Maturity of Cybersecurity Incident Response Teams – Research on CSIRT team dynamics.
• Expel, Reduce FP in a SOC - Reduce FP in a SOC.

Roles & Responsibilities

• CISA, Cyber Defense Incident Responder role – Role definition and responsibilities for incident responders.

Threat Intelligence

• MalAPI, list of Windows API and their potential use in offensive security – Windows API references for offensive/defensive security.
• FireEye, OpenIOC format – Open standard for sharing threat intelligence.
• Herman Slatman, Awesome Threat Intel – Curated list of threat intelligence resources.

Compliance & Regulations

• ENISA, Cybersecurity certificates – List of trusted cybersecurity service providers in the EU.

Tools & Architectures

• SentinelOne, EPP vs. EDR: Understanding the Differences – Explanation of endpoint security technologies.
• Wavestone, Security bastion (PAM) and Active Directory tiering model – How to reconcile PAM and AD tiering.
• Quest, Best practices for AD disaster recovery – AD backup best practices.
• Microsoft, Isolate Tier 0 assets with group policy – Guide to isolate Tier 0 assets.
• Gartner, Market guide for NDR – Market analysis of Network Detection and Response solutions.
• RecordedFuture - Role of OSINT tools, brief history, and how to use these popular tools to deliver crucial intelligence insights.
• MDRProviders.io, comparison of managed detection and response providers – Comparison of MDR providers by pricing, SLA, and breach warranty.

Use Cases & Implementations

• Microsoft, Windows 10 and Windows Server 2016 security auditing and monitoring reference – Auditing and monitoring guide for Windows.
• Medium, Wazuh at the heart of a SOC architecture for public/critical infrastructures – Use case for Wazuh in SOC architectures.
• CyberVigilance, Mitre Engenuity Evaluations 2022 review – Review of MITRE Engenuity evaluations.

📖 Nice to Read

Additional resources to expand your knowledge.

Standards & Controls

• NIST, SP800-53 rev5 (Security and Privacy Controls) – Security and privacy controls for information systems.
• CIS, Business Impact Analysis tool – Guide for assessing business impact of cyber incidents.
• RFC2350 (CERT description) – Framework for describing a CERT.
• SOC CMM, SOCTOM – SOC maturity model and tool.
• PTES – Penetration Testing Execution Standard.
• OWASP, WSTG – Web Security Testing Guide.
• Threat Hunting Framework - TaHiTI threat hunting framework.
• RecordedFuture, Threat Hunting - Using Threat Intelligence to master modern Threat Hunting.
• EU, TIBER purple teaming best practices

Cloud & Platforms

• Amazon, AWS Security Fundamentals – AWS security best practices.
• Microsoft, PAW Microsoft – Privileged Access Workstation (PAW) guidance.
• Elastic, BEATS agents** – Lightweight agents for data collection.

Incident Response

• Incident Response & Computer Forensics, 3rd ed – Book on incident response and forensics.
• Austin Songer, Incident playbook – Collection of incident response playbooks.
• CISA, Cybersecurity incident and vulnerability response playbooks – Ready-to-use playbooks for incident response.

SOC Tools & Architectures

• Reprise99, Microsoft Sentinel queries – KQL queries for Microsoft Sentinel.
• MyFaberSecurity, MS Sentinel architecture and recommendations for MSSP – Architecture and best practices for Microsoft Sentinel.
• Microsoft, Custom data ingestion and transformation in Microsoft Sentinel – Scenarios for data collection in Microsoft Sentinel.

Benchmarks & Surveys

• SANS SOC survey 2022 – Results of the 2022 SANS SOC survey.
• Gartner, PAM Magic Quadrant reprint – Market analysis of Privileged Access Management solutions.
• BitDefender, Analyzing MITRE ATT&CK evaluations 2024 – Analysis of MITRE ATT&CK evaluations.

Miscellaneous Resources

• Microsoft, command line reference – Windows command-line reference.
• CyberFlooD SwitchToOpen – Guide to switch from proprietary to open-source security tools.
• CNIL, GDPR implications – Economics implications of GDPR.
• CNIL, 2025 report - French CNIL's report for 2025.
• Sekoia, What is XDR? – Explanation of Extended Detection and Response (XDR).
• Microsoft, Licensing maps – Licensing comparison for Microsoft Defender and Modern Work plans.
• SANS cheat sheets - Ultimate list of (free) Cheat sheets.
• ENISA, Secure by design and default.

SOC sensors, nice to have

• Deceptive technology:
  • My recommendation: implement AD decoy acounts and AD DNS canary
• WAF for internet-facing websites/apps:
  • My recommendations:
    • FOSS: Crowdsec WAF, Bunkerweb
    • paid but good price: CloudFlare
• MDM:
  • My recommendation: Microsoft Intune
• (full-featured) Honeypot:
  • My recommendation: Canary.tools
  • Or, have a look at Awesome honeypots Git
• Phishing and brand infringement protection (domain names):
  • My recommendation: PhishLabs, Netcraft
• NIDS:
  • My recommendation: Crowdsec, ftagent-lite for lightweight flow-based network monitoring and DDoS detection (sFlow/NetFlow/IPFIX, adaptive baseline anomaly detection)
• NDR:
  • My recommendation: Gatewatcher
  • See Gartner MAgic Quadrant for NDR
• DLP:
  • See Gartner reviews and ratings
• OT (industrial) NIDS:

Harden SOC/CSIRT environment

• Implement hardening measures on SOC workstations, servers, and IT services that are used (if possible), e.g.:
  • CIS Benchmarks;
  • Microsoft Security Compliance Toolkit;
  • NIST, SP800-63B: Digital Identity Guidelines
• Put the SOC assets in a separate AD forest, as forest is the AD security boundary, for isolation purposes, in case of a global enterprise's IT compromise
• Create/provide a disaster recovery plan for the SOC assets and resources.
• Implement admin bastions and silo to administrate the SOC env (equipments, servers, endpoints):
  • My advice: consider the SOC environment as to be administrated by Tier 1, if possible with a dedicated admin bastion. Here is a generic drawing from Wavestone's article (see Must read references):
  • Recommended technology choices: Wallix PAM
  • Implement a level 3 of network segmentation
  • You may want to use throwable machines (virtual machines) for incident response or specific artefacts analysis. Here are my recommendations:
    • Microsoft Developer virtual machines;
    • Windows 11 clean-up script;
    • Windows 11 hardening tool
    • If needed, Flare-VM framework to automate security tools installation on analysts workstations;

Appendix

License

CC-BY-SA

Special thanks

Yann F., Wojtek S., Nicolas R., Clément G., Alexandre C., Jean B., Frédérique B., Pierre d'H., Julien C., Hamdi C., Fabien L., Michel de C., Gilles B., Olivier R., Jean-François L., Fabrice M., Pascal R., Florian S., Maxime P., Pascal L., Jérémy d'A., Olivier C. x2, David G., Guillaume D., Patrick C., Lesley K., Gérald G., Jean-Baptiste V., Antoine C., David Q., Philippe M., ...