# Security operations center

> The team that watches an organization's systems around the clock for attacks.

- Level: Intermediate
- Topics: Security
- URL: https://tidbit.legios.com.ar/security-operations-center/
- In Spanish: [Centro de operaciones de seguridad](https://tidbit.legios.com.ar/es/security-operations-center/)

A **security operations center**, or **SOC**, is the team (and often the room) in charge of watching an organization's systems for attacks and reacting when one happens. Think of it as the security guards of the digital side: they monitor alerts day and night, decide which ones are real, and contain the damage when something gets through.

The day-to-day work is a loop. Tools such as a SIEM and endpoint protection on every laptop send alerts. **Tier 1** analysts triage them: most are false alarms, some are a user who clicked a phishing link. Real cases go to more experienced analysts who investigate, isolate an infected computer, reset stolen passwords or block an attacker's address. Afterwards the team writes down what happened and adjusts its rules so the same trick is caught earlier next time. Some SOCs also do **threat hunting**: actively looking for intruders no alert has spotted.

Running a SOC 24/7 takes several shifts of skilled people, which is expensive. That is why many mid-size companies hire one as a service from a specialized provider (often called **MDR**, managed detection and response) instead of building their own. Whatever the setup, the point is the same: attacks happen at night and on holidays too, and the sooner someone notices, the smaller the damage.

## An analogy

A fire station for computers. Most calls are false alarms or a burnt toast, but the team is always on duty, knows the building, and when there is real smoke it arrives in minutes, not days.

## Keep in mind

- A SOC monitors, detects, responds to and learns from security incidents.
- Analysts are organized in tiers: triage first, deep investigation after.
- Its main tools are a SIEM, endpoint protection and well-rehearsed playbooks.
- Many organizations rent a SOC as a managed service instead of staffing one.

## Go deeper

- [Security operations center on Wikipedia](https://en.wikipedia.org/wiki/Security_operations_center)
- [What is a security operations center? (IBM)](https://www.ibm.com/think/topics/security-operations-center)

## Related terms

- [SIEM](https://tidbit.legios.com.ar/siem/): The system that gathers security logs from everywhere and raises the alarm.
- [Phishing](https://tidbit.legios.com.ar/phishing/): A fake message that tricks you into handing over a password or a payment.