Ravi Sir's Cyber Security Cards › Revision Cards
What a SOC Is
What a SOC Is A SOC (Security Operations Centre) is the team that watches an organisation’s systems day and night, finds attacks and responds. MSSP : a company that runs a SOC for many clients. Playbook : steps for one type of alert. Ticket : a tracked alert or incident. Tools find things; the SOC d
Read card text
What this card says
What it is
A SOC (Security Operations Centre) is the team that watches an organisation’s systems day and night, finds attacks and responds.
Common terms
MSSP: a company that runs a SOC for many clients.
Playbook: steps for one type of alert. Ticket: a tracked alert or incident.
Why it matters for security
Tools find things; the SOC decides what is real and acts.
Tiers: L1 triages, L2 investigates, L3 handles the hardest cases.
| Tier | Role | Typical work |
|---|---|---|
| L1 | Alert monitoring / triage analyst | Watches the SIEM dashboard, checks each alert, closes false… |
| L2 | Incident responder | Investigates escalated alerts deeply, contains the threat,… |
| L3 | Threat hunter / senior analyst | Hunts for hidden attackers, writes detection rules, handles… |
| SOC manager | Lead | Processes, reporting, coordination with management and legal |
Learn more in the lesson: 31.1 What a SOC Is