SOC Analyst workflows
As a Security Operations (SOC) analyst, you're the one on the ground when Northstar flags something serious. This page covers how the SOC workflow runs, from spotting an incident through closing it out.
Your role in Northstar
As a SOC analyst, you're typically responsible for:
Triaging and responding to incidents: investigating whether an incident is a true or false positive. This includes incidents that Northstar opens automatically when CVE Shield detects a successful attack. The incident title shows the CVE, and the details of its observations show the exploited method.
Performing initial containment, such as blocking IP addresses or isolating affected systems.
Executing incident response, including containment, eradication, or recovery.
Looking for threats and identifying risk and exposure across the organization.
Bringing Contrast ADR data into SIEM tools using Contrast integrations.
Where AppSec is driving code-level fixes and a CISO is watching program trends, your job is the active one: deciding what's real right now and acting on it fast.