Understanding the SOC environment

What is a SOC?

SOC stands for Security Operations Centre. It is a team that monitors, investigates and responds to security threats. Analysts review suspicious activity, decide whether it represents a real issue, and help coordinate the response.

An internal SOC protects its own organisation. A Managed Security Service Provider (MSSP) can provide SOC services to several clients, each with its own systems and monitoring needs.

Endpoints, telemetry and ingestion

Endpoints are the devices being monitored: laptops, desktops, servers and virtual machines. A server is a computer that provides services or resources to other computers, such as hosting an application or managing logins.

Telemetry is the activity data collected from those systems. It can include process creation, sign-ins, network connections and file activity. Ingestion means bringing that data into a system where it can be stored and analysed.

How the Microsoft tools fit together

The tools have different roles, but their information can support the same investigation.

Microsoft Defender for Endpoint

An Endpoint Detection and Response (EDR) platform. It monitors endpoint activity and supports actions such as isolating a device or quarantining a file.

Microsoft Defender XDR

Combines security signals across areas such as endpoints, identities and email. XDR stands for Extended Detection and Response.

Microsoft Sentinel

A Security Information and Event Management (SIEM) platform. It brings together logs from different sources for detection, investigation and threat hunting.

Microsoft Azure

The cloud platform used for many Microsoft services, including the Azure resources supporting Sentinel.

Microsoft Entra ID

Manages identities, authentication and access to organisational resources. Its sign-in information can provide useful investigation context.

Microsoft 365 audit logs

The Unified Audit Log (UAL) brings together activity records from Microsoft 365 services such as SharePoint, OneDrive, Exchange and Teams. It is available through Microsoft Purview Audit.

For example, a record might show that a user accessed a file or changed a permission. It records what happened, rather than storing a copy of the original file, email or message.

For a SOC analyst, this makes it easier to investigate activity across several services in one place. These records can complement endpoint telemetry to help build a fuller picture of an incident.

Understanding attacker behaviour

A threat actor is a person or group carrying out harmful activity. TTPs stands for Tactics, Techniques and Procedures: the goals, methods and specific ways an attacker operates.

Tactics

What the attacker wants to achieve.

Techniques

How the attacker achieves that goal.

Procedures

The specific steps, commands or tools used to carry out a technique.

MITRE ATT&CK provides a shared way to describe these behaviours.

An intrusion vector is the route used to gain access, such as phishing or stolen credentials. DFIR stands for Digital Forensics and Incident Response: investigating what happened and responding to the incident.