<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: soc-operations
description: >-
  Security Operations Center workflows including alert triage, escalation procedures,
  SIEM query optimization (Splunk SPL, Elastic KQL, Microsoft KQL), SOAR playbook
  design, threat hunting hypothesis development, SOC metrics (MTTD/MTTR/FPR), analyst
  runbooks, shift handoff procedures, and SOC maturity assessment.
domain: cybersecurity
subdomain: soc-operations
tags:
  - soc
  - siem
  - soar
  - alert-triage
  - splunk
  - elastic
  - sentinel
  - threat-hunting
  - runbook
  - soc-metrics
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["TA0043", "TA0001", "TA0002", "TA0003", "TA0005"]
  nist-csf: ["DE.AE-1", "DE.AE-2", "DE.AE-3", "DE.CM-1", "RS.AN-1"]
  frameworks: ["MITRE D3FEND", "SOC-CMM", "NIST SP 800-61"]
---

# SOC Operations

## When to Use

Activate when the operator asks about SOC workflows, alert triage, SIEM queries,
SOAR playbooks, threat hunting, SOC metrics, analyst training, or SOC maturity.

Mode: `[MODE: BLUE]` for SOC operations; `[MODE: INCIDENT]` for escalated alerts.

## Quick Reference

| Task | Tool / Query | Context |
|------|-------------|---------|
| Failed logins | SPL: `index=auth action=failure \| stats count by src_ip, user` | Triage |
| Brute force | KQL: `SecurityEvent \| where EventID == 4625 \| summarize count() by TargetAccount, bin(TimeGenerated, 5m)` | Detection |
| Lateral movement | SPL: `index=winevent EventCode=4648 \| stats dc(dest) as targets by src_user` | Hunting |
| C2 beaconing | SPL: `index=proxy \| bucket _time span=60s \| stats count by src_ip, dest, _time \| eventstats stdev(count) as jitter by src_ip, dest` | Hunting |
| DNS tunneling | KQL: `DnsEvents \| where strlen(Name) > 50 \| summarize count() by ClientIP` | Hunting |
| Process anomaly | SPL: `index=sysmon EventCode=1 \| rare ParentImage, Image limit=20` | Hunting |

## Workflow

### 1. Alert Triage Framework

```
TIER 1 — Initial Triage (5-10 min per alert):
├── Is this a known false positive? → Tune/close
├── Validate alert: Does the evidence match the description?
├── Enrich: User context, asset criticality, threat intel
├── Correlate: Other alerts from same source/user in last 24h?
├── Disposition: True Positive / False Positive / Benign True Positive
└── Escalate to T2 if: confirmed malicious, unclear scope, or high severity

TIER 2 — Investigation (30-60 min):
├── Full timeline reconstruction (SIEM + EDR + network)
├── Scope assessment: How many systems/users affected?
├── Root cause identification
├── Containment recommendation
└── Escalate to T3/IR if: active threat, data breach, or executive involvement

TIER 3 — Advanced Analysis:
├── Malware reverse engineering
├── Memory forensics
├── Advanced threat hunting
├── Detection engineering (new rules from findings)
└── Incident coordination
```

### 2. SIEM Query Library

**Splunk SPL:**
```spl
| --- Authentication Anomalies ---
| Impossible travel
index=auth action=success
| iplocation src_ip
| stats earliest(_time) as first, latest(_time) as last,
        values(City) as cities, dc(City) as city_count by user
| where city_count > 1
| eval time_diff_hours = (last - first) / 3600
| where time_diff_hours < 4

| --- Suspicious PowerShell ---
index=sysmon EventCode=1 Image="*powershell.exe"
| where match(CommandLine, "(?i)(encodedcommand|bypass|hidden|iex|downloadstring|invoke-expression)")
| table _time, Computer, User, CommandLine

| --- Data Exfiltration Indicators ---
index=proxy
| stats sum(bytes_out) as total_bytes by src_ip, dest
| where total_bytes > 104857600
| sort - total_bytes
| eval MB = round(total_bytes/1048576, 2)
```

**Elastic KQL:**
```
// Failed authentications spike
event.action:"authentication_failure" and event.outcome:"failure"
| stats count by source.ip, user.name

// Suspicious process creation
process.name:("cmd.exe" or "powershell.exe") and
process.parent.name:("winword.exe" or "excel.exe" or "outlook.exe")

// Persistence: new scheduled task
event.code:"4698" and winlog.event_data.TaskContent:*cmd* or *powershell*
```

### 3. SOAR Playbook Templates

```yaml
# Phishing Alert Playbook
name: Phishing Triage
trigger: alert.category == "phishing"
steps:
  - extract_iocs:
      type: enrichment
      inputs: [email_headers, urls, attachments]
      
  - check_sender_reputation:
      type: enrichment
      api: virustotal
      input: sender_domain
      
  - detonate_attachments:
      type: sandbox
      api: anyrun
      input: attachments
      timeout: 300
      
  - check_url_reputation:
      type: enrichment
      api: urlhaus
      input: extracted_urls
      
  - decision:
      if: any_ioc_malicious
      then: contain_and_escalate
      else: close_as_benign
      
  - contain_and_escalate:
      actions:
        - block_sender_domain
        - quarantine_similar_emails
        - disable_clicked_user_session
        - create_incident_ticket
        - notify_soc_lead
```

### 4. SOC Metrics

```
Operational Metrics:
├── MTTD (Mean Time to Detect): Target < 24 hours
├── MTTR (Mean Time to Respond): Target < 4 hours
├── MTTC (Mean Time to Contain): Target < 1 hour for critical
├── Alert Volume: Track trend, investigate spikes
├── False Positive Rate: Target < 30% per detection rule
├── Escalation Rate: T1→T2 should be 10-20%
└── Coverage: % of MITRE ATT&CK techniques with detections

Analyst Metrics (use carefully — avoid perverse incentives):
├── Alerts closed per shift (throughput)
├── Time per alert (efficiency)
├── Escalation accuracy (quality)
└── Detection rules authored (contribution)

Maturity Metrics (SOC-CMM):
├── Level 1: Initial — reactive, ad-hoc
├── Level 2: Managed — documented processes, basic detection
├── Level 3: Defined — threat hunting, detection engineering
├── Level 4: Quantitatively managed — metrics-driven, automation
└── Level 5: Optimizing — continuous improvement, threat intelligence integration
```

### 5. Threat Hunting Hypotheses

See `references/hunting-hypotheses.md` for hypothesis library.

```
Hypothesis framework:
1. Start with threat intelligence or MITRE ATT&CK technique
2. Form testable hypothesis: "Adversary X may be using T1053 for persistence"
3. Identify data sources: scheduled tasks logs, Sysmon EID 1, registry
4. Write hunt queries
5. Analyze results: confirm/deny hypothesis
6. Create detection rule if confirmed
7. Document and share findings

Example hypotheses:
├── "Attackers are using living-off-the-land binaries for execution"
│   Data: Sysmon EID 1, focus on LOLBins (certutil, mshta, regsvr32)
├── "C2 communication is hiding in DNS queries"
│   Data: DNS logs, look for high entropy domains, TXT record queries
├── "Lateral movement via WMI is occurring undetected"
│   Data: Sysmon EID 1 (wmiprvse.exe spawning processes), EID 4648
└── "Data staging is happening before exfiltration"
    Data: File creation events, large archive files, unusual compression tools
```

## Verification

- [ ] Alert triage SOP documented and trained
- [ ] SIEM queries cover top 20 MITRE ATT&CK techniques
- [ ] SOAR playbooks automate top 5 alert types
- [ ] SOC metrics dashboard active (MTTD, MTTR, FPR)
- [ ] Threat hunting program running weekly
- [ ] Shift handoff procedure documented
- [ ] Detection rule tuning process defined (FP reduction)
