> For the complete documentation index, see [llms.txt](https://0xzoro.gitbook.io/0xzoro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xzoro.gitbook.io/0xzoro/soc-operations/soc-fundamentals.md).
# SOC Fundamentals
**The SOC and Its Role**
1- Monitor
* Continuous observation for unusual activity
* Utilization of monitoring tools (IDS, SIEM, etc.) for real-time visibility
* Early detections of potential security threats
2- Detect
* Confirm security events identified during monitoring
* Utilize threat detection techniques
* Identify known indicators of compromise (IOCs)
3- Analyze
* Perform in-depth investigations to understand security incidents
* Examine affected systems, build a timeline of events
* Trace tactics, techniques, and procedures (TTPs)
4- Respond
* Formulate a response plan based on findings
* Contain threats, mitigate impact, and restore normal operations
* Collaborate with internal teams and stakeholders
people
* Analysts, responders, engineers, etc.
Process
* IR plans, playbooks, etc.
Technology
* SIEM, IDS, EDR, etc.
**Key Functions of the SOC TEAM**
**1- Reactive**
1- Monitoring and Detection
o Network and system logs, alerts
o SIEM, IDS, log analysis
o Alert triage
2- Incident Response
o Investigate, contain, and mitigate threats
o Collect evidence and artifacts
o Engage with stakeholders
3- Forensic Analysis
o In-house or third-party
o Determine cause and scope
o Preserve evidence and engage legal
4- Malware Analysis
o In-house or third-party
o Sandbox and reverse engineer malware
o Study malware behavior
o Collect indicators of compromise
**2- Proactive**
1- Threat Intelligence
o Gather and analyze intelligence
o Study emerging threats, vulnerabilities, and attacks
o Feed intel into detection tools for proactive defense
2- Threat Hunting
o Search for malicious activity or intrusions
o Logs, network traffic, endpoint telemetry
o Utilize threat intelligence to hunt for known indicators
3- Vulnerability Management
o Identify and address vulnerabilities
o Scan, assess, and patch
o Coordinate remediation activity
4- Security Awareness Training
o Promote security awareness within the organization
o Educate best practices, policies, and procedures
**Information Security Refresher**
**CIA Triad**
1- Confidentiality
o Protection of sensitive information from unauthorized access
o Ensures data is only accessible to those with proper authorization
2- Integrity
o Ensures that data remains accurate, reliable, and consistent
3- Availability
o Ensures that data and resources are accessible and usable when needed
**AAA Framework**
1- Authentication
o Verifies the identity of users attempting to access a system or resource
o Password, key, or other authentication methods
2- Authorization
o What actions or operations are we allowed to perform?
o Access levels based on roles, permissions, or privileges
3- Accounting
o Tracking and recording activities within a system
o Login attempts, resource access, audit logs
***
Vulnerability
o Weaknesses in systems, networks, or processes
o Can be exploited by threats to compromise CIA
o Exposes the organization to threats
Threat
o Any potential danger to information or systems
o Malware, phishing, denial of service
o Takes advantage of a vulnerability
Risk
o Likelihood of a threat exploiting a vulnerability
o Potential for loss and damage when a threat occurs
Log
o A record of events or actions that have occurred within a system
o Used for monitoring and troubleshooting security incidents
Security Event
o Any observable occurrence that has a potential significance for security
o All incidents are events, but not all events are incidents
Security Incident
o An occurrence that actually harms or jeopardizes information or systems
o Constitutes a violation of law, security policies, procedures, or acceptable use
Alert
o A notification generated by security systems or personnel
o Indication of a potential security issue or suspicious activity
**Detection Outcomes**
1- False Positive
o Incorrect identification of benign activity
2- True Positive
o Correct identification of a real security incident
3- False Negative
o Failed detection of a real security threat
4- True Negative
o Correct identification of benign activity
#### what is SOC :
security operation center , which is a centralized unit within an organization that deals with security issues incidents and events
#### what they are doing :
* monitor
* continuous observation for unusual activity using monitoring tools such as (IDS , SIEM , .. )
* detect
* utilize threat detection techniques to identify known IOC (indicators of compromise) and confirm security events during monitoring
* analyze
* perform in depth investigation to understand security incidents , examine affected systems , trace TTPS
* respond
* formulate a repones plan based on findings , to contain threats , mitigate impacts and restore normal operations ,and also collaborate with internal teams and stakeholders
#### the evolution of SOC :
#### 1- Availability Monitoring
**Description:**
At this initial stage, the SOC primarily focuses on ensuring that systems, services, and networks are available and operational. The goal is to detect and respond to outages or performance issues that could affect availability.
**Example:**
Consider a basic website monitoring tool that verifies if a website is operational by pinging it or sending HTTP requests. If the website doesn't respond, an alert is generated, prompting the SOC team to investigate the cause, whether it's a server issue, network problem, or another factor affecting availability.
#### 2. Reactive Monitoring
**Description:**
In this stage, the SOC evolves to not only monitor availability but also react to security incidents as they occur. The focus is on detecting and responding to threats such as malware infections, unauthorized access, or suspicious activities after they have already happened.
**Example:**
Imagine a SOC team that receives alerts from an Intrusion Detection System (IDS) when it detects a potential breach. The team then investigates the incident by analyzing logs, determining the extent of the breach, and taking steps to contain the threat, such as isolating affected systems or blocking malicious IP addresses.
#### 3. Proactive Monitoring
**Description:**
Moving to proactive monitoring, the SOC begins to anticipate potential threats before they materialize. This involves threat hunting, where analysts actively search for indicators of compromise (IOCs) or vulnerabilities in the environment, and vulnerability management to patch systems before they can be exploited.
**Example:**
A SOC might use threat intelligence feeds to identify emerging threats and indicators of compromise. For instance, if new ransomware is spreading globally, the SOC team proactively scans their environment for similar indicators, updates firewall rules, and patches vulnerable systems to prevent an attack before it happens.
#### 4. Proactive Automation
**Description:**
In the most advanced stage, the SOC integrates automation into its operations to handle repetitive tasks and respond to incidents in real time, reducing the need for manual intervention. This involves using Security Orchestration, Automation, and Response (SOAR) platforms that automate the detection, investigation, and response processes.
**Example:**
Consider a scenario where a phishing email is detected by a security tool. Instead of waiting for a security analyst to investigate, a SOAR platform automatically extracts indicators from the email, such as the sender's address, URLs, and attachments. It then cross-references these indicators with threat intelligence sources and, if deemed malicious, automatically quarantines the email, blocks the sender, and updates the organization's email filters to prevent similar attacks. This allows the SOC to respond to threats almost instantaneously, reducing the potential impact.
#### Summary
* **Availability Monitoring:** Focuses on ensuring systems are operational.
* **Reactive Monitoring:** Responds to security incidents after they occur.
* **Proactive Monitoring:** Anticipates and mitigates threats before they cause harm.
* **Proactive Automation:** Automates the detection and response process for greater efficiency and speed.
#### what make a SOC :
* people : analysts , responders , engineers
* process : IR plans , playbooks
* technology : SIEM , IDS , EDR
#### **Key Functions of a SOC :**
#### **Reactive Functions:**
1. **Monitoring and Detection**
* Analyze network and system logs and alerts.
* Utilize SIEM (Security Information and Event Management), IDS (Intrusion Detection System), and log analysis tools.
* Perform alert triage to prioritize and respond to potential threats.
2. **Incident Response**
* Investigate, contain, and mitigate security threats.
* Collect and analyze evidence and artifacts related to security incidents.
* Engage with key stakeholders to communicate the incident's impact and coordinate response efforts.
3. **Forensic Analysis**
* Conduct in-house or third-party forensic investigations.
* Determine the cause, scope, and impact of security breaches.
* Preserve digital evidence and engage with legal teams if necessary.
4. **Malware Analysis**
* Perform in-house or third-party analysis of malware.
* Use sandbox environments to reverse engineer and study malware behavior.
* Collect and analyze indicators of compromise (IOCs) to understand and mitigate threats.
#### **Proactive Functions:**
1. **Threat Intelligence**
* Gather and analyze intelligence on emerging threats, vulnerabilities, and attacks.
* Study and understand new threat vectors to enhance defense strategies.
* Integrate threat intelligence into detection tools to strengthen proactive defense mechanisms.
2. **Threat Hunting**
* Actively search for signs of malicious activity or intrusions within the environment.
* Analyze logs, network traffic, and endpoint telemetry to identify potential threats.
* Utilize threat intelligence to hunt for known indicators of compromise.
3. **Vulnerability Management**
* Identify and address security vulnerabilities across the organization’s infrastructure.
* Conduct regular scans, assessments, and patch management.
* Coordinate remediation activities to ensure vulnerabilities are resolved.
4. **Security Awareness Training**
* Promote a culture of security awareness throughout the organization.
* Educate employees on best practices, security policies, and procedures.
* Conduct regular training sessions to keep staff informed of the latest security threats and how to mitigate them.
#### difference between log and security event and security incident :
log : record or event or action that have been occurred within a system
security event : any observable occurrence that has a potential significance for security
security incident : event that actually harms system
#### **Security Control Functions :**
#### **Preventative Controls**
* **Purpose:** Aim to prevent or reduce the likelihood of a successful attack.
* **Examples:** Access Control Lists (ACLs), firewalls, Endpoint Detection and Response (EDR) systems, Intrusion Prevention Systems (IPS).
#### **Detective Controls**
* **Purpose:** Identify and record both attempted and successful intrusions.
* **Examples:** Intrusion Detection Systems (IDS), Security Information and Event Management (SIEM) systems, log monitoring, surveillance cameras.
#### **Corrective Controls**
* **Purpose:** Reduce or eliminate the impact of an intrusion after it occurs.
* **Examples:** Data backups, Incident Response (IR) plans, patch management.
#### **Deterrent Controls**
* **Purpose:** Discourage attempts to breach security.
* **Examples:** Physical barriers, signage, tamper-evident seals.
#### **Compensating Controls**
* **Purpose:** Provide alternative measures when primary controls are not feasible or effective.
* **Examples:** Serve as fallback options or additional layers of security to ensure protection.
#### **Risk Control Strategies :**
#### **Risk Transference**
* **Objective:** Shift the responsibility of managing a risk to a third party.
* **Examples:** Purchasing cybersecurity insurance, outsourcing to cloud service providers.
#### **Risk Acceptance**
* **Objective:** Acknowledge and tolerate the presence of a risk.
* **Examples:** Deciding to accept a risk as is, exempting or making exceptions based on calculated tolerance levels.
#### **Risk Avoidance**
* **Objective:** Proactively eliminate or completely avoid the exposure to a specific risk.
* **Examples:** Limiting the types of data stored on a server to avoid potential risks.
#### **Risk Mitigation**
* **Objective:** Reduce the likelihood or impact of a risk through active measures.
* **Examples:** Implementing patch management, applying security updates, and other protective actions.
#### SOC metrics :
1- Mean Time To Detect (MTTD) : measures the average time it takes for the SOC to detect a security incident or threat after it has occurred
2- Mean Time To Respond (MTTR) : the average time it takes to respond to and resolve a security incident after it has been detected.
3- Mean Time To Attend & Analyze (MTTAA) : measures the average time taken to acknowledge the detection and begin analyzing an alert or incident after it has been detected
4- Incident detection Rate : measures the percentage of actual security incidents that are successfully detected by the SOC.
5- False Positive Rates : measures the percentage of alerts that are incorrectly identified as incidents by the SOC.
6- False Negative Rates : measures the percentage of actual incidents that are not detected by the SOC.
###
