One of the most frequently used metrics to evaluate the activity of a SOC is the number of alerts handled. However, does this mean that the SOC is detecting threats better?

The answer is not always yes. A high volume of alerts can reflect good monitoring capabilities, but it can also be the result of imprecise rules, insufficiently contextualized information, or a high false positive rate. In these cases, the main challenge shifts from detecting more to detecting better.

The SOC Critical Path (SCP) model positions detection as a phase whose objective is not to generate more alerts, but to identify those activities that truly require investigation.

When alerts cease to be useful

In a mature SOC, the effectiveness of detection is not measured solely by the number of alerts generated, but by its ability to identify real threats while minimizing operational noise.

This raises an important question: Do the alerts received by the SOC help detect an attack or simply generate more work for analysts? Answering this question can help identify opportunities for improvement.

Some issues to review

• What percentage of alerts end up being discarded as false positives?
• Are there rules that barely generate relevant incidents, but remain active?
• Are detections reviewed periodically or do they simply accumulate over time?
• Do newly detected threats lead to new use cases or are only existing rules still being used?
• Do alerts provide enough context to facilitate investigation?

If several of these questions raise doubts, the problem is probably not the monitoring capacity, but the detection model itself.

Beyond IOCs

Traditionally, much of the detection has relied on Indicators of Compromise (IOCs), such as malicious IP addresses, domains, URLs, or file hashes. This approach remains useful and continues to play an important role in detecting known threats.

However, numerous studies agree that relying exclusively on IOCs has significant limitations. These indicators can change rapidly or become obsolete quickly, requiring constant updates.

For this reason, more and more SOCs are complementing this approach with detections based on Tactics, Techniques, and Procedures (TTPs), that is, on how attackers act rather than on the specific indicators they use in each campaign.

This shift allows for the detection of behaviors that remain relatively stable, even if IP addresses, domains, or the tools used during the attack change.

It's not about replacing one model with another, but about combining them to achieve more robust coverage adapted to increasingly sophisticated threats.

Three actions to improve detection capabilities

Evolving the detection model does not necessarily imply incorporating new technologies. In many cases, small, periodic reviews can significantly improve the effectiveness of a SOC.

Some actions that can add value are:

• Periodically review detection rules to identify those that generate a high volume of false positives or have become obsolete.
• Supplement detections based on Indicators of Compromise (IOCs) with use cases focused on the behaviors and techniques employed by attackers.
• Measure the effectiveness of detections not by the number of alerts generated, but by their ability to identify real incidents and facilitate the work of analysts.

Detection is one of the most visible aspects of a SOC's work, but also one that requires the most constant review. It is important to maintain effective rules, incorporate new knowledge about threats, and periodically evaluate the results obtained so that the SOC evolves at the same pace as the attackers.