Example of SOC RACI with both internal resources of a given organization an

Organization
Activities SOC Incident Offensive SOC
SOC analyst detection manager security Management SOC analyst
lead expert
Alerts triage (SIEM) I A R
Incident creation (SIRP) for follow-up I I A R
Detection
service Incident validation by organization's SOC team R I I A I
Confirmation of need to escalate the incident to CSIRT team R I A A I
Detection use case opportunities identification C A C R A/C C
Risk-based attack scenarios confirmation, with redteaming I A I R A/C
SIEM rules creation (SIEM search creation and optimization) I A I I A
Detection Service Testing & Tuning
engineering C A A C
SIEM rules maintenance & fix I C A I
Datamodel management I A I A I
Data acquisition and ingestion to the SIEM I A I I A I
Custom playbook development C C C C A I
Automation
engineering Tools integration with orchestrator (ITSM, security C C C C A I
solutions...)
Threat intelligence collection C A I I A I
Security
Intelligence Threat intelligence sources validation C A C I A I
Services Threat intelligence use cases definition C A C I A I
SOC tools (SIEM, TIP, SIRP, SOA, GIT) admininistration I I I I A I
Log Source Heartbeat Monitoring I I I I A I
Administrativ
e Services Log Source Management I C I I A I
SOC tools monitoring I I I I A I
Building and updating KPI C C C C A/R I
Reporting Generating reporting
Services I I A I A I
Acting upon missed SLA C C C I A/R I
Incident handling (CSIRT) I I A I A I
Incident
response Forensics Investigation (CSIRT) I I A I A I
service Improve detection with incident response feedback I R A C A I
Detection capabilities assessment (purpleteaming) R A I R A/C R
Continuous Incident response capabilities assessment (purpleteaming)
improvement I I A R A/C I
Scheduling regular external audits I I I I A/R I
en organization and pure-player MSSP
MSSP
Incident Threat intel SOC SecDevOps / SOC Tools SDM /
handler analyst detection automation Admin project
engineer management
I
I I
I I
I A
C C R A
C I R A
I R I
R I A
R I I
I I R I I
I I R I I A
I I C R I A
I I C R C A
I R I I I A
I R I I C A
I R C I A
I I I I R A
I I I I R I
I I C C R A
I I I I R A
I I I I R
I I I A/R
I I I I R
R I I A
R I I A
C C R C I A
I I R R A
R R R A
I I I I I A/R