The No BS SOC Story
summary
Gives a playbook for growing a SOC from one or two people to a global 24x7 operation, backing recommendations with Microsoft CDOC metrics and practices: prioritise reducing dwell time by measuring MTTR/MTTA and focusing detections from endpoint email identity rather than network, start operationally with XDR and automation and treat SIEM as later, avoid vendor “silver bullet” and tool-sprawl anti‑patterns, expect many benign positives (Microsoft sees high benign rates), and apply co-pilot for security for impact analysis, incident summarization and script reverse engineering.
AI-written summary · about
chapters (10)
- 0:00Introduction and context
- 6:02Addressing industry BS
- 10:00Defining security operations
- 14:29Culture and teamwork
- 19:00Anti-patterns and solutions
- 24:08Metrics and measurement
- 28:58Evolution of threats
- 31:51Managing burnout
- 35:30The role of AI
- 42:21Operational maturation
related talks
32mThe SOC Of The Future… The Future Is Now
49mStories from the SOC Front Lines
41mOne SOC, The Whole SOC, and Nothing But The SOC, So Help Me
54mSOCcing: Responding to a Cyber Incident
32mConfidence in Chaos: Strategies for World-Class Security Operations
40mHow to Ruin your SOC in 5 Easy Steps
29mSOC with a Fig Leaf
24mDetection & Response: Building Effective SOC Operations