What is a SOC (Security Operations Center)?

Is a SOC a team, a place or a tool?

A Security Operations Center is primarily an operational function. It combines people, procedures and technical resources to monitor a defined scope, detect suspicious events, analyse them and coordinate initial response measures. The term may describe a co-located team, a distributed service or an outsourced operation. Buying a SIEM, EDR or probe does not, by itself, create a SOC.

This view is consistent with the French ANSSI PDIS v2.0 framework, which covers organisational, human and technical capabilities rather than a product alone.

What happens when an alert appears?

Depending on scope, the SOC receives events from identities, endpoints, servers, applications, cloud services and network equipment. It correlates signals, rules out evident false positives, builds a timeline and assesses the possible extent. When an incident is plausible, it follows an escalation procedure: inform designated owners, preserve relevant evidence and recommend or initiate authorised measures.

Log quality is critical. ANSSI’s logging recommendations address collection architecture, protection of records and their use both to detect and understand an incident.

Who decides and who acts?

The SOC should not improvise its authority during a crisis. Procedures should state who may isolate an endpoint, block an account, stop a service, contact management or involve a specialist. A SOC can detect and coordinate without performing every technical action itself. It does not replace IT, management or notification duties assigned to other functions.

An SME may use an internal, outsourced or hybrid model. The choice depends on the required monitoring hours, available skills, system sensitivity and expected response time. “24/7” coverage should be claimed only when staffing, contracts and procedures genuinely provide it.

How should effectiveness be measured?

The number of alerts processed is not an outcome by itself. More useful measures include actual coverage of critical assets, time to assessment, time to action, the proportion of irrelevant alerts, exercise results and closure of identified root causes. Metrics should lead to concrete improvements.

A Luxembourg case: what had to be done after the attack

During the night of 22 to 23 July 2022, the Luxembourg energy group Encevo suffered a cyberattack affecting its entities Creos and Enovos. The customer portals stopped working; electricity and gas supply was not interrupted.

The full account is told in Syndic ransomware and co-owner data leaks. What concerns us here is what came next: what the company had to do, and in which order. That is precisely a SOC’s output, and almost none of it is technical.

• Qualify. Establish what is affected and what is not. Here: the portals, yes; the distribution network, no. That distinction is what allowed service to continue.
• File a complaint with the Grand Ducal Police.
• Notify the authorities — the CNPD for personal data, the ILR as sector regulator, and the relevant ministries.
• Analyse what left, in order to know what to tell the people concerned.
• Communicate, including to say what still works.

A SOC is not judged on the finesse of its tooling, but on its ability to produce that sequence without hesitating over who does what.

What an SME has to decide

A twenty-person company will not have an in-house SOC, and does not need one to answer the questions below. They define who does what on the day it happens.

• Who do you call, and on which number? The IT provider, the insurer, CIRCL. That list fits on one page, and it must exist outside the information system: ransomware also encrypts the contact file.
• Who decides to cut? Unplugging a suspect server costs business. The person with that authority is named in advance, and reachable at the weekend.
• Which activities must hold without IT, and for how long? Delivering, invoicing, paying wages, opening doors. The answer gives the order in which things are brought back.
• Who speaks to customers, and what is said? Silence is noticed more than imperfect communication.
• Do you know how to notify the CNPD in time? A personal data breach is notified without undue delay and, in principle, within 72 hours. Knowing who drafts that notification is a decision, not a technical skill.

Sources

Links checked on 28 September 2026.

• Encevo, press release on the cyberattack, 2022: encevo.eu (PDF, in French).
• Paperjam, “Creos et Enovos victimes d’une cyberattaque”: paperjam.lu.
• Le Quotidien, “Cyberattaque contre Encevo : une rançon réclamée par les BlackCat”: lequotidien.lu.
• CIRCL, Luxembourg’s incident response centre: circl.lu.
• Luxembourg national cybersecurity portal: cybersecurite.lu.

Sensors are covered in Cybersecurity probe: definition, purpose and limits. To distinguish a weakness from an incident, read What is a cybersecurity vulnerability?.