Operational tasks for SOC analysts
In this section, we will provide an initial list of tasks that have been identified as operational requirements for SOC analysts. These tasks focus on the work required to create, maintain, and organize Azure Sentinel components to ensure operational efficiency.
Daily tasks
A list of daily tasks is as follows:
- Check the Incidents page to ensure any new incidents are assigned to an owner, and all open or in-progress incidents are actively investigated until completion.
- Go to the Hunting page and select Run all queries:
- Review the results for each query that returns at least one result.
- If any queries return a result of N/A, then investigate why results are not available (you should return at least 0 as a result).
- Review TI sources for current activities and new findings; apply findings to your threat hunting procedures.
Weekly tasks
A list of weekly tasks is as follows:
- Go to the Hunting page and review all...
