2022 Developer Survey is open! Take survey.

Questions tagged [soc]

A SOC is a security operations center, a centralised facility in an organisation for monitoring the organisation's security posture, escalating or dealing with any security problems that arise.

Filter by
Sorted by
Tagged with
0 votes
1 answer
62 views

Is Sysmon.exe modifying root certificate legit activity

Today I got an alert on my Elastic SIEM that sysmon.exe has modified or created a root certificate. I tried to look for the certificate thumbprint in the Microsoft trusted root program and could not ...
user avatar
  • 31
2 votes
1 answer
116 views

What is the difference between a SOC and a CSIRT?

So, from a summary of what I have found on the internet, a SOC collects information and the CSIRT makes conclusions based on that info. However, from what I see in labs/challenges websites like ...
user avatar
1 vote
1 answer
148 views

What are the (two?) definitions of SOC?

On one hand "Security Operations Centre", but SOC is seemingly used in the reporting and certification domain, where does this come from? Is there another (or more) definitions of SOC in ...
user avatar
2 votes
0 answers
106 views

Hardware Secure Element

After checking multiple suppliers and reading about HW secure elements, I would like to understand the use of this type of electronic components. Maybe I´m wrong, but it seems a HW secure element ...
user avatar
1 vote
1 answer
132 views

How to detect use of personal NAS devices from corporate machines?

We have an issue where people are taking laptops home and connecting them to their personal home networks in order to backup corporate data to their private NAS devices. From a DLP standpoint we have ...
user avatar
1 vote
1 answer
157 views

Local Scans initiated from a VLAN Broadcast IP address

Just reviewing some logs and I am seeing local scans to several local IP addresses on port 137 within my network. The source IP however is the broadcast IP of the VLAN (.255). I have checked the ...
user avatar
41 votes
3 answers
8k views

What is the meaning of Triage in Cybersec world?

I searched Google about this term, but the definitions that I found was related to the medical world, and nothing related to IT. I think that is some kind of procedure of documenting something maybe? ...
user avatar
0 votes
1 answer
1k views

Contents for Security Operations Reporting

Are there good guides or references on what a monthly report from a Managed service provider such as a SOC would be ?
user avatar
-1 votes
1 answer
141 views

How to calculate the priority and the severity of our daily cyber security intelligence threat feeds?

Some solutions (eg. FireEye ISight) can provide a daily feed where they will mention each reported issue with it's severity and priority. Usually those companies will do some basic research and look ...
user avatar
  • 1,182
-1 votes
1 answer
148 views

Where should I look for information once there is a security incident reported on breaking news? [closed]

We see breaking news alerts popping up with some dramatic headline, but headlines can be tricky and bring a lot of chaos to the organization and more specifically to the SOC. Where will be the best ...
user avatar
  • 1,182
2 votes
2 answers
385 views

How should we mitigate threats that are keep coming to our security monitoring system?

We have continuous cybersecurity threat feeds that coming to our SOC on a daily basis from different sources that provide all the new CVEs, new malware variations and more. We just don't know how to ...
user avatar
  • 1,182
3 votes
4 answers
795 views

SOC and generic log parsing

I am making a conceptual work-flow of a SOC so if we suppose that a SIEM solution is integrated inside an organization's in-house SOC. Also, if the team of the SOC is the one managing the SIEM ...
user avatar
  • 33
6 votes
4 answers
22k views

What is the difference between a SIEM and a SOC?

What is the difference between a SIEM (Security Information and Event Management) and a SOC (Security Operations Centre)? Do they work together? And if independent when to use which?
user avatar
0 votes
3 answers
272 views

What is the difference between Compliance and Auditing in Information Security?

I am a student working on my semester project and it's about developing a SIEM solution with Big Data tools to be used in a SOC (security operations centre) and I know that collecting logs can be used ...
user avatar
  • 33
1 vote
3 answers
1k views

Is penetration testing included in the job of a NOC?

I was researching about what job position is related with ethical hacking. I found something like SOC and NOC, but I got a little bit confused. I know SOC tier 1 does programming tasks and ...
user avatar
5 votes
2 answers
679 views

Incident Responders: Can you give some examples of Incidents / types of incidents that are suitable for fully or partly automated response? [closed]

You setup security monitoring - either a full commercial SIEM/SOC or something home-cooked (e.g., rsyslog -> OSSIM / MozDef / Splunk / ...). You also setup some rules so that some event triage is ...
user avatar
  • 2,638
0 votes
3 answers
459 views

How to achieve other security compliances/certifications on AWS after satisfying HIPAA? [closed]

Our infrastructure is built entirely on AWS and we went through the HIPAA process to ensure that our system is HIPAA-compliant. Where should we look or what next steps can we take to obtain other ...
user avatar
  • 101
4 votes
1 answer
3k views

Steps to become SOC 2 compliant?

Are there any specific steps one must follow to achieve SOC 2 compliance? Or should one just get a checklist from a specialized auditor? Some context: We are a small company and need to become SOC 2 ...
user avatar
6 votes
1 answer
113 views

Is there a certification AICPA grants to qualified auditors?

We are in the process of hiring an auditor in order to become SOC 2 compliant and would like to know if there's some kind of official auditor listing available, or at least a certification or AICPA ...
user avatar
0 votes
1 answer
1k views

Are SIEM and NIDS/HIDS complementary?

I just would like to have your feedback if you were involved with Security Information and Event Management. From your experience, do we have to add a SIEM to an existing NIDS (snort) and HIDS (ossec)...
user avatar
  • 1
2 votes
1 answer
338 views

SOP for SQL Injection Attack

What should (or) how an Incident Handler do (or) follow when an SQL injection attack is reported? Initial Response Analysis Action Aiming to make a procedure guide to follow for myself and my team. ...
user avatar
-3 votes
1 answer
428 views

Confused for taking up job in Information Security? please help me [closed]

I am a fresher computer science graduate from India , I always wanted to pursue career in Information Security and interested in VAPT. But company I am selected in is giving me Security Operations ...
user avatar
  • 181
8 votes
2 answers
730 views

Setting up own enterprise SOC

The other day I was talking with a service provider (MSSP) who has experience with operating SOC (security operations centre) 24x7. Their price was rather steep (in the millions range). I don't ...
user avatar
  • 705
1 vote
0 answers
271 views

Anatomy of a Cyber exercise and SOC

What exactly entails an incident response exercise (like a Red/Tiger team excercise)? How does it add value to a security operations center? Is there any good resource I can read up on how to set up a ...
user avatar
  • 705
1 vote
2 answers
1k views

What are the most relevant security events/incidents any company should monitor? [closed]

What are the most relevant security events/incidents any company should monitor using event management tools? Related to servers, antivirus, networks, etc.
user avatar
7 votes
1 answer
2k views

Security Operation Center (SOC)

I am looking for resources and details on establishing a security operation center (SoC) or network operation center (NoC) based on ITIL or any other applicable regulations. Where can I find good ...
user avatar
3 votes
1 answer
2k views

How many people are required to build your own 24x7 security operations center (SOC)? Rough costs?

I have received this question from a few clients, but I have 0 experience building a 24x7 SOC.
user avatar
  • 13.7k