What does a security operations center (SOC) do?

The details

Smaller organizations often use a managed SOC or managed detection and response (MDR) service rather than staffing one in-house. AI agents are increasingly used to speed up triage and enrichment, with analysts approving actions.

Useful next reads and tools

• How to Build an Agentic SOC: A 4-Phase Roadmap for AI Security Operations · guide
• Triage of Distributed SSH Authentication Failures · lab

Terms explained

SIEM

A SIEM (security information and event management) system collects logs from across an organization, correlates them and raises alerts for analysts to investigate.

SOC (security operations center)

A security operations center (SOC) is the team, in-house or outsourced, that monitors systems for threats, triages alerts and leads the technical response to incidents.

EDR (endpoint detection and response)

Endpoint detection and response (EDR) software records activity on laptops and servers, detects suspicious behavior and lets responders investigate and contain threats remotely.

Sources

• NIST SP 800-61 Rev. 3 Incident Response
• MITRE ATT&CK