Security Operations and Management · Topic 2 of 3
SOC Workflow, People, Process, Technology and SOC Models
Learn the SOC workflow, analyst tiers, SOC processes and tools, and compare in-house, outsourced, hybrid and virtual SOC models for CSA 312-39.
- 5 min
- Includes a diagram
- A typical workflow order: Collect, Ingest, Validate, Report, Respond, Document.
- Tier I triages, Tier II investigates and responds, Tier III hunts and does deep analysis, the SOC manager runs operations.
- People, process and technology must all be present. A SIEM with no playbooks or trained staff is not an effective SOC.
What it is
A SOC runs on three pillars: people who analyze, processes that tell them what to do, and technology that collects and presents the data. The SOC workflow is the path an event follows from collection to a documented outcome. The six stages below are a typical workflow taught in SOC training, not a fixed standard.
A SOC model is how the organization sources that capability. It can build its own, buy it from a provider, or mix the two.
How it works
The SOC workflow
| Stage | What happens |
|---|---|
| Collect | Logs and events are gathered from endpoints, servers, network devices, applications and cloud services |
| Ingest | Data is parsed, normalized and stored in the SIEM, where correlation rules raise alerts |
| Validate | Tier I analysts triage each alert: true or false positive, scope and priority |
| Report | Confirmed incidents are recorded in a ticket and escalated to the right team |
| Respond | Tier II and the response team contain, eradicate and recover |
| Document | Actions, evidence and lessons learned are recorded for reports, audits and tuning |
The workflow loops. Documentation feeds new rules, playbook updates and better collection.
People: roles and tiers
| Role | Main tasks |
|---|---|
| Tier I analyst (triage) | Monitors alert queues, validates alerts, gathers first facts, opens tickets and escalates |
| Tier II analyst (incident responder) | Investigates escalated incidents in depth, finds scope and root cause, leads containment |
| Tier III analyst (subject matter expert) | Threat hunting, advanced malware and forensic analysis, builds new detections |
| SOC manager | Runs staffing, shifts, processes, metrics and reporting to leadership |
| Security engineer or architect | Deploys and maintains the SIEM, sensors and integrations |
| Threat intelligence analyst | Collects and applies intelligence to detection and response |
The CISO sets security strategy and is the usual escalation point for business impact. Shift handover notes keep 24x7 coverage consistent.
Process
Processes make response repeatable instead of depending on one person's memory.
- Monitoring and triage procedures: how to validate and prioritize each alert type.
- Escalation matrix: who is told, by when, for each severity.
- Incident response plan, playbooks and runbooks: the steps for each incident type.
- Service level agreements (SLAs): target times to acknowledge and resolve.
- Change management and use case management: how rules are added, tuned and retired.
- Reporting: daily, weekly and monthly reports for different audiences.
Technology
| Tool | Role in the SOC |
|---|---|
| SIEM | Central log collection, correlation, alerting and search |
| SOAR | Automates playbook steps and enrichment, orchestrates other tools |
| EDR and XDR | Endpoint (and extended) telemetry, detection and remote response |
| IDS and IPS | Detect or block malicious network traffic |
| Firewalls and proxies | Enforce traffic policy and log connections |
| Threat intelligence platform (TIP) | Gathers, scores and shares indicators |
| UEBA | Builds behavior baselines for users and devices and flags anomalies |
| Vulnerability scanner | Finds weaknesses to prioritize |
| Ticketing or case management | Tracks every incident from alert to closure |
SOC models
| Model | Description | Advantages | Disadvantages |
|---|---|---|---|
| In house (dedicated or internal) | The organization builds and staffs its own SOC | Full control, deep knowledge of the business, data stays inside | High cost, hard to hire and keep skilled staff, slow to set up |
| Outsourced (MSSP or SOC as a service) | A managed security service provider monitors for the organization | Fast start, 24x7 coverage, lower upfront cost, access to experts | Less control, less business context, data shared with a third party, contract dependent |
| Hybrid (co-managed) | Internal team plus a provider, for example the provider covers nights | Balances cost and control, fills skill gaps | Needs clear split of duties and tight coordination |
| Virtual SOC | A team works from different locations without a dedicated facility, often part time or on call | Low cost, flexible | Slower response, often not 24x7 |
| Command (global) SOC | Oversees several regional SOCs and gives a single view | Big picture across a large enterprise | Complex and expensive to run |
An internal SOC can be centralized (one site) or distributed (teams in several sites or time zones, which helps "follow the sun" coverage).
A worked example
A mid-size bank has four security staff, strict data residency rules and a regulator that expects 24x7 monitoring. Four people cannot cover every shift, and the bank wants sensitive logs to stay under its control.
A hybrid model fits best. The internal team handles business hours and owns the SIEM, while an MSSP covers nights and weekends under a clear escalation matrix and SLAs.
How the exam asks about this
- "Which SOC tier first validates alerts and escalates real ones?" → Tier I.
- "Which SOC model gives the organization the most control but the highest cost?" → In house SOC.
- "Which tool automates playbook steps across the SOC's other tools?" → SOAR.
What to remember for the exam
- A typical workflow order: Collect, Ingest, Validate, Report, Respond, Document.
- Tier I triages, Tier II investigates and responds, Tier III hunts and does deep analysis, the SOC manager runs operations.
- People, process and technology must all be present. A SIEM with no playbooks or trained staff is not an effective SOC.
- Outsourced SOCs start fast and cost less upfront but give less control and business context.
- Hybrid SOCs share duties between internal staff and a provider.
Do not confuse SOAR with SIEM. The SIEM detects and alerts. SOAR automates the response steps that follow.
Common mistakes
Escalating without validating. Tier I must decide true or false positive first. Passing every alert to Tier II floods the senior team.
Picking an MSSP when data must not leave the organization. If a scenario stresses data control or residency, a fully outsourced model is the weakest choice.
Skipping the Document stage. Without records there are no lessons learned, no audit evidence and no metrics.
Check yourself
Which workflow stage parses and normalizes logs in the SIEM?
Ingest. Data is parsed, normalized and stored so correlation rules can run on it.
Who usually performs threat hunting and advanced malware analysis?
Tier III analysts, the SOC's subject matter experts.
What is the main drawback of an outsourced SOC?
Less control and less business context, with security data shared with a third party.
Topic 2 of 3 in Security Operations and Management
Test yourself on Security Operations and Management
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.