SOC Hierarchy & Roles
The 3-tier model, specialist roles, alert lifecycle, and shift handovers
Learning Objectives
- ›Map the 3-tier SOC model (T1, T2, T3)
- ›Understand specialist roles (IR, TI, Detection Engineer, SOAR Engineer, SOC Manager)
- ›Trace an alert from generation to closure
- ›Know what each tier owns and escalates
Module 1 — Tier 1 — Triage Analyst
First responder. Watches the queue. Performs initial triage on every alert.
Owns the runbook: validates the alert, gathers context, decides escalate vs close.
Average time per alert: 5–15 minutes. Burns out fastest if alert quality is poor.
Career path: → T2 within 12-18 months.
Module 2 — Tier 2 — Incident Investigator
Takes escalations from T1. Performs deep correlation across multiple data sources.
Owns the incident end-to-end: investigation, containment, communications.
Pivots through Splunk, EDR, email gateway, identity logs, threat intel.
Module 3 — Tier 3 — Threat Hunter / Detection Engineer
Proactive — hunts for adversaries that no rule has caught yet.
Builds new correlation searches, tunes false positives, runs adversary emulation.
Owns the detection backlog and the engineering side of the SOC.
Module 4 — Specialist Roles
Incident Responder — leads major incidents, runs IR playbooks, coordinates legal/comms.
Threat Intelligence Analyst — produces intel, tracks actors, drives priority intel requirements.
Detection Engineer — codifies hunts into reliable rules; owns CI/CD for detections.
SOAR / Automation Engineer — builds playbooks that automate enrichment and response.
SOC Manager — owns SLAs, capacity, training, vendor management, reporting.
Module 5 — Alert Lifecycle (10 steps)
1) Log generated → 2) Forwarded → 3) Indexed in Splunk → 4) Correlation search fires → 5) Notable Event in Incident Review → 6) T1 triage → 7) Escalate or close → 8) T2 investigates → 9) Containment / Eradication → 10) Lessons learned & detection improvement.
Module 6 — Shift Handovers
Every shift handover passes: open tickets, active incidents, watchlist IOCs, pending approvals.
Quality handovers prevent dropped balls during the most dangerous hours (after-hours / weekends).
Lab 2 — Map a Triage Workflow
- Open the Splunk ES lab → Incident Review.
- Pick the 3 newest notable events.
- For each, write a 4-line triage note (Who · What · When · Action).
- Decide for each: false positive, escalate to T2, or contain.
- Note which tier you'd hand off to and why.
Key Takeaways
- ✓T1 triages, T2 investigates, T3 hunts and engineers
- ✓Every alert needs a runbook and an owner
- ✓Notable Events are the heartbeat of Splunk ES