## 3 Background Knowledge
### Security Operation Center (SOC) in Enterprise Network  
Data breaches, malware infections, and cyberattacks commonly occur for large and small enterprises. Hundreds of new vulnerabilities threatening an enterprise's network environment are found every day. Defensive tools such as a firewall or an antivirus may not detect these threats. The longer unfixed threats result in more significant potential damage and expense to enterprises. Therefore, it becomes a daily priority for network security managers to detect and eradicate the threats before they cause any adverse effects.  
Many IT departments address the issue by establishing a separate security operations center (SOC) internally or through a third-party security service provider. An SOC is a facility within an enterprise responsible for continuously monitoring and analyzing an organization's security and improving the organization's security while stopping and reacting to cybersecurity incidents.  
SOC teams supervise and defend the organization's assets, including corporation property, confidential documents, and enterprise systems architecture. The SOC team is responsible for implementing the company's entire cybersecurity strategy and serving as a focal point for coordinated efforts to monitor, evaluate, and protect against cyberattacks.  
Figure 5: ELK architecture.  
Traditional security solutions such as passwords, Access Control Lists (ACLs), firewall rules, IDS rules, and others are becoming less practical. The enterprise network security team must always ensure that these tools work across all network devices to spot anomalous activity that may cause harm.  
The primary responsibilities of an SOC include the following [36]:  
* Prevention and detection: In cybersecurity, prevention is more effective than response. An SOC monitors the network to detect attacks rather than responding when they occur. As a result, the SOC team can see malicious activity and stop it before it causes any harm. When SOC analysts notice something unusual, they gather as much information as possible to conduct a more thorough investigation.
* Investigation: The SOC team analyzes anomaly activity at the investigation stage to establish the nature of the threat and the extent to which it has entered the infrastructure. The security analyst examines the network and activities of the company from the perspective of an attacker, looking for essential indicators and sections of weakness before they are exploited. By understanding how assaults escalate and successfully responding before they become uncontrollable, the analyst identifies and executes triage on various security problems. To achieve a successful defense, the SOC analyst combines the enterprise's network expertise with the most recent global threat intelligence, including specifics on attacker tools, techniques, and trends.
* Response: Following the investigation, the SOC team plans a reaction to address the issue. The SOC serves as the first responder as soon as an incident is confirmed, isolating endpoints, eliminating hazardous programs, stopping them from executing, removing them, and more.  
The SOC attempts to restore systems and retrieve any lost or compromised data in the aftermath of an event. The process may include wiping and restarting endpoints, changing systems, or, in the case of ransomware attacks, deploying viable backups to evade the ransomware. This phase, if successful, will restore the network's status before the attack.