Security
--
Questions
--
Followers
Top Experts
Hi Everyone
We’ve recently outsourced the Security Operations Center 24x7 monitoring to 3rd party SOCaas service provider
What should we expect to receive in weekly and monthly reports from the SOC team?
The report will be reviewed by technical security team, C-level & IT Manager.
Currently we are going through a process and reporting is being discussed but we’re now in the early operational phase and trying to fine tune exactly what level of detail and frequency makes sense for both technical and executive stakeholders. We are a health sector.
The platform they use is customizable to an extent and we’re aligned on getting a baseline in place, but I wanted to discuss and get expert opinions here from community what’s working well for others.
So far we have considered the following in weekly reports so far
• Security incidents by severity
• Threat intelligence & IOCs observed
• Detection & Response metrics
• Log source health
• Vulnerability findings
Thanks
Zero AI Policy
We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.
I will probably look out for minimally the below
[Real time]
- Monitoring reports deliver a current view of security health (compliance, patching)
- Monitoring reports deliver a current view of potential threats and vulnerabilities.
- Threat hunting performed actively or due to incident detected
- Remediation actions taken to resolve threats and improve security.
[Weekly]
- Incident reports provide a detailed account of security incidents, their handling, and outcomes.
- Remediation actions taken to resolve threats and improve security.
[Monthly, Quarterly]
- Trend analysis reports offer insights into long-term security trends, aiding in strategic planning.
- Compliance related alignment with new or adjusted regulatory frameworks.
- Remediation actions taken to resolve threats and improve security.
[Annual]
Insights into emerging risks and trends and what to improve and look out in coming year
Recommendations to enhance security posture and reduce recurrence incident (people, process).
[Details to expect in updates]
- Timestamps and time ranges - incidents/data points correlated for tracking and historical analysis.
- Metrics and key performance indicators (KPIs) - Key indicators like incident resolution times and response effectiveness to measure the effectiveness of the SOC.
- Incident summaries - recap security events for quick reference and decision-making.
As per the provider, reports are not customizable as there are standard templates for all customers.
In addition, they mentioned weekly reports are technical and monthly/quarterly reports are sort of for management.
It is with the outcome in mind that would be spelled out, rather how it can be achieved which of course if it nake sense the vendor can suggest alternative if those are already not there. That is why the suggestion since asked what is expected from others
EARN REWARDS FOR ASKING, ANSWERING, AND MORE.
Earn free swag for participating on the platform.
Security
--
Questions
--
Followers
Top Experts
Security is the protection of information systems from theft or damage to the hardware, the software, and the information on them, as well as from disruption or misdirection of the services they provide. The main goal of security is protecting assets, and an asset is anything of value and worthy of protection. Information Security is a discipline of protecting information assets from threats through safeguards to achieve the objectives of confidentiality, integrity, and availability or CIA for short. On the other hand, disclosure, alteration, and disruption (DAD) compromise the security objectives.
Create your account and start contributing!