What is a SOC in cybersecurity?
A SOC is the function that turns security data into decisions. It receives events and alerts from the organization's tools, decides which ones deserve attention, investigates the ones that could be an attack and coordinates the response. It can be a room full of screens or a remote, distributed team. Either way, what matters is whether it detects and contains attacks in time.
Its value shows in who detects first. According to Mandiant's M-Trends 2026 report (Google Cloud), in 52% of the intrusions it investigated in 2025, the organization itself was the first to detect the malicious activity, up from 43% the previous year. In the rest, the organization found out from an external source.
What does a SOC do?
- Monitoring: collecting and watching events from endpoints, network, email, identity, cloud and applications, day and night.
- Alert triage: deciding whether an alert is a false positive, legitimate activity or something to investigate, and with what priority.
- Investigation: reconstructing what happened, which machines and accounts are involved and since when.
- Response and containment: isolating machines, blocking accounts, cutting off communications and coordinating recovery with the IT team.
- Detection engineering: writing, testing and tuning the rules that generate alerts so they catch real techniques with as little noise as possible.
- Threat hunting: proactively searching, based on hypotheses, for activity that has not triggered any alert.
- Threat intelligence: bringing in IOCs, campaigns and techniques from the actors that target your industry and your country.
- Continuous improvement: reviewing every incident, measuring times such as MTTD and MTTR and fixing process failures.
What does each SOC analyst tier do?
The classic structure splits the work into three tiers with progressive escalation. The names change from one organization to another, but the logic is the same: the higher the tier, the more complex the case and the more experience it takes.
| Tier | Main role | Day-to-day work |
|---|---|---|
| Tier 1 (L1) | Triage | Works through the alert queue, rules out false positives, gathers basic context and escalates what looks real. |
| Tier 2 (L2) | Investigation and response | Analyzes escalated cases in depth, determines scope, carries out containment and proposes remediation. |
| Tier 3 (L3) | Expert | Handles complex incidents, performs forensic and malware analysis, hunts for threats and improves detections. |
| SOC manager | Management | Organizes shifts and procedures, measures performance and explains risk to leadership. |
Beyond these tiers, many SOCs have specialized roles: detection engineers, threat intelligence analysts and threat hunters. In small teams, one person covers several roles.
What tools does a SOC use?
Each tool covers one part of the cycle. The outcome depends on how they are combined and who operates them.
| Tool | What it is for | Common limitation |
|---|---|---|
| SIEM | Centralizes and correlates logs from many sources, stores the history and generates alerts based on rules. | It generates a lot of noise if rules are not maintained, and its cost usually grows with data volume. |
| EDR / XDR | Records process, file and connection activity on machines and lets you isolate them. XDR extends correlation to email, identity, network or cloud. | EDR only sees the machine it is installed on; XDR depends on the sources you integrate. |
| SOAR | Orchestrates and automates repetitive tasks with playbooks: enriching an alert, opening a ticket, blocking an indicator. | Playbooks are deterministic: they do what they were programmed to do and fail on cases nobody anticipated. |
| NDR | Analyzes network traffic to detect lateral movement, exfiltration or communications with command-and-control servers. | Encryption limits how much of the content it can see. |
| Threat intelligence | Provides IOCs, actors, campaigns and techniques to enrich and prioritize alerts. | Without context or expiry dates, IOCs generate false positives. |
| Ticketing | Records each case, its owner and its status so nothing gets lost between shifts. | It adds waiting time if every escalation depends on a manual ticket. |
What types of SOC are there?
- In-house SOC: your own staff, tools and processes. Maximum control and business knowledge, in exchange for high cost and the difficulty of staffing 24/7 shifts.
- Outsourced SOC (SOC as a service or MDR): a provider monitors and responds across your environment. You get continuous coverage without building your own shifts, but you need to define clearly what the provider can do and with what data.
- Hybrid SOC: your team handles what it knows best (architecture, business decisions, remediation) and a provider covers continuous monitoring, nights and weekends.
- Co-managed SOC: a variant of the hybrid model in which both teams work on the same tools and share the case queue.
If you are deciding whether to build your own or hire one, our guide on in-house vs outsourced SOC compares cost, coverage, talent and control.
Why does the traditional SOC model have bottlenecks?
The classic model was born when there were fewer sources and fewer alerts. Today its limits show up in four places.
- Alert volume: every new tool adds its own queue. Tier 1 spends much of each shift ruling out false positives, and medium-priority alerts go unreviewed.
- Manual, repetitive triage: for each alert, the analyst checks an IP's reputation, who the user is, what role the machine plays and whether there was similar activity. Those minutes multiply across hundreds of alerts.
- Slow escalations: every jump from Tier 1 to Tier 2 and from Tier 2 to Tier 3 goes through a ticket and someone being available. At night and on weekends that wait grows, and attackers take advantage of it.
- Turnover and knowledge held by people: Tier 1 work wears people down, turnover is high and the judgment needed to make decisions leaves with whoever walks out the door.
These bottlenecks explain automation in the SOC: first with SOAR and now with AI agents that handle triage and enrichment and leave decisions to the analyst. We explain this in our guide on what an agentic SOC is.
How do you measure whether a SOC is working?
The most widely used metrics are mean time to detect (MTTD), to acknowledge (MTTA), to contain (MTTC) and to respond (MTTR). Add coverage (which sources and which MITRE ATT&CK techniques you really detect) and quality: the false positive rate and the share of incidents the SOC detects itself versus those reported by an outside party. A SOC that quickly closes irrelevant alerts and misses what matters can have a good MTTR and still fail.
How Ciberia helps
Ciberia MDR operates 24/7 on the tools you already have, with the managed service included. It integrates with more than 600 sources (EDR/XDR, SIEM, firewall, email, identity, cloud and ticketing) and does not replace your EDR or your SIEM. It runs on sovereign AI: proprietary agents, built on our own architecture, investigate every alert in seconds and automate about 90% of triage, and an analyst validates decisions with impact. For critical alerts, the contractual SLA is 15 minutes from alert to initial containment.
