Basic Guide on SOC (Security Operation Center)

Basic Guide on SOC (Security Operation Center)

What is a SOC? What is its use?

The Security Operations Center means, in its literal translation, Security Operations Center, which can be understood as a centralizer of services aimed at information security, from specific projects to the conduct manual of people, processes and technology adopted by the company . The purpose of a SOC is to ensure data security. For this, the activities carried out involve:

  • Prevention: good practices that prevent incidents;
  • Detection: identification of security issues in processes;
  • Incident response: resolve security issues encountered;
  • Vulnerability assessment: monitoring and analysis of processes according to the risk of insecurity.

Thus, a SOC is composed of five distinct modules:

  • Alert generators;
  • Event collectors;
  • Database of messages;
  • Analysis mechanisms;
  • Reaction management software.

The main problem found in the construction of a SOC is the integration of all these modules and the correlation of data they generate, commonly constructed as autonomous parts, reconciling the integrity, availability and confidentiality of data and its transmission channels.

What tools and contents can I study to implement a SOC?

This is a question that many ask, as what usually goes into a SOC? Is it just a SIEM?

In fact SIEM is just one of the things that are part of a solution within a SOC, so if you want to work as a SOC Analyst or even a Security Analyst, you need to know the fundamentals of (Computer networks, Operating Systems, Infrastructure, Virtualization, Programming Logic, etc.)

Let's see some tools that can be used in a SOC?

SIEM (Security Event Management and Correlation)

Security Event Management and Correlation is a Software solution that combines SIM and SEM. A SIEM solution allows events generated by various security applications.

SIEM allows an organization to view its security events across the entire enterprise. By gathering log data from security systems, operating systems, applications and other software components, it can analyze large volumes of data and identify attacks.

RSA: https://www.rsa.com/

IBM Security (QRadar): https://lnkd.in/d2fkUTE

Splunk: https://lnkd.in/dEFxRkD

McAffe: https://lnkd.in/dFw_AJS

Logrhythm:https://logrhythm.com/

OSSIM: https://lnkd.in/dyU4zy3

EventTracker: https://lnkd.in/dHwzHWB

Elastic: https://lnkd.in/dkdSWth

TrustWave: https://lnkd.in/dwKcHWM

ArcSight: https://lnkd.in/dsMv-4V

InsightIDR: https://lnkd.in/dXbDrHq

Required knowledge:

  • Log Monitoring and Management (Knowing how to read logs)
  • Regex
  • Computer Networking Knowledge
  • Operational systems
  • Cyber Threats

Network and Infrastructure Monitoring

PRTG: https://www.br.paessler.com/PRTG

Zabbix: https://www.zabbix.com/download

Nagios: https://www.nagios.org/

Whatsupgold: https://www.whatsupgold.com/

Cacti: https://www.cacti.net/

Icinga: https://icinga.com/

Wireshark: https://www.wireshark.org/

Tcpdump: https://www.tcpdump.org/

Required knowledge:

  • Computer network
  • Network Infrastructure
  • Operational systems
  • Cyber Threats

Gerenciamento de LOGS

Graylog: https://www.graylog.org/

Xpolog: https://www.xplg.com/

Loggly: https://www.loggly.com/

Required knowledge:

  • Computer network
  • Knowledge in reading logs
  • Operational systems
  • Cyber threats

Gest?o de Vulnerabilidade

Nessus: https://pt-br.tenable.com/

Nexpose: https://www.rapid7.com/

Qualys: https://www.qualys.com/

Outpost24: https://outpost24.com/

Acunetix: https://www.acunetix.com/vulnerability-scanner/

Required knowledge:

  • Computer network
  • Knowledge in reading logs
  • Operational systems
  • Cyber threats

Threat Intelligence

Kaspersky: https://www.kaspersky.com.br/enterprise-security/threat-intelligence

Security Compass: https://www.securitycompass.com/

DCX Technology: https://www.dxc.technology/

OSINT Framework: https://osintframework.com/

Incident Response:

https://www.incidentresponse.com/

https://searchsecurity.techtarget.com/definition/incident-response

https://www.forcepoint.com/cyber-edu/incident-response

https://www.cybrary.it/course/incident-response-steps/

https://acaditi.com.br/ecih-treinamento-certified-incident-handler/

https://www.cybrary.it/course/implementing-an-incident-response-plan/

https://www.exabeam.com/incident-response/steps/

Computer Forensic:

https://www.forensiccontrol.com/what-is-computer-forensics

https://acaditi.com.br/chfi-treinamento-certified-computer-hacking-forensic-investigator/

https://www.youtube.com/watch?v=NmuhGa4QekU

https://www.cybrary.it/course/computer-hacking-forensics-analyst-archive-v1/

https://digitaldefynd.com/best-computer-forensics-courses/

Methodology Vulnerability Assessment :

https://owasp.org/www-project-top-ten/

https://csrc.nist.gov/publications/detail/sp/800-115/final

https://www.isecom.org/OSSTMM.3.pdf

https://www.futurelearn.com/courses/ethical-hacking-an-introduction/1/steps/522778

https://www.pentest-standard.org/index.php/Main_Page

Engenharia Reversa e Analise de Malware:

https://www.youtube.com/watch?v=Sp6Y83rdISo (Sobre Engenharia Reversa)

https://www.youtube.com/channel/UCuQ8zW9VmVyml7KytSqJDzg (Papo Binário)

https://www.youtube.com/watch?v=ZKObRxxbOCQ&list=PLBf0hzazHTGMSlOI2HZGc08ePwut6A2Io (Playlist Analise de Malware)

https://www.youtube.com/watch?v=D6mVIos-S2M (Introdu??o a Engenharia Reversa)

https://www.cybrary.it/course/malware-analysis/

https://www.cybrary.it/course/binwalk-tutorial/

https://www.cybrary.it/course/windbg-tutorial/

https://www.cybrary.it/course/ollydbg-tutorial/

https://www.youtube.com/watch?v=Sv8yu12y5zM (Engenharia Reversa)

https://www.youtube.com/watch?v=LC81gbmTsiE&list=PLUFkSN0XLZ-kwukmQOAgCZ08C5REoZElt (Playlist Engenharia Reversa de Malware)

Algumas certifica??es:

EC-COUNCIL

CND (Certified Network Defender), CEH (Certified Ethical Hacker), ECIH (Certified Incident Handler), CHFI (Computer Hacking Forensic Investigator), ECSA (Certified Security Analyst), CSA (Certified SOC Analyst), CTIA (Certified Threat Intelligence Analyst)

Aonde estudar? https://acaditi.com.br/

CompTIA

Network+, Security+, CySA+, Linux+, Casp+, PenTest+

Aonde estudar? https://www.strongsecurity.com.br/ e https://4linux.com.br/cursos/linux (Mesmo sendo foco LPI1, "s?o quase o mesmo conteúdo")

This is a small content about SOC, if you want to pursue a career in the field of SOC Analyst, I recommend Cybrary's guide

https://www.cybrary.it/catalog/career-path/soc-analyst-level-1/

https://www.cybrary.it/catalog/career-path/soc-analyst-level-2/

https://www.cybrary.it/catalog/career-path/soc-analyst-level-3/

Take a look and try to set up your own labs to put your knowledge into practice.

Adriano Pacheco

Consultor de seguran?a da informa??o | GRC | SOC

2 年

Cara, muito bom esse artigo!!! Me ajudou muito a ter uma base de estudos ??????

回复
Juliana C.

Information Security | AppSec | Cybersecutity

2 年
Luiz Eduardo Eleuterio de Souza

Analista de seguran?a da informa??o GRC - ISH | Pentester | Red Team

2 年

Muito bom seus conteúdos, continua assim, ajuda muita gente.

回复
Edjanio Silva

Cloud | DevOps | CyberSecurity

4 年

Valeu Joas mais um excelente artigo.

回复
Maycon Rodrigues

Information Security | Blue Team | SOC | CyberSecurity

4 年

Tmj brow ??

要查看或添加评论,请登录

社区洞察

其他会员也浏览了