Modern day SOC Evolution from Open Source to Unlimited Budget

The speakers, who run the security operations for a large conference network, trace how their setup grew from a single router and a few off-the-shelf parts in the early days to a team of more than 60 people serving about 25,000 attendees. As the event grew, cheap open-source scripts and hardware stopped scaling, so they began borrowing enterprise equipment from vendors in exchange for exposure.

The core of the talk walks through the building blocks they consider essential for a modern SOC: endpoint detection, central log storage in a SIM or data lake, network detection, orchestration and automation, threat intelligence platforms, sandboxing, behavior analytics, and identity controls. For each, they name leading commercial and open-source picks, drawn from informal polls of experienced practitioners, and weigh buying a product against staffing a team to run open tools. Real cases illustrate the points, including rental laptops with a compromised golden image caught by endpoint detection, an unknown HVAC system found through network traffic, and sensitive financial documents sent without encryption.

They close by explaining that hostile-looking traffic at a conference is mostly expected, so they tune alerts around classroom context and automate closure of benign detections. Their takeaways are to keep logs long enough to uncover long-running intrusions, validate what the network actually shows, be careful when baselining behavior, and expect AI assistants and insurance requirements to shape future SOCs.