## 2 Background  
### Security Operations Center  
Security Operations Centers (SOCs) play a crucial role in protecting information systems. Their main mission is to continuously monitor security activities, detect potential threats, analyze incidents, and classify them in terms of severity and impact. The SOC team is responsible for taking appropriate measures to respond to confirmed security incidents and minimize their duration and impact on the organization's daily operations. In addition to monitoring and detecting threats, the SOC also assumes significant operational responsibilities. This can include managing security devices, such as hardening operating systems to enhance their security, managing access rights to resources, as well as managing patches and security updates. In close collaboration with IT services, the SOC aims to reduce the duration and impact of security incidents that exploit, disrupt, prevent, degrade, or destroy systems dedicated to usual and standard operations. This objective is achieved through effective monitoring and end-to-end incident tracking [1]. It is common for individuals to mistakenly equate SOCs with Security Information and Event Management (SIEM), which is primarily concerned with the management and correlation of logs collected from various sources, offering real-time oversight of an organization's information security systems [12]. The main mission of SOCs is to ensure the security and integrity of data by identifying any suspicious activities, abnormal behaviors, or attempted breaches within the organization's IT infrastructure. To accomplish this, SOC teams utilize a combination of advanced technologies, well-defined processes, and deep security expertise to analyze events and alerts, assess potential threats, and take appropriate corrective actions. Figure 1 shows an example of a SOC component. The Security Operations Center (SOC) is underpinned by three fundamental components:  
* **People:** Cybersecurity experts form a critical element of the SOC structure. Their responsibilities encompass the monitoring, detection, and rigorous analysis of security events, ensuring that potential threats are identified and mitigated promptly [2]. * **Processes:** The processes are clearly defined and documented steps that guide the operations of the SOC. They include managing security incidents, detecting and analyzing threats, responding to incidents, remediation, and recovery after an incident. These processes ensure a methodical and consistent approach to managing security events. They are designed  
Figure 1: Security Operations Center component. to optimize the SOC's effectiveness and responsiveness to threats. Examples of critical processes within a SOC include the cyber incident management playbook; procedures for incident response; operational guidelines or knowledge articles; processes for managing personnel changes, such as new hires, transfers, and departures; policies for SOC access control; and standard security operational procedures [13]. * **Technology:** To effectively monitor and analyze security events, the SOC employs an array of advanced tools and technologies. Central to these is the Security Information and Event Management (SIEM) system, which integrates capabilities to collect, aggregate, and correlate security data from diverse sources, providing a comprehensive and coherent security landscape, as shown in Figure 2. This technological infrastructure is crucial in enabling real-time insights and fostering a proactive security posture within the organization [14]. The SOC service can be an inside entity or outsourced to focus on the main activity and avoid the heavy lifting and shifting and skilled resources to manage and monitor the security. Hence, the supplier organization is far better at running and maintaining a SOC service. In contrast, the client organization becomes responsible for security incident management, escalation, and decision-making as the overarching risk owner. Most client organizations work from 9 a.m. to 5 p.m.