A security operations centre (SOC) is a team of security analysts, and the room they work in, that watches a company's computer systems around the clock for attacks. The analysts work in shifts, so someone is always awake. Large Indian banks are required by the RBI to run one.
The SOC reads alerts. An alert is a message from a security tool saying that something looks wrong. Every security tool in a company sends alerts: the email filter, the login system, the security software on every laptop, the firewall and many more. A large company can receive tens of thousands of alerts a day, and almost all of them are harmless. The SOC's job is to find the few that are a real attack, and to stop the attacker before the attack is finished.
Take, for example, one night at a large bank in Chennai. At 3 a.m., the account of an employee in the payroll team starts downloading the bank's customer database. The employee is asleep at home. Someone has stolen the employee's password.
First, the record. Every system writes a log, a line of text for each thing that happens, such as "this account logged in from this address at 2:58 a.m." All the logs go into the SIEM, one large searchable store of logs. A rule in the SIEM notices that a payroll account has never downloaded customer records before. It raises an alert.
Second, the sorting. Sorting the real alerts from the harmless ones is called triage. An AI SOC analyst reads every alert first. It checks the address that the data is going to against a threat intelligence platform, which lists addresses known to belong to attackers. It puts this alert at the top of the queue.
Third, the decision. A human analyst reads the evidence and confirms that it is a real attack. This analyst may work for the bank, or for a contractor that watches the bank's alerts at night. That service is called managed detection and response (MDR). Both can work on one shared security operations platform.
Fourth, the response. The analyst approves a playbook, a list of response steps written in advance. SOAR software runs the steps automatically: it cuts the computer off from the network, disables the employee's account and opens a ticket. By hand, this takes about an hour.
Fifth, the report. Digital forensics works out how the password was stolen and which records left the bank. The incident response team writes the final report.