What is Security operations center?

A team or facility that continuously monitors an organization's networks, endpoints and cloud services, analyzes alerts from SIEM and EDR, determines whether they are incidents and reports them to those who respond. It is abbreviated SOC (a different term from SoC, system on chip). It often operates around the clock, and many organizations outsource it to an external provider rather than running it themselves. Response to the incidents it identifies proceeds in cooperation with the CSIRT.

Japanese name: セキュリティオペレーションセンター

Security operations center appears in 1 practice question across 1 topic, including Cyber Attacks and Defense in Practice.

Field: Cyber Attacks and Defense in Practice

Try it: questions about Security operations center

Which of the following correctly matches SIEM, SOAR and SOC with their roles in security monitoring?

ASIEM is software that records endpoint behavior, SOAR is a device that encrypts traffic, and SOC is an identifier given to vulnerabilities
BSIEM automatically runs response procedures, SOAR collects and analyzes logs from each device, and SOC is the development team that handles product vulnerabilities
CSIEM collects and correlates logs from many devices, SOAR automatically runs response procedures (playbooks), and SOC is the team that uses them for monitoring

Show answer and explanation

Answer: C. SIEM collects and correlates logs from many devices, SOAR automatically runs response procedures (playbooks), and SOC is the team that uses them for monitoring

SIEM (security information and event management) collects logs from firewalls, servers, EDR, cloud services and so on in one place, aligns their timestamps and presents suspected attacks as alerts using rules that combine several events (correlation analysis). SOAR (security orchestration, automation and response) automatically runs set procedures such as gathering information, isolating devices and disabling accounts as playbooks in response to alerts, reducing analysts' workload. The SOC (security operations center) is the team that uses these to monitor, analyze alerts and determine and report whether something is an incident, and it often operates around the clock. Response to the incidents identified by the SOC is usually led by the CSIRT.

Security operations center in the explanations

The SOC (security operations center) is the team that uses these to monitor, analyze alerts and determine and report whether something is an incident, and it often operates around the clock.
Which of the following correctly matches SIEM, SOAR and SOC…