SOC monitoring and event correlation
Continuous monitoring with IBM QRadar: offense triage, cross-source correlation and hand-off to response.
Based on professional work at Neotel Segurança Digital. Clients, rules, indicators and configurations are confidential and have been left out.
Problem
Hybrid corporate environments produce a high volume of events from firewalls, proxy, WAF and endpoints. Without correlation, the relevant signal gets lost in the noise and investigations take longer than they should.
Technical goal
Detect and qualify suspicious activity quickly, shortening the path from alert to response decision.
How it was done
Watch SIEM offenses and alert queues throughout the shift.
Triage: validate the source, asset context and severity before escalating.
Correlate with firewall, proxy and WAF logs and EDR telemetry to build the timeline.
Classify the case as false positive, benign activity or incident, and record the analysis.
Hand off for containment and follow through to closure.
Build and tune correlation rules and use cases mapped to MITRE ATT&CK based on what each case taught.
Evidence
SELECT sourceip, username, COUNT(*) AS falhasFROM eventsWHERE QIDNAME(qid) ILIKE '%login failed%'GROUP BY sourceip, usernameHAVING falhas > 20ORDER BY falhas DESCLAST 1 HOURSKey takeaways
- Asset context matters as much as the alert signature.
- Well-documented triage speeds up the next investigation.
- Rule tuning never stops: every false positive teaches something about the environment.