1. Monitor
2. Receive alerts
3. Triage / Qualify
4. Analyze (Level 1)
5. Respond (basic)
6. Escalate if needed
7. Document
1. Monitoring & Detection
Objective: Gain real-time visibility into all activities
-Continuous monitoring via SIEM / XDR / NDR
-Monitoring security dashboards
-Detecting anomalies and suspicious behavior
-Tracking automated alerts (rules, AI, UEBA)
-Verifying the health of security tools
---
2. Alert Handling & Triage
Objective: Filter noise and identify real threats
-Receiving alerts (SIEM, EDR, email, phishing)
-Rapid triage (priority / severity)
-Classification: true positive vs false positive
-Quick enrichment (IP, hash, user, device)
---
3. Level 1 Investigation
Objective: Quickly understand what is happening
-Log analysis (authentication, network, endpoint)
-Security event analysis
-Pivoting (IP, user, machine)
-Verification of Indicators of Compromise (IOCs)
---
4. Initial Response & Remediation
Objective: Contain the threat quickly
-Applying playbooks
-Limited response actions:
-Endpoint isolation (EDR)
-IP / domain blocking
-Account disablement
-Specific handling :
Phishing (analysis + removal + blocking)
---
5. Incident Management & Escalation
Objective: Ensure efficient handoff
-Creating and updating tickets (ITSM)
-Incident classification
-Escalation to SOC L2 / L3 when necessary
-Tracking incident lifecycle
---
6. Documentation & Communication
Objective: Ensure traceability and clarity
-Writing incident reports
-Documenting analysis
-Internal communication (IT / security teams)
-Updating procedures
---
7. Use Case & Playbook Management
Objective: Industrialize detection
-Executing existing use cases
-Applying SOAR playbooks
-Verifying alert quality
-Providing feedback on detection rules
---
8. Threat Intelligence & Threat Context
Objective: Understand the adversary
-Consulting Threat Intelligence feeds
-Enriching alerts (IP, domains, malware)
-Identifying ongoing campaigns
---
9. Tools & Environment Management
Objective: Ensure operational availability
-Verifying proper functioning of tools
-Basic management (EDR agents, missing logs)
-Escalation in case of tool failure
---
10. Continuous Improvement
Objective: Improve SOC performance
-Feedback on recurring incidents
-Suggesting playbook improvements
-Reducing noise (false positives)
-Participating in lessons learned (post-incident reviews)
---
11. Support for Advanced Activities
Objective: Assist L2 / L3 teams
-Collecting data for advanced investigations
-Preparing incident cases
-Providing basic forensic support
Copyright © All rights reserved.