Operational tasks for SOC analysts
In this section, we will provide an initial list of tasks that have been identified as operational requirements for SOC analysts. These tasks focus on the work required to create, maintain, and organize Microsoft Sentinel components to ensure operational efficiency.
Daily tasks
A list of daily tasks for SOC analysts is as follows:
- Check the Incidents page to ensure any new incidents are assigned to an owner and all open or in-progress incidents are actively investigated to completion.
- Go to the Hunting page and select Run all queries:
A. Review the results for each query that returns at least one result.
B. If any queries return a result of
N/A, then investigate why the results are not available (you should at least receive a return of0as a result). - Review TI sources for current activities and new findings and apply any findings to your threat hunting procedures.
Weekly tasks
A list of weekly tasks for SOC analysts...
