The primary mission of the SOC is security monitoring and alerting. This includes the collection and analysis of data to identify suspicious activity and improve the organization’s security. Threat data is collected from firewalls, intrusion detection systems, intrusion prevention systems, security information and event management (SIEM) systems and threat intel. Alerts are sent out to SOC team members as soon as discrepancies, abnormal trends or other indicators of compromise are picked up.