Explain like I'm five · Security
What is a SOC?
The Security Operations Center, told as a story about a castle's guard room.
A castle has too many doors and windows.One person can't watch them all.
A SOC is the castle's guard room.Every door and window is on a screen. Someone is watching at night and on weekends too.
When a bell rings, they go look.Is it a burglar, or just a cat?
Watchkeep eyes on the screens
Sortthrow out the cats
Runif it's a burglar, lock the door
Notes from the watchtower go on the wall.The watchtower friend (CTI) says who's coming. The guard room sees who's here now.
Too many bells wear the guards out.A hundred cat alarms, and the real burglar walks right in.
In one breath
SOC = the guard room that watches every door day and night and runs when a bell rings.
Security Operations Center: people, screens and rules in one room. The hard part isn't spotting burglars — it's throwing out the cats fast.
When grown-ups say it
- SIEM
- The guard room's big screen. Collects news from every door and window into one place.
- Alert
- The bell. Something looks off. Could be a burglar, could be a cat.
- Triage
- Cat or burglar? Deciding which bells to look at first.
- False positive
- The cat. A bell that wasn't a burglar. → the footprint story
- Incident response
- Running to lock the door. What happens when it's real: stop, remove, repair.
- Tier 1 · Tier 2
- New guards and senior guards. Who looks first, and who takes the hard ones.
- Alert fatigue
- The hundredth cat. So many bells that the real one gets missed.
Next story
The Big Screen →