Translated from 日本語 • View original 
However, this is what I often hear in the field.
"I can analyze logs, but I don't know what to judge in the end."
"There are alerts, but I can't judge whether it's really a 'threat'."
This is a wall that security operations always face as they move to the next stage.
1. There is a big gap between "analysis" and "judgment"
Log analysis means that
It refers to the state of being able to visualize data and read correlations.
On the other hand, judgment is
It is the act of deciding whether it is a threat or not and whether a response is necessary.
In other words, analysis is "information processing" and judgment is "decision-making".
In between, there is an inextricably linked gap between experience and standards.
2. Common "Injurious" Patterns
| Pattern | Situation | Results |
|---|---|---|
| I don't know what an alert means | Unable to technically interpret Defender or Sentinel detections | No progress as it is "under investigation for the time being" |
| No Risk Standards | Not sharing "where the threat comes from" within the SOC and CSIRT | Judgments vary depending on the person in charge |
| It does not lead to recurrence prevention | Once you respond, you'll get the same type of alert again | Response history is not knowledgeable |
| Stop at "suspicious but not confirmed" | The behavior on the log is subtle and there is no decisive blow | Unable to escalate or close, floating in the air |
In this way, "unable to judge" is
In many cases, it is not just a lack of skills, but a lack of operational design.
3. What is needed for a SOC that can make decisions is "standards" and "records"
It is not experience that supports judgment, but systematized standards and records.
- Specify the response criteria
- "If this alert comes out, look it up here."
- "Escalate if this condition is met"
Share these decision lines with your entire team.
- Unify the rules for risk assessment
- Define Severity (tool importance) and Risk (self-judgment) separately.
- Example: "Multiple detections on the same device" → Raise the risk level by one level.
- Have a mechanism to keep a judgment log
- Who made the decision based on what information.
- Leaving "reasons for judgment" in Backlog, Wiki, etc. will increase reproducibility.
4. Tools can automate "analysis", but not "judgment"
SIEM, SOAR, EDR, and AI Assistant......
These tools automate data analysis, organization, and notification.
However, "how much risk it is to the organization" and "whether it should be dealt with"
You can't decide with a tool.
This is because judgment is "decision-making" that crosses technology, business, and organization.
5. Helping Colorkrew Security
Colorkrew Security provides the following
We support a "SOC operation system that can make decisions".
- Tuning detection rules and developing risk assessment standards
- Design and document compliance standards
- Mechanism for recording and reusing judgments (knowledge)
From a SOC that just looks at logs,
**To a SOC that can make decisions and improve. **
We will design and operate the "maturity of operations" together.