security-operations_skill

Overview

This skill captures practical Security Operations Center (SOC) practices for incident response, SIEM management, and threat hunting aligned to NIST 800-61. It distills team roles, incident lifecycle steps, playbooks for common incidents (phishing, ransomware, data breach), and essential SIEM queries and metrics. Use it to build repeatable operational processes and measurable detection/response capabilities.

How this skill works

The skill outlines a four-phase incident response lifecycle: Preparation, Detection, Containment/Eradication, and Post-Incident review. It maps SOC tiers (T1–T3) to responsibilities, provides SIEM query examples and correlation rules, and describes threat-hunting and forensics procedures. Actionable checklists, recovery steps, and timing targets (MTTD/MTTR) make it operationally usable.

When to use it

• When designing or maturing a SOC and defining roles, on-call rotation, and escalation paths.
• When creating or updating incident response playbooks for phishing, ransomware, or data breaches.
• When tuning SIEM rules, implementing correlation, and reducing alert noise.
• When running tabletop exercises, red team tests, or post-incident reviews.
• When building threat-hunting programs and creating hypotheses tied to telemetry sources.

Best practices

• Automate repetitive Tier 1 tasks with SOAR and enrich alerts with threat intel to reduce fatigue.
• Prioritize log sources (auth, network, endpoints, cloud, apps) and ensure complete ingest and retention.
• Define clear severity levels and SLA targets (e.g., critical detection <1 hour, response <4 hours).
• Preserve forensic evidence before remediation and document chain-of-custody for legal needs.
• Run quarterly rule tuning and annual tabletop or red-team exercises to validate procedures.

Example use cases

• Triage workflow for a suspected credential compromise: validation, scoping, contain, and escalate.
• Implementing SIEM correlation rules for brute force, privilege escalation, lateral movement, and data exfiltration.
• Ransomware playbook execution: isolate, assess encrypted systems, rebuild from gold image, and improve backups.
• Threat hunt for beaconing activity using connection-interval analysis and UEBA baselines.
• Post-incident review template creation with timelines, lessons learned, and tracked remediation items.