The security operations center (SOC), also known as the computer incident response team (CIRT), is the security team that handles and monitors daily security events. The organizational structure of SOC can include parts of the existing IT team, an outsourced team, or a dedicated security team. No matter what kind of structure it has, there are several key functions that the team will have:
|
Key functions |
Description |
|
Security incident analysis and forensics (call center) |
This function team may include the Tier 1 case handling in the 24/7 security monitoring center. The Tier 1 team typically handles the case by following the predefined checklist or SOP to perform initial root-cause analysis or mitigation based on the incidents. |
|
Security operations and administration |
This functional team involves the following routine security activities. These are regular... |