Building a SOC means setting up an in-house security operations center: the analysts, processes and technology, such as SIEM, EDR and SOAR, needed to monitor, detect and respond to threats around the clock. It requires hiring and retaining enough people to cover every shift, licensing and tuning tools, and writing playbooks, which is why many companies weigh it against contracting SOC as a Service.
How TecnetOne handles it: TecnetSOC
SOC building, building a security operations center, how to build a SOC, build a SOC, in-house SOC, build vs buy SOC
Related terms
Microsoft Defender
Microsoft Defender is Microsoft's family of security products that protects devices, email, identities and cloud: Defender for Endpoint, for Office 365, for Identity and for Cloud, among others. Their alerts come together in the Microsoft Defender portal (Defender XDR), and several are included in plans such as Microsoft 365 Business Premium or E5.
CTEM (continuous threat exposure management)
CTEM (continuous threat exposure management) is a program, defined by Gartner, that continuously assesses what a company exposes to attackers, prioritizes what is truly exploitable and validates that fixes work. It follows five stages: scoping, discovery, prioritization, validation and mobilization.
TTP (tactics, techniques and procedures)
TTPs (tactics, techniques and procedures) describe how an attacker operates: the tactic is the goal at each stage, the technique is the method used to reach it and the procedure is the specific way it is carried out. Detecting TTPs works better than chasing single indicators, because an attacker can easily change IP addresses but not the way they operate.
External threat monitoring (cyber patrolling)
External threat monitoring, which TecnetOne calls cyber patrolling, is the continuous monitoring of the internet, social media, forums and the dark web to catch threats against a company early, such as network access for sale, data leaks or attack plans. Unlike digital risk protection (DRPS), which focuses on brand abuse and takedowns, it looks for signs that an attack against the company is being prepared.
Incident response plan
An incident response plan is the document that defines who does what, how people communicate and which steps to follow when a security incident occurs. It includes roles, contacts, escalation criteria, procedures by incident type and notification requirements, and it should be tested with drills.
DRPS (digital risk protection services)
DRPS (digital risk protection services) is a service that monitors the internet, social media, app stores and the dark web for threats against a brand, such as fake websites, impersonating profiles or leaked credentials, and manages takedowns. It protects what lives outside the company's perimeter.
Ready to put this into practice in your operation?
Tell us what you need and a TecnetOne engineer will get back to you.
Talk to an engineerTalk to an engineer
Tell us what you need and we’ll reply the same business day.