A SOC analyst's day and playbooks

What a SOC is

A security operations centre (SOC) is a team, with tools and processes, that monitors an organisation for attacks and responds to them, often 24 hours a day in shifts. Some companies run their own SOC; many use a managed security service provider (MSSP). India has many SOCs serving both Indian and international clients, which is why "SOC analyst" is a common first security job.

The tiers

A typical L1 shift

1. Handover: read the previous shift's notes: open incidents, anything to watch.
2. Check that the tools are healthy: are logs still arriving from all sources? A silent log source can hide an attack.
3. Work the alert queue by severity, following playbooks, writing a note for each.
4. Escalate true positives to L2 with evidence; call the on-call lead for critical ones.
5. Handle user reports, like "I clicked a link".
6. End of shift: write a handover note for the next shift.

Playbooks

A playbook (or runbook) is a written, step-by-step procedure for a type of alert or incident. It makes responses fast and consistent, helps new analysts, and records who may approve which action. Here is a simple phishing playbook:

1. Get the reported email as an attachment (with full headers), not a forward.
2. Check headers: the real sender, the Return-Path, and the SPF, DKIM and DMARC results in Authentication-Results.
3. Extract links and attachments. Check domains and file hashes against threat intelligence, and look at links in a safe sandbox, never on your own laptop.
4. Search the mail logs: who else received it? Did anyone click or reply?
5. Contain: remove the email from all mailboxes, block the sender domain and URLs.
6. If someone entered a password: reset it, revoke sessions, check for new MFA devices or mail forwarding rules.
7. Close with a note and thank the reporter.

Authentication-Results: mx.company.example;
  spf=fail (sender IP 198.51.100.40 not permitted) smtp.mailfrom=bank-alerts.example;
  dkim=none;
  dmarc=fail (p=reject) header.from=mybank.example

Automation: SOAR

SOAR (security orchestration, automation and response) tools run playbook steps automatically: pulling headers, checking hashes and domains, searching mailboxes. Analysts then spend their time on judgement, not copy-paste. Python skills help here.

Metrics

• MTTD (mean time to detect): how long, on average, before an attack is noticed.
• MTTR (mean time to respond or recover): how long, on average, to contain or fix it.
• False positive rate per rule: shows which detections need tuning.

Common mistakes

• Opening suspicious links or attachments on your own work laptop "to check". Use a sandbox.
• Skipping the handover note.
• Not noticing that a log source has gone silent.
• Following a playbook blindly when the facts do not fit. Escalate and ask.