<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-soc-tooling-integration
description: >-
  Integrate and configure SOC tools (SIEM, SOAR, EDR, threat intel) for unified security operations workflows.
domain: cybersecurity
subdomain: soc-operations
tags:
  - soc-integration
  - siem
  - soar
  - edr
  - threat-intel
  - api-integration
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  nist-csf: ["DE.AE-1", "DE.CM-1", "RS.CO-1"]
---

# Implementing SOC Tooling Integration

## Overview

A well-integrated SOC toolchain eliminates manual data pivoting between systems, reduces MTTD through automated correlation, and enables consistent enrichment and response at scale. Integration is never one-size-fits-all — the goal is reducing analyst friction at the highest-volume decision points.

Mode: `[MODE: BLUE]` — Defensive operations enablement.

## Integration Architecture

| Layer | Components | Integration Pattern |
|---|---|---|
| Collection | EDR, network sensors, cloud logs, endpoint agents | Syslog/API push to SIEM |
| Normalization | SIEM log pipeline, OCSF schema mapping | Field extraction, ECS/OCSF alignment |
| Detection | SIEM correlation rules, UEBA, ML models | Alert to SOAR via webhook |
| Enrichment | Threat intel (MISP, TI feeds), asset DB, identity | SOAR playbook lookup |
| Response | EDR isolation, firewall block, identity suspend | SOAR → API action |
| Case management | Ticketing (Jira, ServiceNow), IR platform | Bidirectional sync |

## Integration Patterns

| Pattern | Use Case | Tooling |
|---|---|---|
| Syslog/CEF | Legacy systems, network appliances | rsyslog, nxlog, Vector |
| API polling | Cloud services without native push | Lambda/Function cron, Airbyte |
| Webhook push | SOAR/SIEM native integrations | SIEM alert → SOAR trigger |
| Kafka/Kinesis | High-volume streaming | Confluent, AWS Kinesis |
| OpenTelemetry | Modern cloud-native | OTEL collector → backend |

## SIEM Onboarding Checklist

- [ ] Log source identified and data classification confirmed
- [ ] Transport configured (syslog, API, agent)
- [ ] Field normalization complete — key fields mapped (src_ip, user, action, outcome)
- [ ] Baseline volume measured (EPS) and license impact assessed
- [ ] Parsing tested against 100 real events
- [ ] At least one detection rule referencing new source
- [ ] Retention policy set per data classification

## SOAR Playbook Integration Points

| Trigger | Enrichment Steps | Response Actions |
|---|---|---|
| Phishing alert | VirusTotal URL/hash, WHOIS, MX/SPF check | Block sender, sandbox attachment, notify user |
| Endpoint malware | Hash lookup, process tree, parent-child chain | Isolate host, collect forensic artifact |
| Impossible travel | Auth log correlation, user's normal geo baseline | Challenge MFA, suspend if confirmed |
| Privilege escalation | Asset owner lookup, change window check | Alert owner, freeze account if unauthorized |
| Data exfil (DLP) | Classify data, check user last access pattern | Block outbound, notify DLP owner |

## Monitoring the Integration Stack

| Signal | What to Watch | Alert Threshold |
|---|---|---|
| Log source EPS | Drop to zero = source outage | 0 events for 5 min on critical source |
| SIEM parse error rate | Parsing failures indicate schema drift | >1% error rate on any source |
| SOAR playbook failure | Integration timeout or API error | Any failure on P1/P2 playbooks |
| Alert age | Old open alerts = analyst backlog | >50% alerts >4h old |
| Enrichment cache miss | TI feed stale or unreachable | >20% cache miss rate |

## Workflow

1. Inventory current tools and document existing integrations
2. Identify highest-friction manual pivot steps analysts perform daily
3. Prioritize integrations by alert volume × analyst time saved
4. Stand up API integration in test SIEM/SOAR environment
5. Validate field normalization with real event samples
6. Instrument the integration with health metrics
7. Run in shadow mode for 1 week — compare enriched vs manual results
8. Promote to production with documented rollback procedure

## Related Techniques

- [Implementing SIEM Alert Triage](../performing-alert-triage/SKILL.md)
- [Building SOAR Playbooks](../building-soc-playbooks/SKILL.md)
