A Security Operations Center’s overarching strategy revolves around threat management, which includes collecting and analyzing suspicious activity data to make the entire organization more secure. Raw data collected by SOC teams is security-relevant and comes from firewalls, threat intelligence, and other sources. Alerts are generated to notify team members immediately if any data is abnormal or shows signs of compromise (IOCs).