← soc analyst
Take Quiz →
SOC Operating Model & Triage Workflow
beginner 3h
Understand how a SOC functions as a system, master the 7-step triage workflow, and develop the cognitive hygiene needed to sustain accuracy on a high-volume alert queue.
After this module you will
- › Explain the tiered and tierless SOC models and the 6 SOC functions
- › Define MTTD and MTTR and explain how they drive SOC design
- › Execute the 7-step triage workflow against a simulated alert queue
- › Apply structured analytic techniques (ACH, devil's advocate) to resist cognitive bias
- › Produce a disposition record that meets quality criteria
Lessons
1 The SOC as a System — Tiers, Functions, and Metrics
25 min 2 The Alert Lifecycle — From Sensor to Close
20 min 3 The 7-Step Triage Workflow
25 min 4 Cognitive Hygiene — Bias, Fatigue, and Structured Analysis
25 min 5 Worked Example — Full Triage of a Real-Looking Alert
25 min Module Quiz
Test your knowledge before moving on.