Developing Base of the Modal SOC Integrated with Free & Open Source Software

Emerging technologies are being developed in response to the increasing reliance on data and information across almost every company and organization today. As a result, it's become essential to monitor systems to identify policy violations, detect cyber threats, and assist with troubleshooting. Log data plays a crucial role in this process, as it provides visibility into system activities. Each application's logs give us insight into what’s happening inside a system, and by collecting and analyzing these logs, wecan effectively monitor for security events and anomalies. A Security Operation Center (SOC) is a centralized unit that is responsible for preventing, detecting, analyzing, and responding to cybersecurity incidents in real time. However, building a SOC from the ground up is a complex process involving the integration of multiple modules and functions. One of the biggest challenges is not just technical, it’s financial. Traditional SOC solutions often require significant investment in commercial tools, licensing, infrastructure, and skilled personnel. The key focus of this research is to explore the possibility of developing a SOC using Free and Open-Source Software (FOSS). This approach offers a more costeffective solution for organizations, especially those with limited budgets, the research highlights both the advantages and the challenges of using FOSS in SOC implementation, including aspects like integration complexity, performance tuning, and community support. Moreover, the study touches on the importance of Security Orchestration, Automation, and Response (SOAR). Finally, this research concludes with key findings and offers recommendations for future work, including how organizations can continue improving their SOC capabilities using open-source technologies while maintaining cost-effectiveness and operational resilience.