| CARVIEW |
Select Language
HTTP/2 200
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=3600
content-encoding: gzip
content-security-policy: default-src 'none'; style-src 'self' 'unsafe-inline' https:; img-src 'self' https: data:; font-src 'self'; script-src 'nonce-uAtExaJyw42TZgO87waShA' 'strict-dynamic' 'self' 'unsafe-eval'; form-action 'self'; media-src 'self' *.first.org; connect-src 'self' *.first.org; object-src 'none'; frame-src https:; frame-ancestors 'self'; base-uri 'self'
last-modified: Mon, 23 Jun 2025 03:58:12 GMT
referrer-policy: same-origin
server: nginx
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
accept-ranges: bytes
age: 0
date: Mon, 06 Oct 2025 01:50:30 GMT
via: 1.1 varnish
x-served-by: cache-bom-vanm7210071-BOM
x-cache: MISS
x-cache-hits: 0
x-timer: S1759715429.211759,VS0,VE1174
vary: accept-encoding, Accept-Encoding
strict-transport-security: max-age=31557600
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 7355
Security Operations Center SIG
- About FIRST
- Mission Statement
- Strategy Framework
- History
- Sustainable Development Goals
- Organization
- FIRST Policies
- Anti-Corruption Policy
- Antitrust Policy
- Bylaws
- Board duties
- Bug Bounty Program
- Code of Conduct
- Conflict of Interest Policy
- Document Record Retention and Destruction Policy
- FIRST Press Policy
- General Event Registration Refund Policy
- Guidelines for Site Selection for all FIRST events
- Identity & Logo Usage
- Mailing List Policy
- Media Policy
- Privacy Policy
- Registration Terms & Conditions
- Services Terms of Use
- Standards Policy
- Statement on Diversity & Inclusion
- Translation Policy
- Travel Policy
- Uniform IPR Policy
- Whistleblower Protection Policy
- Partnerships
- Newsroom
- Procurement
- Jobs
- Contact
- Membership
- Initiatives
- Special Interest Groups (SIGs)
- SIGs Framework
- Academic Security SIG
- AI Security SIG
- Automation SIG
- Cybersecurity Communications SIG
- Common Vulnerability Scoring System (CVSS-SIG)
- CSIRT Framework Development SIG
- Cyber Insurance SIG
- Cyber Threat Intelligence SIG
- Curriculum
- Introduction
- Introduction to CTI as a General topic
- Methods and Methodology
- Priority Intelligence Requirement (PIR)
- Source Evaluation and Information Reliability
- Machine and Human Analysis Techniques (and Intelligence Cycle)
- Threat Modelling
- Training
- Standards
- Glossary
- Communicating Uncertainties in CTI Reporting
- Webinars and Online Training
- Building a CTI program and team
- Curriculum
- Detection Engineering & Threat Hunting SIG
- Digital Safety SIG
- DNS Abuse SIG
- Stakeholder Advice
- Detection
- Cache Poisoning
- Creation of Malicious Subdomains Under Dynamic DNS Providers
- DGA Domains
- DNS As a Vector for DoS
- DNS Beacons - C2 Communication
- DNS Rebinding
- DNS Server Compromise
- DNS Tunneling
- DoS Against the DNS
- Domain Name Compromise
- Dynamic DNS (as obfuscation technique)
- Fast Flux (as obfuscation technique)
- Infiltration and exfiltration via the DNS
- Lame Delegations
- Local Resolver Hijacking
- Malicious registration of (effective) second level domains
- On-path DNS Attack
- Stub Resolver Hijacking
- Detection
- Code of Conduct & Other Policies
- Examples of DNS Abuse
- Stakeholder Advice
- Ethics SIG
- Exploit Prediction Scoring System (EPSS)
- FIRST Multi-Stakeholder Ransomware SIG
- Human Factors in Security SIG
- Industrial Control Systems SIG (ICS-SIG)
- Information Exchange Policy SIG (IEP-SIG)
- Information Sharing SIG
- Law Enforcement SIG
- Malware Analysis SIG
- Metrics SIG
- NETSEC SIG
- Public Policy SIG
- PSIRT SIG
- Red Team SIG
- Security Lounge SIG
- Security Operations Center SIG
- Threat Intel Coalition SIG
- Traffic Light Protocol (TLP-SIG)
- Transportation and Mobility SIG
- Vulnerability Coordination
- Vulnerability Reporting and Data eXchange SIG (VRDX-SIG)
- Women of FIRST
- CCB Initiatives
- FIRST CORE
- Internet Governance
- IR Database
- Fellowship Program
- Mentorship Program
- IR Hall of Fame
- Victim Notification
- Volunteers at FIRST
- Previous Activities
- Special Interest Groups (SIGs)
- Standards & Publications
- Events
- Education
- Blog
Security Operations Center (SOC) SIG
Mission
Security operations centers encounter a variety of challenges, yet there is not a framework or guideline that focuses on the challenges unique to SOCs. SOC challenges can stem from disparities between people’s skills and knowledge, inadequately developed processes, and misunderstood or lack of technology resources. SOC teams are inundated with data which can make it difficult to discover or decide on adequate toolsets to help reduce the over consumption of data and extract greater value from the tools in place. Left unaddressed, these challenges can lead to the SOC team being slower to detect and respond to potential incidents, getting distracted with false positive or negative alerts, and being subject to analyst over exposure and alert fatigue.
In the FIRST community, there is a heavy focus on CSIRT/PSIRT frameworks and issues that include some mention of SOC-related concerns. While there is no one, right way to configure the delineation between SOC and CSIRT services, it would help to have SOC-specific collateral and or models for addressing the challenges SOC teams face.
The mission of the Security Operations Center SIG is to help synthesize existing materials and create new collateral for an easier to access focus area within FIRST for SOC-specific challenges and recommendations.
Goals & Deliverables
Goals:
- Identify members within the FIRST community willing to contribute to this SIG.
- Gather and evaluate existing SOC-specific materials from prior FIRST conferences related specifically to SOC development, challenges, and models that would be useful to include in collateral material produced by this SIG.
- Agree upon type and scale of collateral materials that the SIG should focus on and assign lead developers and sub-team members for each type to support the agreed upon deliverables.
Deliverables:
- Creation of a Common SOC Challenges collateral to help teams recognize their potential issues in a currently operating SOC or to help in the planning phases of SOC team creation.
- Creation of overview collateral focused on SOCs and CSIRTs models and how these functions work collectively and where it is common to see distinctions in services offered.
- Creation of a SOC Framework or Ontology that compliments the existing CSIRT/PSIRT Services Frameworks. For the first year’s effort, the goals would be to draft this documentation for wider review within the FIRST community.
Chair
- Angel Hueca, CERT/CC
Meetings
- At the Annual Conference (in person)
- Monthly (virtually)
Mailing list
Any FIRST member may join, others are welcome as well, requests must be approved by the SIG chairs.
- soc-sig@first.org (subscribers only; please complete the Request to Join form below)
- Initiatives
- Special Interest Groups (SIGs)
- SIGs Framework
- Academic Security SIG
- AI Security SIG
- Automation SIG
- Cybersecurity Communications SIG
- Common Vulnerability Scoring System (CVSS-SIG)
- CSIRT Framework Development SIG
- Cyber Insurance SIG
- Cyber Threat Intelligence SIG
- Curriculum
- Introduction
- Introduction to CTI as a General topic
- Methods and Methodology
- Priority Intelligence Requirement (PIR)
- Source Evaluation and Information Reliability
- Machine and Human Analysis Techniques (and Intelligence Cycle)
- Threat Modelling
- Training
- Standards
- Glossary
- Communicating Uncertainties in CTI Reporting
- Webinars and Online Training
- Building a CTI program and team
- Curriculum
- Detection Engineering & Threat Hunting SIG
- Digital Safety SIG
- DNS Abuse SIG
- Stakeholder Advice
- Detection
- Cache Poisoning
- Creation of Malicious Subdomains Under Dynamic DNS Providers
- DGA Domains
- DNS As a Vector for DoS
- DNS Beacons - C2 Communication
- DNS Rebinding
- DNS Server Compromise
- DNS Tunneling
- DoS Against the DNS
- Domain Name Compromise
- Dynamic DNS (as obfuscation technique)
- Fast Flux (as obfuscation technique)
- Infiltration and exfiltration via the DNS
- Lame Delegations
- Local Resolver Hijacking
- Malicious registration of (effective) second level domains
- On-path DNS Attack
- Stub Resolver Hijacking
- Detection
- Code of Conduct & Other Policies
- Examples of DNS Abuse
- Stakeholder Advice
- Ethics SIG
- Exploit Prediction Scoring System (EPSS)
- FIRST Multi-Stakeholder Ransomware SIG
- Human Factors in Security SIG
- Industrial Control Systems SIG (ICS-SIG)
- Information Exchange Policy SIG (IEP-SIG)
- Information Sharing SIG
- Law Enforcement SIG
- Malware Analysis SIG
- Metrics SIG
- NETSEC SIG
- Public Policy SIG
- PSIRT SIG
- Red Team SIG
- Security Lounge SIG
- Security Operations Center SIG
- Threat Intel Coalition SIG
- Traffic Light Protocol (TLP-SIG)
- Transportation and Mobility SIG
- Vulnerability Coordination
- Vulnerability Reporting and Data eXchange SIG (VRDX-SIG)
- Women of FIRST
- CCB Initiatives
- FIRST CORE
- Internet Governance
- IR Database
- Fellowship Program
- Mentorship Program
- IR Hall of Fame
- Victim Notification
- Volunteers at FIRST
- Previous Activities
- Special Interest Groups (SIGs)