Before you can walk the walk, you must talk the talk. Welcome to Part 1 of our SOC Monitoring series, where we decode the jargon, acronyms, and slang used by professional defenders.
Imagine walking into a hospital operating room. The doctors are shouting things like “BP is dropping!” or “Push 10cc of Epi!” If you don’t know what those words mean, you can’t help save the patient.
The Security Operations Center (SOC) is no different. It has its own language. When a crisis hits, clear communication is the difference between stopping a hack and losing data.
In this first installment of The Watchtower Chronicles, we are going to build your dictionary. But this isn’t a boring A-Z list. We are going to learn these terms by following the lifecycle of an attack.
Phase 1: The Signals (What are we looking at?)
In a SOC, data flows in constantly. You need to know the difference between a harmless noise and a gunshot.
1. Event
- Definition: Anything that happens on a system. It is neutral—neither good nor bad.
- Example: “User Bob logged in.” “File A was opened.”
- Analogy: Hearing a car drive past your house.
2. Alert
- Definition: An event (or series of events) that triggers a warning because it looks suspicious.
- Example: “User Bob logged in at 3 AM from Russia.”
- Analogy: Hearing a car screech its tires and stop in front of your house.
3. Incident
- Definition: A confirmed security breach or attack. An alert becomes an incident when a human verifies it is bad.
- Example: “We confirmed Bob’s account was hacked and is downloading database files.”
- Analogy: Seeing someone break your window and jump inside.
4. False Positive
- Definition: An alert that looked bad but turned out to be harmless. The bane of an Analyst’s existence.
- Example: An alert triggers for “Malware Download,” but it turns out the user was just downloading a new video game installer that looked weird.
Phase 2: The Evidence (What did we find?)
Once we have an Incident, we start looking for clues. These clues have specific names.
5. IOC (Indicator of Compromise)
- Definition: A piece of forensic evidence that proves a known attack happened. It is static and precise.
- Example: A specific bad IP address (
192.168.1.50), a Virus Hash (MD5: e5d2...), or a malicious domain name (evil-site.com). - Analogy: Finding a fingerprint or a specific drop of blood at a crime scene.
6. IOA (Indicator of Attack)
- Definition: Evidence that an attack is currently happening or about to happen. It focuses on the intent rather than the specific tool.
- Example: “A persistence registry key was created” or “Powershell is running a hidden command.”
- Analogy: Seeing the door handle jiggle.
7. TTPs (Tactics, Techniques, and Procedures)
- Definition: The behavioral patterns of the hacker. Not what tool they used (IOC), but how they work.
- Example: “This hacker group (APT28) always sends phishing emails on Fridays and uses a specific PowerShell script to steal passwords.”
- Analogy: Knowing that a specific burglar always enters through the chimney and steals only silverware.
Phase 3: The Tools (What are we using?)
You can’t do the job without the gear.
8. SIEM (Security Information and Event Management)
- Pronounced: “Sim”
- Definition: The “Brain” of the SOC. It collects logs from everywhere (firewalls, servers, laptops), correlates them, and generates alerts.
- Example Tools: Splunk, Microsoft Sentinel, Wazuh, Elastic.
9. EDR (Endpoint Detection and Response)
- Definition: Advanced antivirus on steroids. It records exactly what happens on a laptop (process creation, network connections) and allows you to remotely kill viruses.
- Example Tools: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne.
10. SOAR (Security Orchestration, Automation, and Response)
- Pronounced: “Soar”
- Definition: The robots. Software that automates boring tasks.
- Example: If a phishing email is detected, the SOAR tool automatically blocks the sender and deletes the email from all inboxes without a human lifting a finger.
Phase 4: The Scorecard (How well are we doing?)
Finally, managers need to measure success. These are the metrics we discussed earlier.
11. Dwell Time
- Definition: The time a hacker sits inside your network undetected.
- Goal: Reduce from Months $\rightarrow$ Hours.
12. MTTD (Mean Time to Detect)
- Definition: How fast does your alarm ring? The average time it takes to spot an active threat.
13. MTTR (Mean Time to Respond/Remediate)
- Definition: How fast do you put out the fire? The average time to kick the hacker out after finding them.
Conclusion
This vocabulary is your toolkit.
When you read a job description, an incident report, or the rest of this article series, these terms will appear constantly.
Now that we speak the language, we are ready to enter the control room.
In Part 2, we will look at “The Eyes of the Beast”—learning how to set up the Logs and Visibility needed to catch a hacker in the act.
Disclaimer
This article is for educational purposes only. Definitions in the cybersecurity industry can vary slightly between organizations and vendors. These definitions represent the generally accepted industry standard.
Secure Scroll 
Leave a comment