I am making a conceptual work-flow of a SOC so if we suppose that a SIEM solution is integrated inside an organization's in-house SOC. Also, if the team of the SOC is the one managing the SIEM solution.
My question is when we will face a log format that does not match any of the parsing rules already stored in the SIEM parser then we will move to a generic format and manually add a new parsing rule for this entry. So which Analyst level should be in charge of this task? Knowing that I have:
Level 1 (Triage): responsible for ordinary alerts and closing false-positives
Level 2 (Analyze): basically, this is where qualification of non-ordinary alerts are escalated from L1 to L2 which need further investigation.
Level 3 (Investigation): For deep investigations where we will need to identify attack vectors and actors also apply some data enrichment...
Remediations Team: Where we will contain and eradicate and recover from the incident...
SOC management: handles administration, supervision and service management of the SOC.