Work

A Practical SOC Use Case Life Cycle with MITRE ATT&CK Simulation

Year: 2026

Type: article

Abstract: A SOC use case starts by understanding real business risks and how attackers behave.These behaviors are mapped to the MITRE ATT&CK framework and matched with available security logs.Detection rules are then built and tested using real attack simulations to ensure they actually work.Once validated, alerts are handled through clear analyst playbooks and incident response processes.The use case is continuously improved based on simulations, incidents, and analyst feedback.

Source: Zenodo (CERN European Organization for Nuclear Research)

DOI: 10.5281/zenodo.18329608

Author: Muhammad, Sheraz

Language: English

Topic: Network Security and Intrusion Detection

Subfield: Computer Networks and Communications

Field: Computer Science

Domain: Physical Sciences

Open Access status: green

OpenAlex ID: W7125288706

FWCI:

Cites:

Cited by:

Related to: