A Grid-Matrix Based on Industry Needs to Evaluate Automation in Security Operations Centre (SOC)

Security Operations Centre (SOC) is a unit used for events detection and responding to incidents associated with cyber security threats via monitoring, detecting, examining and reporting on anomalies. Well-known, unknown and new activities are part of SOC tasks that organisations looking to have in their security environment. The key purpose of SOC is to be able to analyse a large set of data and correlate other categories of events. Some network monitoring software solutions produce huge number of false positives due to the lack of accurate prediction processes. Manual processes can provide hackers with the advantage of having more time to accomplish their malicious activities. Thus, SOC analysts are required to apply automated mechanisms to help them in detecting threats. This paper presents a Grid-Matrix that contains different parameters to be considered when evaluating automation and machine learning (ML) models within SOC. An automation model using machine learning algorithms is presented to several cyber security specialists in industry. Based on their feedback the Grid-Matrix is created to compare and evaluate different automation solutions. Thus the obtained results of this work is the Grid-Matrix that highlights the essential parameters that need to be considered when applying automation solutions into SOC.