Why This Matters#

Prevention eventually fails. When it does, the speed and quality of your detection and response determines whether an incident is a minor event or a catastrophic breach. Security operations is the 24/7 function that watches, detects, and responds.

Security Operations Center (SOC)#

SOC Tiers#

SOC Metrics#

SIEM (Security Information and Event Management)#

Centralized log aggregation, correlation, and alerting:

flowchart LR
    subgraph Sources["Log Sources"]
        FW["Firewalls"]
        EP["Endpoints (EDR)"]
        Cloud["Cloud (CloudTrail)"]
        App["Applications"]
        Auth["Auth Systems"]
        Net["Network (NDR)"]
    end
    
    Sources --> SIEM["SIEM<br/>(normalize, correlate, alert)"]
    SIEM --> Alerts["Alerts"]
    SIEM --> Dashboards["Dashboards"]
    SIEM --> Hunt["Threat Hunting"]
    SIEM --> SOAR["SOAR<br/>(automated response)"]

Detection Rule Types#

SIGMA Rules#

Vendor-agnostic detection rule format (like Snort rules for logs):

title: Suspicious PowerShell Download
status: stable
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'powershell'
            - 'downloadstring'
    condition: selection
level: high

SOAR (Security Orchestration, Automation, and Response)#

Automates repetitive SOC tasks:

Playbook Example: Phishing Response#

flowchart TD
    Alert["Phishing Alert"] --> Extract["Extract IOCs<br/>(URLs, hashes, sender)"]
    Extract --> Check["Check Threat Intel<br/>(VirusTotal, reputation)"]
    Check --> Malicious{"Malicious?"}
    Malicious -->|Yes| Block["Block sender + URLs"]
    Block --> Search["Search for other recipients"]
    Search --> Remove["Remove from all mailboxes"]
    Remove --> Notify["Notify affected users"]
    Malicious -->|No| Close["Close as false positive"]
    Notify --> Ticket["Create incident ticket"]

Incident Response Lifecycle#

NIST SP 800-61 Framework#

flowchart LR
    Prep["1: Preparation"] --> Detect["2: Detection<br/>& Analysis"]
    Detect --> Contain["3: Containment<br/>Eradication<br/>Recovery"]
    Contain --> Post["4: Post-Incident<br/>Activity"]
    Post --> Prep

Phase 1: Preparation#

Phase 2: Detection & Analysis#

Phase 3: Containment, Eradication, Recovery#

Phase 4: Post-Incident#

Incident Severity Classification#

Digital Forensics#

Evidence Handling#

Forensic Data Sources#

Memory Forensics#

What you can find in a memory dump:

• Running and recently terminated processes
• Network connections (including encrypted)
• Encryption keys (BitLocker, TLS session keys)
• Injected code and rootkits
• Command history
• Credentials in memory

Threat Hunting#

Proactive search for threats that evade automated detection:

Hunting Approaches#

Hunting Loop#

flowchart LR
    Hypothesis["Form<br/>Hypothesis"] --> Collect["Collect<br/>Data"]
    Collect --> Analyze["Analyze<br/>& Search"]
    Analyze --> Finding{"Finding?"}
    Finding -->|Yes| Investigate["Investigate<br/>& Respond"]
    Finding -->|No| Refine["Refine<br/>Hypothesis"]
    Investigate --> Detect["Create<br/>Detection Rule"]
    Refine --> Hypothesis
    Detect --> Hypothesis

Breach Notification#

Regulatory Requirements#

Key Takeaways#

1. Detection speed matters most — MTTD determines breach impact
2. Automate the repetitive — SOAR handles Tier 1 tasks, humans handle judgment
3. Preparation is everything — playbooks, training, and tools BEFORE the incident
4. Preserve evidence first — you can’t investigate what you didn’t collect
5. Post-incident reviews improve everything — every incident is a learning opportunity
6. Threat hunting finds what automation misses — proactive > reactive
7. Know your notification obligations — GDPR 72h clock starts at awareness