Building and running a SOC
You design a SOC from scratch: scope, use cases, shift patterns, metrics, maturity assessment and working with an external provider.
Level 501 · 12 lessons · 12 practice labs
Lessons
Design
- The SOC charter: mission, scope, authority
- The use case catalogue
- In-house, outsourced and hybrid SOC models
- Short task: write a SOC charter for a mid-sized company
People and process
- Staffing and the shift plan
- Alert fatigue and analyst burnout
- The analyst development path
- Short task: draw up a round-the-clock shift roster
Measurement
- Metrics reported to management and their pitfalls
- Maturity assessment
- Continuous improvement and exercises
- Capstone: prepare and present a SOC’s first-year plan
Practice labs
- Find the missing sections in a SOC charter: Mark which of mission, scope, authority and reporting are missing from a given draft.
- Write a SOC charter for a mid-sized company: Write a one-page charter for Karaçam Mobilya covering mission, in-scope systems, authority to act and the reporting line.
- Compare in-house, outsourced and hybrid SOC models on cost and risk: Score the three models against a given budget, headcount and compliance needs, choose one for Yelkovan Bankası and name the work that must stay in-house.
- Match use cases to their log sources: Choose the log source each of ten use cases needs and flag those that depend on a source you lack.
- Fill in a use case card from start to finish: Write a card for additions to a privileged group with objective, data source, detection logic, response steps and owner.
- Prioritise the catalogue against a threat model: Score thirty use cases against the organisation’s three main threats and data readiness, pick eight for the first quarter and state the risk of those left out.
- Find the gaps in a shift roster: Mark the hours with no cover and the analyst working two consecutive nights in a weekly roster.
- Draw up a round-the-clock shift roster: Prepare a four-week roster for six analysts that allows for leave and handover time, showing weekly hours per person.
- Measure alert fatigue from data and plan the improvement: Calculate alerts per analyst, handling time and the share closed without review, find the three heaviest rules and write a six-week reduction plan.
- Calculate the mean detection and response time for the SOC: Calculate mean time to detect and mean time to respond from the timestamps of twenty cases.
- Correct a misleading metric and present it to management: Prove from data why the count of closed alerts does not show success and propose two outcome-based metrics instead.
- Run a maturity assessment and derive the first-year plan: Score process, technology and people on a five-level scale from the given evidence, pick the three weakest areas and write a one-year plan that includes exercises.
About this course
You design a SOC from scratch: scope, use cases, shift patterns, metrics, maturity assessment and working with an external provider.
What you will learn
- Design
- People and process
- Measurement
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.