The ontology for SOC creation assistance and replication

A Security Operations Center (SOC) is an indispensable tool for any modern organization or enterprise to secure its digital data and information assets. Developing SOCs and SOC capabilities to meet organizational needs in today’s threat environment is an often laborious, time-consuming, and expensive task that (if not done correctly) may leave organizational goals unfulfilled. In this paper, we introduce the Ontology for SOC Creation Assistance and Replication (OSCAR), which organizations can use to aid in developing SOCs and in planning and evaluating SOC capabilities. We developed OSCAR using a purpose-built dataset created by extracting the knowledge of numerous SOC expert practitioners. OSCAR is organized into a knowledge hierarchy that includes people, process, and technology classes, but also emphasizes planning and functional considerations. OSCAR accomplishes two things. First, it fills a gap in existing cyber ontology literature by including classes for the initial development of SOCs in addition to those for security operations capabilities. Second, its domain-specific knowledge is derived from a unique dataset gathered directly from experts working in the field. Taken together, these unique traits make OSCAR an ideal tool for planning, building, and evaluating SOCs.