thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Security Operations Center (SOC)

A centralized team and facility that monitors, detects, analyzes and responds to cybersecurity incidents around the clock.

Definition

A SOC combines people (analysts, engineers, hunters, managers), processes (playbooks, escalation, metrics) and technology (SIEM, SOAR, EDR/XDR, threat intelligence). It may be in-house, outsourced to an MSSP or MDR provider, or hybrid. Maturity is measured through metrics such as MTTD and MTTR.

Example

A 24x7 SOC triaging SIEM alerts and escalating confirmed incidents to the incident response team.

Exam tip

Know SOC models (internal, outsourced, hybrid) and the tiered analyst structure.

Related terms