What tools are used in a SOC?

A security operations center (SOC) typically combines security information and event management (SIEM) for log collection, endpoint detection and response (EDR) for devices, intrusion detection systems for network traffic, and threat intelligence feeds for context. AI SOC platforms increasingly sit across these tools, correlating their data and automating triage and investigation.