How to Save Your SOC from Stagnation

The talk opens with the familiar feeling of SOC work: overwhelming alerts, weak data, and processes that never seem to improve. The presenter argues that teams can break out of this by changing how they work rather than simply buying more tooling, and introduces seven practices that can be adopted one or two at a time.

The middle of the talk covers those practices. Regular detection review meetings bring triage staff, detection authors, hunters and data specialists together to rank ideas, and detections should be tested before they count as working. After significant cases, a short technical review walks through the queries and data sources used, which doubles as training. Teams should record their data sources in a structured catalogue, since most of the data they depend on sits outside their control. Response automation can begin with low-risk work such as ticket creation, and proactive hunts can run saved queries on a schedule, with random findings kept separate from hypothesis results. Standard operating procedures should be maintained by everyone, and post-incident reviews should capture problems quickly in rough notes, then turn them into tracked fixes. Service owners can also join onboarding, hunts and detection writing.

The closing point is that these changes free up capacity, so analysts are ready when the next major incident arrives. The presenter advises starting small, and suggests checking whether some compliance activities the team performs are actually required.