In any Security Operations Center (SOC), the ability to detect a threat depends directly on the information it receives. No detection rule, algorithm, or analyst can identify what is not being monitored.

For this reason, the SOC Critical Path (SCP) model, proposed in the article "SOC Critical Path: A Defensive Kill Chain Model" (IEEE, 2022), positions data collection as the first phase of the detection and response process. Before analyzing, detecting, or responding, it is essential to have the most complete view possible of the assets and activity occurring within the organization.

However, having more sources of information does not always imply better visibility. The question is not how much data is collected, but whether it allows a SOC to answer the questions it needs to ask when investigating a potential threat.

How to Evaluate SOC Monitoring Coverage

A simple way to evaluate this phase is to analyze whether the SOC receives information from all areas that may be relevant for detecting an incident.

These questions can serve as a starting point:

Assets

  • Do we have an up-to-date inventory of the assets that should be monitored?
  • Are there any critical systems or services that are not yet generating events for the SOC?

Endpoints

  • Is information received from the user equipment and servers?
  • Does coverage extend to both corporate systems and those with critical functions?

Network

  • Do we have visibility into communications occurring inside and outside the organization?
  • Are there network segments with limited monitoring?

Identity

  • Can we detect anomalous activity related to users or credentials?
  • Is authentication information integrated into the detection processes?

Cloud Services

  • Do cloud environments generate events with the same level of detail as traditional infrastructure?
  • Is there visibility into the activities performed in these services?

Failure to comply with any of these requirements does not necessarily imply that there is a problem, but it may indicate that certain threats will be more difficult to detect.

The importance of detecting shortcomings before they become blind spots

Blind spots usually appear gradually. A new application, a service deployed urgently, or an infrastructure change can fall outside the scope of the SOC without anyone being fully aware of it.

For this reason, periodically reviewing available information sources is as important as incorporating new detection capabilities.

Some actions that can help identify potential gaps are:

  • Review periodically which assets are part of the SOC's scope and which remain outside of monitoring.
  • Compare available event sources with the organization's current architecture to detect potential gaps.
  • Verify that newly incorporated platforms or services generate useful information for the SOC from the moment they are put into production.
  • Evaluate not only the quantity of events received, but also their quality and usefulness during investigations.
  • Review periodically whether the available information allows for reconstructing an incident from beginning to end, or if there are phases where information is missing. context.

Data collection is the starting point of the entire detection cycle. Insufficient coverage can limit the effectiveness of the remaining phases, while a well-planned data collection strategy provides analysts with the information needed to investigate more quickly and make more effective decisions.