One SOC, The Whole SOC, and Nothing But The SOC, So Help Me
summary
Argues the SOC must be atomic: keep triage/analysis/response, hunt/detection/intel, tools/architecture and situational awareness together or chaos follows. Shows common failures: engineering split out leads to “us vs them,” hunting and intel excluded, truth-telling absent, and zero capacity for improvement. Recommends bringing detection engineers close, running detection V‑teams, keeping composite asset inventory and vuln scanning linked to the SOC, doing post‑incident knowledge shares, and allocating 20% to 50% capacity for non‑incident work to enable continual improvement.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker background
- 3:14The SOC's atomic mission
- 6:05What belongs in the SOC
- 11:02What doesn't belong in the SOC
- 12:06Four common SOC mistakes
- 16:38Engineering in the SOC
- 17:00Excluding hunt and threat intel
- 20:34Truth-telling in the SOC
- 22:17Building SOC capacity
- 25:07Conclusion: One SOC, the whole SOC
- 26:33Q&A session begins
related talks
32mThe SOC Of The Future… The Future Is Now
51mThe No BS SOC Story
53mSecurity Operations 2018: What Is Working? What Is Not.
32mConfidence in Chaos: Strategies for World-Class Security Operations
40mHow to Ruin your SOC in 5 Easy Steps
49mStories from the SOC Front Lines
24mDetection & Response: Building Effective SOC Operations
30mModern SOC:Less Than One and More Than Infinity