SOC L1

·     Load sharing with L1

·     Validate Incidents
reported 

·     Act as a point of
escalation for L1 SOC support of information security
investigations

·     Provide guidance and
oversight on incident resolution and containment techniques

·     Manage the SIEM, incidents
knowledge base

·     Incident detection&
Response

·     Build/review use cases

·     Perform Log Management and
Event Management

·     Leverage emerging threat
intelligence (IOCs, updated rules, etc.)

·     Contribute to the creation
of incidents playbooks

·     Identify impacted systems
and the scope of the attack

·     Recommend how to optimize
security monitoring tools based on threat hunting discoveries

Recommend actions for mitigation/ remediation to the
client