From Indicators to Insights: Mastering TTPs, IOCs, and Alert Triage in the SOC Link to heading
Introduction Link to heading
In the world of cybersecurity, understanding both the technical indicators of compromise and the behavioral patterns of attackers is essential for effective defense. This article explores three foundational concepts that every SOC analyst must master: Tactics, Techniques, and Procedures (TTPs) , Indicators of Compromise (IOCs) , and Alert Triage.
Part 1: Tactics, Techniques, and Procedures (TTPs) Link to heading
TTPs describe how attackers think, act, and operate during a cyber attack. While an Indicator of Compromise (IOC) tells you what happened, TTPs tell you how and why it happened.
Why SOC Analysts Use TTPs Link to heading
SOC analysts leverage TTPs to:
- Detect attacks even when IOCs change
- Understand attacker intent and motivation
- Build better detection rules, alerts, and response playbooks
The Importance of TTPs in a SOC Link to heading
Consider this analogy:
| Perspective | Description |
|---|---|
| IOC perspective | “A masked person was seen.” |
| TTP perspective | “The attacker broke the lock, entered through the backdoor, disabled the CCTV, and escaped via the fire exit.” |
SOC analysts care more about behavioral patterns than isolated indicators. Understanding the how and why enables proactive defense rather than reactive response.
1. Tactics: The Attacker’s Goal Link to heading
Tactics represent the why behind an attacker’s actions—their immediate objectives during an attack.
| Tactic | Meaning |
|---|---|
| Initial Access | How the attacker first gains entry |
| Execution | Running malicious code on the system |
| Persistence | Maintaining presence in the compromised system |
| Privilege Escalation | Gaining higher privileges (e.g., admin access) |
| Defense Evasion | Avoiding detection by antivirus/EDR solutions |
| Credential Access | Stealing passwords and authentication tokens |
| Lateral Movement | Moving to other systems within the network |
| Exfiltration | Stealing sensitive data from the environment |
Each tactic represents a distinct phase in the attack lifecycle. Common attack goals include:
- Gaining initial access
- Stealing credentials
- Moving laterally across the network
- Exfiltrating sensitive data
- Maintaining persistence
2. Techniques: The Method Link to heading
Techniques explain how an attacker achieves a specific tactic. For example, under the tactic of “Credential Access,” techniques might include:
- Keylogging
- Credential dumping (LSASS)
- Browser password theft
- Phishing for credentials
Note: Each tactic typically has multiple associated techniques.
3. Procedures: The Execution Steps Link to heading
Procedures represent the attacker’s real-world implementation of a technique. This includes:
- Specific tools used
- Commands executed
- Scripts deployed
- Timing and sequencing
Example:
| Component | Detail |
|---|---|
| Technique | Credential dumping |
| Procedure | procdump.exe -accepteula -ma lsass.exe lsass.dmp |
MITRE ATT&CK Framework Link to heading
Most SOC teams map TTPs using the MITRE ATT&CK framework—a globally recognized knowledge base used by SOCs, SIEM, EDR, and XDR platforms. It is structured around tactics and techniques, providing a common language for cybersecurity professionals.
Part 2: Indicators of Compromise (IOCs) Link to heading
IOCs are observable evidence that suggests a system may be compromised or under attack. If TTPs describe attacker behavior, IOCs are the footprints attackers leave behind.
“IOC means something bad happened here, and we can prove it with data.”
This data comes from various sources:
- Logs
- Network traffic
- Endpoint activity
- Email headers
- File systems
How SOC Analysts Use IOCs Link to heading
In a real SOC environment, IOCs help analysts:
- Trigger alerts in SIEM
- Confirm malicious activity
- Correlate attacks across systems
- Respond quickly to incidents
- Write comprehensive incident reports
Types of IOCs Link to heading
1. Network-Based IOCs Link to heading
These reveal what happened within the network:
- Malicious IP addresses
- Suspicious domains
- C2 server communication
- Unusual ports or protocols
Where SOC sees them:
- Firewall logs
- Proxy logs
- DNS logs
- IDS/IPS alerts
2. Host/Endpoint-Based IOCs Link to heading
These show what happened inside the system:
- Suspicious processes
- Unexpected services
- Registry changes
- New scheduled tasks
Where SOC sees them:
- EDR/XDR platforms
- Windows Event logs
- Sysmon
- Linux audit logs
3. File-Based IOCs Link to heading
These relate to malicious files:
- File hashes (MD5, SHA256)
- File name patterns
- File size anomalies
Where SOC sees them:
- Antivirus solutions
- EDR platforms
- Email security gateways
- Sandbox environments
4. Email-Based IOCs Link to heading
These relate to malicious emails:
- Malicious sender addresses
- Phishing subject lines
- Malicious URLs
- Email header anomalies
Where SOC sees them:
- Email security tools
- Microsoft Defender
- Proofpoint/Mimecast
- User reports
IOC Confidence Levels Link to heading
Not all IOCs carry equal weight. SOC analysts assess confidence levels to prioritize response:
| Confidence | Example |
|---|---|
| Low | Single suspicious IP address |
| Medium | Known phishing domain |
| High | Malware hash combined with execution evidence |
| Very High | Multiple correlated IOCs pointing to the same threat |
Critical point: SOC analysts never rely on a single IOC. Multiple correlated indicators significantly increase confidence in threat detection.
IOC vs. TTP: Key Differences Link to heading
| IOC | TTP |
|---|---|
| Evidence | Behavior |
| What happened | How it happened |
| Short-lived | Long-lived |
| Easy to change | Hard to change |
| Used for alerts | Used for detection logic |
Best practice: Pro SOC teams use both together. IOC alerts initiate investigation, while TTP analysis provides context and deeper understanding.
Real SOC Flow Link to heading
IOC Detected (IP/Hash/Code) ↓ SIEM Generates Alert ↓ SOC L1 Validates IOC ↓ SOC Maps to TTP ↓ Decision: True Positive or False Positive ↓ Escalation or Close
text
Part 3: Alert Triage Link to heading
What is Alert Triage? Link to heading
Alert triage is a structured process of quickly analyzing security alerts to determine whether they represent real threats, false alarms, or require escalation.
“Alert triage separates real attacks from noise—fast and accurately.”
The Alert Lifecycle Link to heading
Events (program execution, login attempts, etc.) ↓ Alerts (generated by security tools) ↓ Triage (analysis and classification)
text
Sources of Alerts Link to heading
- SIEM platforms
- EDR/XDR solutions
- IPS/IDS systems
- Email security tools
Why Alert Triage is Critical Link to heading
Without proper triage:
- SOC teams drown in alerts
- Real attacks get missed
- Response is delayed
- Business impact increases
With good triage:
- False positives (noise) are reduced
- Real threats are caught early
- SOC becomes efficient and trusted
Key insight: SOC analysts are evaluated based on triage quality, not the number of alerts closed. Triage determines whether an alert becomes an incident.
Alert Properties Link to heading
| Property | Description |
|---|---|
| Alert Severity | Urgency assigned to the alert (Low, Medium, High, Critical) |
| Alert Status | Current lifecycle state (New, In Progress, Closed) |
| Alert Verdict | L1 classification outcome (True Positive/False Positive) |
| Alert Assignee | Analyst handling the alert |
| Alert Description | Detailed description of the suspicious activity |
| Alert Fields | Affected hostname, command line, etc. |
Alert Prioritization Link to heading
Alert prioritization is the process of deciding which alerts to investigate first based on their potential impact and urgency.
“Every SOC team has its own prioritization rules and automates them by setting appropriate alert sorting logic in SIEM or EDR.”
Best Practices for Alert Prioritization Link to heading
- Filter alerts to ensure no duplication of effort
- Sort by severity to address the most critical issues first
- Sort by time to comply with service level agreements (SLAs)
Conclusion Link to heading
Understanding the relationship between TTPs, IOCs, and alert triage is fundamental to effective security operations. IOCs provide the evidence, TTPs provide the context, and effective triage ensures that security teams focus their efforts where they matter most.
By mastering these concepts, SOC analysts can move from reactive response to proactive defense—catching threats earlier, responding faster, and ultimately making their organizations more secure.