Chapter 13 of 13 · Day 180
What SOCs are not good at
- Why does my SOC celebrate alert volume?
- Why does nobody tune the noisy rules?
- Is the hero who stays all night a good model?
By month six you will see your SOC more clearly. You will see what it does well and where it struggles. Many SOCs share the same few blind spots. Naming them helps you avoid copying them, and helps you suggest something better when you are ready.
1. Treating alert volume as success
A slide that says "we handled thousands of alerts this month" sounds impressive and says almost nothing about safety. More alerts can mean more noise, not more protection. Better questions: how many led to real action, how many rules produced only false positives, and what did we miss?
2. Tuning nothing
Rules get added after every incident and report, and almost never removed or improved. Over time the queue fills with alerts nobody believes. Analysts close them by habit, and real signals get buried. Tuning is not lowering your guard. It is making sure your guard is pointed at the right place.
- Every rule should have an owner.
- Every noisy rule should get a tuning review on a schedule.
- Analysts should have an easy way to say "this one is always noise".
3. Hero culture
Some teams admire the person who stays all night, knows every system and fixes everything alone. That person is often exhausted, and when they leave, their knowledge leaves too. A strong team writes things down, shares the hard cases and makes sure no single person is the only one who can handle something.
The question you might not ask out loud
I am new. Can I really change any of this?
Not by yourself, and not by arguing. You can write clear tickets, raise tuning requests with evidence, document what you learn, and refuse to be the hero. Those habits spread. In a year, the new analyst will copy you.
Where you are now
You know the queue, you know who to call, you can write a ticket someone else can act on, and you have a direction in mind. That is a good 180 days. The next step is choosing what kind of analyst, engineer or leader you want to become, and practising on purpose.
Rule of thumb:Rule of thumb: judge a SOC by what it learns after a miss, not by how many alerts it closes.