Digital Forensics and Incident Response - Second Edition

SOC and CSIRT combined

To limit some of the drawbacks with the SOC escalation model, some organizations embed the SOC within the overall CSIRT team. Placing the SOC in such a structure may prove to be a more efficient fit since the SOC has responsibility for the initial alerting and triaging function, which is directly related to the CSIRT.

In this model, the SOC analyst serves as the first tier. As previously discussed, they have the first view of security events or security control alerts. After processing and triaging the alert, they have the ability to immediately escalate the incident to the Tier 2 analyst, without having to engage a manager who would then escalate it to the CSIRT manager. This process is highlighted in the following ...