---
title: "Security Operations Center"
canonical: https://trickest.com/glossary/security-operations-center
description: "A security operations center is the team and tooling that monitors an organization around the clock to detect, investigate, and respond to security events."
---

# Security Operations Center

A security operations center is the team and the tooling that watch an organization's environment for signs of attack and act on them. Analysts triage alerts in tiers: the first line confirms and filters, deeper levels investigate the events that survive triage, and threat hunters look for activity that no alert fired on. The SOC may sit in-house, run as a managed service, or blend both.

It matters because attacks happen at any hour and dwell time decides how much damage an intruder causes. A SOC compresses the gap between an attacker's first action and the defender's response, which is the difference between a contained incident and a breach.

The center runs on connected functions. A [SIEM](/glossary/siem) aggregates and correlates logs into alerts, [detection engineering](/glossary/detection-engineering) writes and tunes the rules that decide what fires, and [incident response](/glossary/incident-response) takes over once an event becomes confirmed. Feeding [vulnerability management](/glossary/vulnerability-management) data into the SOC helps analysts judge whether an alert hits an exposed weakness.

In a Trickest workflow you automate the enrichment a SOC repeats on every alert, resolving IPs, checking domains against intelligence, and pulling asset context, so analysts open a ticket with the surrounding facts already gathered.

---
_Markdown source of https://trickest.com/glossary/security-operations-center._