One of the biggest differences I regularly observe between high and low performing SOCs: expectations surrounding the burden of evidence. Assuming the correct question, analysts achieve an evidence-based answer. 1/
If an analyst wants to assert something, they need evidence to support that. If they can't produce that evidence, is that a data, tool, or training problem? All are identifiable and solvable. 2/
Do you know if that downloaded thing executed? How do you know? Can you prove it?
Great SOCs get that answer with supporting evidence. Poor SOCs make excuses about why they don't need that evidence or why it's outside their control. 3/
Great SOCs get that answer with supporting evidence. Poor SOCs make excuses about why they don't need that evidence or why it's outside their control. 3/
One of the hardest part of being an analyst is asking the right question. One of the hardest part of supporting analysts in the SOC is making sure those questions are answerable, both through supporting tech and empowering analysts to access relevant evidence. It can be done. 4/4
