Summary

In this chapter, we have looked at the varied tools and techniques that would be used within an enterprise SOC. A security professional will need to identify different types of threats and be able to select the correct approach and framework. We have covered the main industry approaches. We have examined how an organization can identify IOCs and how to respond to a variety of threats.

In this chapter, you have gained the following skills:

• An understanding of the different sources for threat intelligence
• An understanding of the main threat actor types
• An understanding of threat actor properties
• An understanding of intelligence collection methods
• An understanding of frameworks, including MITRE, the Diamond model, and the cyber kill chain model.
• An understanding of how an enterprise detects indicators of compromise.
• How to respond to threats.

This knowledge gained will be very useful as we look into vulnerability management and pen testing...