Learning centre
How security operations works, in plain words
Guides to triage, investigation, detection and hunting, and to what AI changes in the SOC. Written for the people who run security and the people who pay for it.
- What is an AI SOC?An AI SOC uses an AI agent to take the first look at security alerts and hand people a verdict with its evidence. Here is what the AI does, what it leaves to people and what to check before you choose one.
- How an AI SOC compares with a traditional SOCA traditional SOC runs on tiers, shifts and handovers; an AI SOC puts an agent on the first look. Here is where each is strong, how they fit together and how to count what the first look costs you today.
- A practical guide to alert triageTriage decides which alerts matter and in what order. This guide covers the questions a good triage answers, how to order the queue, how to state a verdict and its confidence, and when to escalate.
- The hidden cost of false positivesAlerts that turn out to be nothing still cost time and attention, and they make real attacks easier to miss. Here is where the cost hides and how to measure it in your own team.
- Why alert fatigue happens and how to reduce itAlert fatigue is what happens when people see more alerts than they can give real attention to. This guide covers its usual causes, from noisy rules to night shifts, and practical ways to reduce it.
- How to investigate a security alert, question by questionThe questions an analyst works through to decide whether an alert is a real attack, and how to keep the evidence so others can check the verdict.
- Alert correlation: joining single alerts into one attackWhy alerts read one at a time mislead, how to decide which alerts belong to the same attack, and what a campaign view should show the people reviewing it.
- Threat hunting with hypotheses: how to write and run a huntHow to turn an idea about attacker behaviour into a hunt you can run, what data each hunt needs, and how to read the results without being misled by an empty answer.
- Testing detection rules before they go liveHow to check that a new detection rule has the data it needs, how often it would fire on past data, and how to approve, tune and switch rules off with proper change control.
- On-premises AI for security operations: keeping alert data at homeWhy some organisations run their AI investigator inside their own environment, and what that means for data residency, regulation, running cost and hardware.
- SOC metrics that matter, and how to measure them honestlyFive measures that say whether a security operation is finding attacks and missing nothing important, and the habits that keep them honest.
- How to triage Elastic Security alertsA practical routine for triaging alerts in Elastic Security: what to read first, which fields and data to check, how to treat noisy rules and when to escalate.
- Investigating suspicious Linux process activityHow to investigate suspicious process activity on Linux: reconnaissance commands, parent and child chains, cron jobs, beaconing and the logs you need.
- Covering security alerts at night and weekendsHow to cover security alerts out of hours: on-call models, what should wake someone, runbooks, the morning handover and how an AI first look changes the night.
- Running security operations with a small teamHow a team of two to five people can run security operations: what to monitor first, tuning noise, outsourcing choices, safe automation and avoiding burnout.
- AI SOC on-premises vs cloud: how to chooseWhat leaves your network in a cloud AI SOC, what running one on-premises asks of you, and a checklist for choosing between them or mixing the two.
- Alternatives to an MDR service, comparedWhat a managed detection and response service gives you, where buyers feel it falls short, and how in-house, co-managed, MSSP and AI SOC options compare.
- SOAR vs AI SOC: what is the difference?SOAR follows playbooks written in advance; an AI SOC decides its next investigative step. Where each fits, what each costs to keep up, and how to use both.
- How much does a SOC cost? A way to work it outA method for working out what a SOC costs: round-the-clock staffing, tools, hidden costs, and a worked example you can redo with your own numbers.
- How to evaluate an AI SOC platformA buyer’s checklist for AI SOC platforms: accuracy on your own alerts, visible reasoning, honest confidence, data handling, pricing and demo red flags.
- How to run an AI SOC pilot on your own alertsA step-by-step plan for piloting an AI SOC: scope, success criteria, known-answer alerts, reviewers, read-only access and what to measure honestly.
- Can you trust an AI verdict on a security alert?When an AI verdict on a security alert deserves trust: cited evidence, calibrated confidence, known failure modes, human review and a full audit trail.
- AI in the SOC for regulated organisationsHow banks, healthcare, government and critical infrastructure can use AI in the SOC while keeping data at home, people accountable and evidence ready.
- Alert triage for MSSPs across many customersHow MSSPs can triage alerts across many customers: separate data, per-customer context, consistent verdicts, readable reports and analyst time.
New guides and posts by emailAbout once a month: a new guide to security operations, or what changed in armor360. No other mail.Subscribe by email
See where your team’s time goes. Then decide.
Start a free pilot on your own alerts, or put in your own numbers first.