It's easy to think that the more data a SOC receives, the greater its ability to detect threats. However, the reality is often quite the opposite. As the volume of events increases, so does the noise and the time required to find what truly matters.

For this reason, the SOC Critical Path (SCP) model positions information processing as a phase independent of collection. Before generating a detection, events must be transformed into useful information for analysts.

In other words, it's not enough to collect data; it must be prepared so that it can become effective detections.

The problem is usually not a lack of information

Many SOCs receive events from firewalls, EDR, authentication systems, network devices, applications, or cloud services. The problem is that this information arrives in different formats, with varying levels of detail, and sometimes with such a volume of data that it's difficult to find what truly deserves attention.

When this happens, analysts dedicate a significant portion of their time to tasks that add little value, such as searching for context in multiple tools, interpreting different formats, or reviewing duplicate events before even beginning the investigation.

Five questions to review event processing

Rather than asking whether enough events are being received, it can be helpful to analyze whether that information is prepared to facilitate detection.

1. Do events from different technologies use a homogeneous structure that facilitates their analysis?

• When each tool presents information differently, correlation and investigation become more complex.

2. Do the events incorporate the necessary context for the analyst to interpret them quickly?

• Having information about the affected asset, the user involved, or the level of criticality can significantly reduce analysis times.

3. Is there a high volume of duplicate events or events with little operational value?

• More information doesn't always mean better results. Sometimes, it only increases the noise.

4. Does data quality facilitate building effective detection rules?

• Detection is only as good as the information it's based on.

5. Do analysts spend more time preparing information than investigating the incident?

• If the answer is yes, there is probably room for improvement in this phase of the process.

What actions can make a difference?

Not all improvements require incorporating new tools. In many cases, reviewing how available information is processed has a much greater impact than increasing the volume of collected events.

Some actions that can bring improvements are:

• Periodically review which sources generate truly useful information for detection.
• Homogenize the structure of events from different technologies.
• Incorporate processes that provide context before the information reaches the analyst.
• Reduce the presence of duplicate or irrelevant events that increase noise.
• Periodically verify that the available information allows for building reliable detections and facilitates subsequent investigation.

The quality of a detection begins long before a rule generates an alert. It depends, to a large extent, on the information arriving at the SOC ready to be interpreted.