Security Operations 2018: What Is Working? What Is Not.
summary
SOCs are overloaded with low‑fidelity alerts, often running ~40 tools but using maybe 5% of features, and more than 50% of orgs admit they ignore events because analysts burn out. Target operational goals include events per analyst hour ≈13 to be effective; prevention‑based architecture (consistent protection, centralized management, automated IOC enforcement) cuts response from weeks to minutes; hunting works only as formal, time‑boxed, intelligence‑driven exercises; measure configuration and operational confidence, not MTTR or feed counts.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:10Socks
- 11:32Simping
- 12:43Turing Machine
- 16:30Prevention Based Architecture
- 20:06Where We Want To Be
- 22:27Hunting
- 24:58Tools
- 27:50Vendor Management
- 29:59Building Your Own
- 33:51Working With The Business
- 37:39Metrics
related talks
49mStories from the SOC Front Lines
03mFighting Every Threat with AI Agents: The Future of Security Operations
32mThe SOC Of The Future… The Future Is Now
41mOne SOC, The Whole SOC, and Nothing But The SOC, So Help Me
20mSIEM There, Done That: Rising Up in the SecOps Revolution
32mConfidence in Chaos: Strategies for World-Class Security Operations
51mThe No BS SOC Story
40mHow to Ruin your SOC in 5 Easy Steps