Security Operations Center Architecture

A mature SOC is not just an alert queue and a SIEM — it is a data engineering platform, a detection-as-code CI/CD pipeline, a response orchestration layer, and a threat intelligence fusion cell. Detection engineers sit at the intersection of all of these, responsible for translating adversary tradecraft into rules, validating coverage, and reducing analyst toil through automation.

SOC Tiers and Detection Engineering Role

Data Pipeline — What Gets Logged and Why

SIEM Tuning — Alert Quality Over Volume

-- KQL example: tuning a noisy rule by scoping with context and baselined exceptions
-- BAD (generates 4000 alerts/day): "any PowerShell with -enc"
DeviceProcessEvents
| where ProcessCommandLine has "-enc"

-- BETTER: encoded command from non-whitelisted parent, pointing to rare hosts
let management_hosts = dynamic(["SCCM-SRV01","PATCHING-SRV02"]);
DeviceProcessEvents
| where ProcessCommandLine has "-enc"
| where InitiatingProcessFileName !in~ (
    "svchost.exe", "services.exe", "WmiPrvSE.exe"
  )
| where not (DeviceName has_any (management_hosts))
| extend b64 = extract(@"-[eE][nN][cC][oO]?\s+([A-Za-z0-9+/=]+)", 1, ProcessCommandLine)
| extend decoded = base64_decode_tostring(b64)
| where decoded has_any ("IEX","Invoke-Expression","DownloadString","WebClient","bypass")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName,
          ProcessCommandLine, decoded

-- Alert deduplication: suppress repeated identical alert on same host within 1 hour
-- (implement via SOAR dedup logic or SIEM lookup table keyed on host+rule_id+hour bucket)

SOAR Playbook — Automated Alert Enrichment

# SOAR pseudo-playbook: IP IOC triage (runs on every network-based alert)

def ip_triage_playbook(alert):
    ip = alert['remote_ip']

    # Step 1: Threat intel lookup (VirusTotal, Shodan, AbuseIPDB)
    vt = vt_lookup(ip)
    abuse = abuseipdb_lookup(ip)
    shodan = shodan_lookup(ip)

    # Step 2: Internal context
    asset_info   = cmdb_lookup(alert['hostname'])
    user_history = get_user_login_history(alert['user'], days=30)
    similar_alerts = siem_count_similar(ip=ip, hours=24)

    # Step 3: Scoring
    score = 0
    if vt['malicious'] > 3:   score += 40
    if abuse['confidence'] > 80: score += 30
    if shodan['org'] in BULLETPROOF_HOSTERS: score += 20
    if asset_info['is_privileged']: score += 10

    # Step 4: Auto-triage decision
    if score >= 70:
        create_p1_incident(alert, enrichment={'vt': vt, 'abuse': abuse})
        block_ip_on_firewall(ip)  # automated containment
        notify_oncall()
    elif score >= 40:
        create_p2_ticket(alert, enrichment={...})
    else:
        auto_close(alert, reason="low-score after enrichment")

SOC Metrics — What to Measure

Detection Engineering

title: SOAR Enrichment Bypass — Direct Alert Close Without Investigation
description: >
  Detects when a SOAR playbook closes a high-severity alert without creating
  a ticket — may indicate playbook logic error or manipulation.
logsource:
  product: soar
  service: audit
detection:
  selection:
    action: 'close_alert'
    original_severity: 'high'
    ticket_created: false
  condition: selection
level: high

-- MDE KQL: ATT&CK coverage gap identification — technique with no recent alerts
-- (conceptual: join your rule catalog against alert fire history to find dark areas)
let rule_catalog = datatable(technique_id:string, rule_name:string)[
    "T1003.001", "LSASS Memory Access",
    "T1055.001",  "DLL Injection",
    "T1071.001",  "HTTP C2 Beaconing",
    "T1021.002",  "SMB Lateral Movement"
];
let fired_last_30d = AlertInfo
| where Timestamp > ago(30d)
| summarize last_fired=max(Timestamp) by AttackTechniques
| mv-expand AttackTechniques to typeof(string);
rule_catalog
| join kind=leftouter fired_last_30d on $left.technique_id == $right.AttackTechniques
| where isnull(last_fired) or last_fired < ago(14d)
| project technique_id, rule_name, last_fired
| order by last_fired asc

Q&A