Digital Forensics and Incident Response - Second Edition

Security Operations Center escalation

In this organizational model, the Security Operations Center (SOC) is responsible for handling the initial incident detection or investigation. In general, the SOC is responsible for the management of the security tools that monitor the network infrastructure. It has direct access to event management, intrusion prevention and detection, and antivirus systems. From here, it is able to view events, receive and review alerts, and process other security-related data.

SOC escalation is a common model among organizations that have a dedicated SOC, either through in-house personnel or through a third-party Managed Security Service Provider (MSSP). In this model, there are clearly defined steps, from the initial ...