The rising frequency and complexity of cybersecurity threats necessitate robust monitoring and rapid response capabilities to safeguard digital assets effectively. As a result, many organizations are increasingly establishing Security Operations Centers (SOCs) to actively detect and respond to cybersecurity incidents. This paper addresses the intricate process of setting up a SOC, emphasizing the need for careful planning, substantial resources, and a strategic approach. This study outlines the essential steps involved in defining the SOC’s objectives and scope, selecting appropriate technologies, recruiting skilled cybersecurity professionals, and developing processes throughout the SOC lifecycle. This paper aims to provide a comprehensive understanding of the SOC’s threat detection capabilities and use cases. It also highlights the importance of choosing technologies that integrate seamlessly with existing IT infrastructure to ensure broad coverage of SOC activities. Furthermore, this study offers actionable insights for organizations looking to enhance their SOC capabilities, including a technical overview of SOC use case coverage and a gap assessment of detection rules. This assessment is based on an alignment with the MITRE ATT&CK framework and an analysis of events generated by the company’s existing IT devices and products. The findings from this research elucidate the indispensable role that SOCs play in bolstering organizational cybersecurity and resilience.

The increasing complexity and sophistication of cyber threats underscore the critical need for advanced threat detection mechanisms within Security Operations Centers (SOCs) to effectively mitigate risks and enhance cybersecurity resilience. This study enhances the capabilities of Wazuh, an open-source Security Information and Event Management (SIEM) system, by addressing its primary limitation: high false-positive rates in rule-based detection. We propose a hybrid approach that integrates machine learning (ML) techniques—specifically, Random Forest (RF) and DBSCAN—into Wazuh’s detection pipeline to improve both accuracy and operational efficiency. Experimental results show that RF achieves 97.2% accuracy, while DBSCAN yields 91.06% accuracy with a false-positive rate of 0.0821, significantly improving alert quality. Real-time deployment requirements are rigorously evaluated, with all models maintaining end-to-end processing latencies below 100 milliseconds and 95% of events processed within 500 milliseconds. Scalability testing confirms linear performance up to 500 events per second, with an average processing latency of 45 milliseconds under typical SOC workloads. This integration demonstrates a practical, resource-efficient solution for enhancing real-time threat detection in modern cybersecurity environments.

The escalating sophistication of cyber threats necessitates advanced threat detection in Security Operation Centers (SOCs). This study aims to enhance the capabilities of Wazuh, an open-source Security Information and Event Management (SIEM) system, by addressing its primary limitation: high false positive rates in rule-based detection. We propose integrating machine learning (ML) to improve detection accuracy and operational efficiency. The approach involves training and evaluating ML models—Random Forest (RF), Support Vector Machine (SVM), K-Nearest Neighbors (KNN), Logistic Regression, and Gaussian Naive Bayes—alongside clustering algorithms (DBSCAN, K-means, Isolation Forest) using 10-fold cross-validation. Results demonstrate that RF achieved the highest performance with an accuracy of 0.972, precision of 0.982, recall of 0.975, and F1-Score of 0.978, while DBSCAN excelled in clustering with a 91.06% accuracy and 0.0821 false positive rate. This integration significantly reduced false positives, enhancing alert management and enabling efficient real-time threat detection. The study contributes to cybersecurity by demonstrating that ML integration with Wazuh markedly improves threat detection, reduces operational overhead in SOCs, and establishes a more adaptive security framework.