The maturity of a Security Operations Center (SOC) is often associated with the incorporation of new tools, the volume of alerts processed, or the degree of automation achieved. However, a mature SOC is not defined by the technology it uses, but by how it organizes its processes to detect, analyze, and respond to threats.

In this context, the SOC Critical Path (SCP) model emerges, described in the article "SOC Critical Path: A Defensive Kill Chain Model" (IEEE, 2022). This model structures the operation of a SOC as a continuous chain of activities. The goal is not to add new tools, but to ensure that each of the necessary phases for managing an incident works in a coordinated manner and that none becomes a bottleneck.

This approach raises a simple but relevant question for any SOC manager: Is our detection and response process truly balanced, or are there phases that limit the overall effectiveness?

The 6 Phases of an Effective SOC

The Critical Path SOC model organizes the work of a SOC into six stages that form a continuous cycle.

1. Gathering
It all begins with obtaining information from the various available sources: systems, network, identities, cloud services, or security tools. If visibility is incomplete, any subsequent analysis will start from a limited basis.

2. Processing
Collected events must be normalized, correlated, and enriched to transform large volumes of information into data useful for detection.

3. Detection
In this phase, behaviors that may correspond to a threat are identified. Effectiveness depends not only on the number of rules or alerts generated, but also on the ability to detect truly relevant activities.

4. Analysis
Once a potential threat has been detected, the analyst needs sufficient context to determine if it is a real incident, assess its impact, and decide on the most appropriate response.

5. Response
Containment, mitigation, and recovery actions must be executed quickly, in a coordinated manner, and, whenever possible, supported by predefined procedures.

6. Continuous Improvement
Each incident represents an opportunity to strengthen the SOC. Incorporating new rules, updating procedures, or improving use cases allows acquired knowledge to translate into greater detection and response capabilities.

Far from being independent phases, they all form part of a continuous process. A weakness in any of these steps affects overall performance, so improvement must be addressed holistically.

A first self-assessment exercise

Beyond understanding the model, it's useful to ask ourselves how our own SOC stands with respect to each of these phases.

These questions can serve as a starting point:

Collection

  • Do we have visibility into all of the organization's critical assets?
  • Are there any information sources that are not yet being monitored?

Processing

  • Are events normalized and enriched to facilitate analysis?
  • Is redundant or unhelpful data removed before generating detections?

Detection

  • Do detection rules respond to real threats or have they accumulated over time?
  • How often is the effectiveness of detections reviewed?

Analysis

  • Do analysts have sufficient context to investigate an alert? without constantly resorting to other tools?
  • Is more time spent gathering information than analyzing the incident?

Answer

  • Are there documented procedures for the most common incidents?
  • What part of the response is automated and what part still depends on manual actions?

Continuous Improvement

  • Does each incident generate any learning that is incorporated into the SOC's operations?
  • If an incident similar to the one that occurred six months ago were to happen today, would it be detected and managed more quickly and effectively?

It is not necessary to answer yes to all questions. The objective of this exercise is to identify which phases have the greatest room for improvement and prioritize the actions that will have the greatest impact on the overall effectiveness of the SOC.