{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/soc","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/soc/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/soc/"},"term":{"en":"Security operations centre (SOC)","da":"Security operations center (SOC)"},"aka":{"en":["SOC","security operations center"],"da":["SOC","sikkerhedscenter"]},"domain":["security"],"cluster":"controls","layer":"people","status":"current","summary":{"en":"A team that watches an organisation's systems around the clock and acts when an alarm points to a real attack.","da":"Et team, der overvåger organisationens systemer døgnet rundt og griber ind, når en alarm peger på et reelt angreb."},"body":{"formal":{"en":"A central function, run in house or bought as a service, whose analysts follow alarms from tools such as SIEM and EDR, sort real threats from noise, look into them and start incident response.","da":"En central funktion, drevet internt eller købt som en tjeneste, hvor analytikere følger alarmer fra værktøjer som SIEM og EDR, skiller reelle trusler fra støj, undersøger dem og sætter hændelseshåndteringen i gang."},"plain":{"en":"Like the control room of a fire service - people who never sleep, watch every call that comes in, and decide which ones need a truck right now.","da":"Som alarmcentralen hos brandvæsenet - folk, der aldrig sover, ser hvert opkald, der kommer ind, og afgør, hvilke der kræver en brandbil lige nu."},"inPractice":{"en":"At 3 a.m., at a SOC that a Danish region buys as a service, an analyst sees an admin login from an unknown country, checks with the region's on-call IT lead that it was not him, and locks the account.","da":"Klokken 3 om natten ser en analytiker i den SOC, en region køber som tjeneste, et administratorlogin fra et ukendt land, bekræfter med regionens vagthavende IT-ansvarlige, at det ikke var ham, og spærrer kontoen."},"whyItMatters":{"en":"Tools raise alarms, but only people decide what they mean; without someone watching, a warning at night can sit unread until the damage is done.","da":"Værktøjer slår alarm, men kun mennesker afgør, hvad alarmen betyder; uden nogen til at holde øje kan en advarsel om natten ligge uden at blive læst, til skaden er sket."}},"deepDive":{"en":"A SOC is an organisational capability - people, process and technology - rather than a room or a product. Its core loop is detect, triage, investigate, respond and improve. Many SOCs are organised in tiers: tier 1 analysts triage incoming alerts against runbooks and close false positives or escalate; tier 2 performs deeper investigation, scoping and containment; tier 3 covers threat hunting, malware analysis, forensics and detection engineering. The tier model is increasingly criticised because it concentrates repetitive, burnout-prone work at the bottom and slows escalation, and many teams are replacing tier-1 triage with SOAR playbooks and automated enrichment so that humans handle judgement rather than copy-paste.\n\nThe technology stack usually centres on a SIEM for log correlation, EDR for endpoint telemetry and response, network detection (IDS/NDR), a case-management or ticketing system, threat intelligence feeds and a SOAR platform. The process layer consists of use cases mapped to MITRE ATT&CK, playbooks for common incident types (phishing, account compromise, ransomware precursor activity), escalation matrices with the business, and shift handover. The SOC-CMM model is a widely used self-assessment for SOC maturity across business, people, process, technology and services domains.\n\nSourcing is a strategic decision. Staffing one 24/7 seat in-house takes, by a common rule of thumb, around five to six analysts once shifts, leave and training are covered, which is beyond most small and mid-sized organisations. Alternatives are managed security service providers (MSSP) that monitor devices and forward alerts, managed detection and response (MDR) services that also investigate and take containment actions using their own or the customer's EDR, and hybrid models with an internal team during business hours and a provider at night. The contract must specify response authority - may the provider isolate a production server at 3 a.m.? - as well as log ownership, retention and exit terms.\n\nA SOC is distinct from a CSIRT or CERT, which coordinates incident response, communication and recovery once an incident is declared, although small organisations merge the roles. NIST SP 800-61 Rev. 3 (2025) repositions incident response within the NIST CSF 2.0 functions rather than as a standalone lifecycle. Under NIS2, essential and important entities must submit an early warning to the CSIRT or competent authority within 24 hours of becoming aware of a significant incident and an incident notification within 72 hours (Art. 23); in practice the SOC is where awareness starts the clock. Common metrics are mean time to detect, mean time to respond, alert-to-incident ratio and detection coverage, although chasing speed metrics alone can encourage premature alert closure.","da":"En SOC er en organisatorisk kapabilitet - mennesker, processer og teknologi - snarere end et lokale eller et produkt. Kernen er en løkke: opdage, triagere, undersøge, reagere og forbedre. Mange SOC'er er organiseret i niveauer: tier 1-analytikere triagerer indkomne alarmer efter runbooks og lukker falske positiver eller eskalerer; tier 2 står for dybere undersøgelse, afgrænsning og inddæmning; tier 3 dækker threat hunting, malwareanalyse, forensics og detection engineering. Niveaumodellen kritiseres i stigende grad, fordi den samler det gentagne, udbrændingsfarlige arbejde nederst og sinker eskalering, og mange teams erstatter tier 1-triage med SOAR-playbooks og automatisk berigelse, så mennesker bruger tiden på vurderinger frem for copy-paste.\n\nTeknologistakken er typisk centreret om en SIEM til logkorrelation, EDR til telemetri og respons på endpoints, netværksdetektion (IDS/NDR), et sags- eller ticketsystem, threat intelligence-feeds og en SOAR-platform. Proceslaget består af use cases kortlagt til MITRE ATT&CK, playbooks for almindelige hændelsestyper (phishing, kompromitterede konti, forstadier til ransomware), eskaleringsmatricer med forretningen og vagtoverdragelser. SOC-CMM er en udbredt model til selvevaluering af en SOC's modenhed på tværs af domænerne forretning, mennesker, processer, teknologi og services.\n\nOrganiseringen er en strategisk beslutning. At bemande én plads døgnet rundt internt kræver efter en gængs tommelfingerregel omkring fem-seks analytikere, når vagter, ferie og uddannelse er dækket, hvilket ligger uden for rækkevidde for de fleste små og mellemstore organisationer. Alternativerne er managed security service providers (MSSP), der overvåger udstyr og videresender alarmer, managed detection and response (MDR), hvor leverandøren også undersøger og foretager inddæmning med egen eller kundens EDR, og hybride modeller med et internt team i dagtimerne og en leverandør om natten. Kontrakten skal fastlægge beføjelserne til at reagere - må leverandøren isolere en produktionsserver klokken 3 om natten? - samt ejerskab til logs, opbevaring og exitvilkår.\n\nEn SOC er noget andet end et CSIRT eller CERT, der koordinerer hændelseshåndtering, kommunikation og genopretning, når en hændelse er erklæret, selv om små organisationer slår rollerne sammen. NIST SP 800-61 Rev. 3 (2025) placerer hændelseshåndtering inden for funktionerne i NIST CSF 2.0 i stedet for som en selvstændig livscyklus. Efter NIS2 skal væsentlige og vigtige enheder sende en tidlig varsling til CSIRT'en eller den kompetente myndighed inden for 24 timer efter at have fået kendskab til en væsentlig hændelse og en hændelsesunderretning inden for 72 timer (art. 23); i praksis er det i SOC'en, at kendskabet starter uret. Typiske nøgletal er mean time to detect, mean time to respond, forholdet mellem alarmer og hændelser samt detektionsdækning, men jagt på hastighedstal alene kan friste til at lukke alarmer for tidligt."},"edges":[{"type":"requires","to":"security/incident-response","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/threat-intelligence","why":{"en":"Up-to-date knowledge of how attackers work helps the team tell a real attack from a false alarm.","da":"Aktuel viden om, hvordan angribere arbejder, hjælper teamet med at skelne et reelt angreb fra en falsk alarm."},"confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"NIST SP 800-61 Rev. 3 - Incident Response Recommendations and Considerations","tier":"standard","publisher":"NIST"},{"title":"CIS Controls v8 - Control 17 (Incident Response Management)","tier":"standard","publisher":"Center for Internet Security"}],"draft":true}