How to Build a Security Operations Center: A Practitioner's Guide
Most organizations that build a SOC underestimate what it takes to operate one. A room with screens, a SIEM license, and three analysts is not a SOC — it is the infrastructure for a SOC that will take 12 to 18 months to reach the detection coverage and operational maturity needed to justify its cost.
The most important decision in SOC development is not which SIEM to buy. It is whether to build, buy, or augment — and at what scale. This guide covers the organizational and technical decisions that determine whether a SOC investment produces security outcomes versus expensive alert triage infrastructure.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts — distilled for practitioners. 50,000+ subscribers. No noise.
Build vs Buy vs Augment: The Decision Framework
Organizations under approximately 1,000 employees with limited security budgets should not build a 24/7 in-house SOC. The economics do not work: 24/7 coverage requires a minimum of five to six analysts across three shifts, and the fully loaded annual cost of that team exceeds $1.5 million before tooling, infrastructure, or management overhead. A Managed Detection and Response (MDR) service provides 24/7 analyst coverage, mature detection content, and tooling at $200,000 to $600,000 annually — better economics, faster time to coverage, and access to analyst expertise that takes years to develop internally.
Organizations with 1,000 to 5,000 employees and meaningful security budgets should consider a hybrid model: internal detection engineers and Tier 2/3 analysts who own the detection program, supplemented by an MDR provider for 24/7 Tier 1 alert triage and after-hours coverage. This model keeps detection strategy and critical incident response in-house while solving the staffing and coverage challenges that make pure in-house 24/7 SOCs difficult to operate.
Organizations with 5,000 or more employees, significant compliance obligations, or classified environments typically require a full in-house SOC. The scale justifies the investment, the compliance requirements may restrict what can be outsourced, and the internal threat surface is complex enough that deep institutional knowledge matters.
MDR providers to evaluate for the outsourced or hybrid model: CrowdStrike Falcon Complete, SentinelOne Vigilance, Palo Alto XMDR, Arctic Wolf, and Huntress. Evaluate them on analyst response SLA (time from alert to analyst action), detection coverage across ATT&CK, escalation procedures, and contractual data handling terms.
SOC Staffing Model and Analyst Tiers
A functional SOC uses a tiered analyst model that routes work by complexity rather than treating every analyst as interchangeable.
Tier 1 analysts handle alert triage: reviewing incoming alerts, making true/false positive determinations against documented playbooks, and escalating confirmed incidents. Tier 1 is high-volume, lower-complexity work. The skill requirement is proficiency with the SIEM and EDR console, knowledge of the alert types they are triaging, and the judgment to recognize when an alert requires escalation. Tier 1 analysts typically have one to three years of security experience.
Tier 2 analysts handle incident response and investigation: investigating escalated alerts, performing deeper log analysis, coordinating containment actions, and producing incident documentation. Tier 2 requires deeper technical skills: log analysis, attacker TTP knowledge, and familiarity with forensic techniques. Tier 2 analysts typically have three to five years of experience.
Tier 3 analysts and detection engineers handle threat hunting, detection development, and complex incident response. This is the most senior function: building new detection rules, running ATT&CK-aligned hunts, reverse engineering malware, and handling the most complex incidents that Tier 2 escalates. These roles require five or more years of experience and specific technical depth.
A 24/7 SOC requires shift coverage. A common staffing model for in-house 24/7 operations: three shift teams of two to three Tier 1 analysts, a day-shift team of Tier 2 analysts with on-call rotation for after-hours escalations, and one to three Tier 3 analysts and detection engineers who work standard business hours. Total headcount for a minimally staffed 24/7 SOC: 10 to 15 analysts. Under-staffing Tier 1 creates an alert backlog; under-staffing Tier 3 means the detection content that Tier 1 uses becomes stale.
Technology Stack: The Four Required Layers
A SOC technology stack has four layers, each required for full operational capability. The most common failure mode is investing heavily in one layer (typically EDR) while underinvesting in another (typically SOAR), creating operational inefficiencies that limit detection throughput.
Layer 1 — Telemetry collection: EDR for endpoint telemetry, network detection (NDR or NSM) for network traffic analysis, identity provider logs, and cloud infrastructure logs (CloudTrail, Azure Monitor). The breadth and quality of telemetry determines the ceiling on what detections are possible.
Layer 2 — Detection and analytics: SIEM or data lake for correlation and rule-based detection, UEBA for behavioral analytics, and threat intelligence platform integration for IOC enrichment. The SIEM is the SOC's primary detection surface — detection engineering investment directly determines how many real threats surface as actionable alerts versus how much noise analysts process.
Layer 3 — Case management and workflow: ticketing system integration (ServiceNow, Jira, or a dedicated security case management tool) and documented playbooks for each alert type. Without structured case management, SOC work is invisible to leadership and impossible to measure.
Layer 4 — Orchestration and automation: SOAR platform for automating repetitive Tier 1 actions (IP enrichment, user lookup, asset context enrichment, automatic ticket creation) and automated response for high-confidence detections (account lock on credential stuffing detection, host isolation on confirmed ransomware behavior). SOAR investment pays back in Tier 1 analyst capacity — each automated triage action is analyst time returned to higher-value work.
Detection Coverage Priorities for a New SOC
A new SOC should resist the temptation to build detections for everything immediately. Detection coverage that is too broad produces false positives that overwhelm Tier 1 capacity and train analysts to distrust alerts — the opposite of what a SOC is designed to do.
Start with the twenty detections that cover the highest-risk attack patterns for your environment. For most enterprise environments, this set includes: impossible travel authentication (login from two locations faster than travel allows), off-hours admin account use, new local administrator account creation, PowerShell encoded command execution, process spawning from Microsoft Office applications (T1566 phishing execution pattern), LSASS memory access by non-system processes (credential dumping), lateral movement via PsExec or WMI from an unusual source, DNS requests to domains registered within the past 30 days with high entropy names (DGA C2), large outbound data transfers during off-hours, and ransomware behavioral patterns (mass file modification or deletion).
Document a playbook for each detection before enabling it. A detection without a playbook forces Tier 1 analysts to make investigation decisions without guidance, producing inconsistent response quality. The playbook defines: what the detection means, what Tier 1 should check to determine true/false positive, what the escalation criteria are, and what containment actions Tier 1 is authorized to take without escalation.
Measure false positive rates per detection from day one. Any detection with a false positive rate above 20% should be tuned or disabled — it is consuming analyst time without producing security value. Detection quality is more important than detection quantity.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, remediation steps, and every daily briefing.
The bottom line
A SOC is an operational capability, not an infrastructure deployment. The organizations that build effective SOCs invest as much in staffing model design, detection content quality, playbook development, and analyst development as they do in tooling. A Tier 3 detection engineer who writes twenty high-quality detection rules with documented playbooks produces more security value than a SIEM license that comes pre-loaded with five hundred noisy rules that no analyst trusts.
Frequently asked questions
What is the difference between a SOC and an MDR service?
A SOC (Security Operations Center) is an internal team with dedicated analysts monitoring an organization's environment. An MDR (Managed Detection and Response) service is an outsourced provider that delivers SOC-like capabilities — 24/7 monitoring, threat detection, and response — as a service, typically providing their own tooling and analyst team. MDR services provide faster time to coverage and lower operational overhead than building an internal SOC, but offer less customization and institutional environment knowledge than an in-house team.
How many analysts does a 24/7 SOC require?
A minimal 24/7 SOC with two analysts on each eight-hour shift requires six Tier 1 analysts for shift coverage alone (accounting for vacation, sick leave, and turnover requires seven to eight). Add two to four Tier 2 analysts for day-shift investigation coverage with on-call availability, and one to two Tier 3 analysts and detection engineers for detection development and complex incidents. Total minimum viable 24/7 SOC: ten to twelve analysts. Organizations that budget for fewer than ten analysts for 24/7 operations will be chronically understaffed within the first year.
What SIEM is best for a new SOC?
The SIEM decision should follow the existing environment rather than lead it. Organizations heavily invested in Microsoft (Azure AD, M365, Azure infrastructure) get the most native integration value from Microsoft Sentinel. Organizations with heterogeneous environments and mature detection engineering teams get the most flexibility from Splunk Enterprise Security or Elastic SIEM. Organizations that want the fastest time to detection value with least detection engineering investment should evaluate cloud-native MDR platforms (CrowdStrike Falcon, SentinelOne Singularity) that include the SIEM, EDR, and detection content as an integrated stack.
What metrics should a new SOC track?
For the first year, prioritize: mean time to detect (MTTD) by incident type, mean time to respond (MTTR) from alert generation to containment, Tier 1 alert false positive rate per detection rule, detection coverage percentage against your priority ATT&CK techniques, and analyst capacity utilization (percentage of shift time spent on investigation vs administrative tasks). These five metrics give you the signals needed to prioritize SOC improvement efforts during the build-out phase. Alert volume is a useful operational metric but should never be the primary KPI — high alert volume with high false positive rates is a program failure, not a success metric.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, weekly, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals weekly.