home / incident-response / soc-analyst-web-agency
SOC Analyst at a Web Design Agency
My work as SOC Analyst at the same web design agency: monitoring, triage, escalation and tuning, anonymised.
- Type
- Ongoing operational case
- Severity
- Medium
- Category
- Security operations and monitoring
- Role
- SOC Analyst
- Organisation
- Web design agency (anonymised)
Summary
The agency builds and hosts websites for many clients, so it holds client sites, admin panels, hosting accounts and design assets. As SOC Analyst I watched the alerts from those systems, decided what was real, escalated what mattered, and tuned noisy detections so the team could trust what it saw.
My role
SOC Analyst. I monitored the alert queue, triaged and investigated alerts, escalated confirmed issues to the system owner or the account holder, and wrote up what I found. I also worked on reducing false positives.
Timeline
relative to the first event- T+0
Alert
An alert fires for sign-in activity or a web-facing event on a client or internal system and enters the queue.
- T+10m
Triage
Check the account, source address, time and what the account normally does. Decide: benign, suspicious or confirmed.
- T+30m
Investigate
Pull related logs from the same account, host and source to see what else happened before and after.
- T+1h
Escalate and contain
If confirmed, tell the system owner and take the agreed first step: reset credentials, revoke sessions, or isolate the affected site or account.
- T+1d
Document
Record what was seen, the decision made and the evidence, so the next analyst can follow it.
- T+1w
Tune
Review alerts that turned out benign and adjust thresholds, allow-lists or rule logic.
Key decisions
Escalate on evidence, not on the alert name
An alert is a lead. Escalation waits for evidence from related logs, so owners are not pulled in for noise.
Take the smallest effective containment step first
Resetting credentials and revoking sessions stops most account abuse without taking a client site offline.
Tune after every cluster of false positives
A queue full of noise hides real incidents. Repeated benign alerts become tuning tasks.
Actions taken
- Monitor: watch the alert queue and the key sources: sign-ins, web server and hosting logs, and admin panel activity.
- Triage: classify each alert with a short, consistent checklist.
- Escalate: hand confirmed issues to the owner with the evidence and the first containment step taken.
- Tune: reduce repeat false positives and record the change.
Post-incident improvements
| Area | Change |
|---|---|
| People | Clear escalation contacts for each client system and for the agency’s own accounts. |
| Process | Triage checklist, ticket template, and a regular tuning review. |
| Tooling | Alerts on unusual sign-ins and admin actions, with the context an analyst needs in the alert itself. |
| Detection | Rules reviewed against real outcomes, with benign patterns allow-listed. |
Lessons
- Good triage is a repeatable checklist, not a feeling.
- Context in the alert saves more time than extra alerts.
- Tuning is part of the job: every false positive that is fixed makes the next real one easier to see.
Tags
#incident-response#soc#monitoring#triage