How Into SOC?

Alright Lainon. I'm in a bit of a pickle. I've been forced into a position where I'm going to have to start up a SOC. I've got a lot of legwork ahead of me, I just want to know what direction to go before I start marching. I'm not looking for a handout, just point and I'll do the heavy lifting from there. To give a little background, it's going to be purely based on network data feeds, nothing host-based (at least starting out, maybe some day I can convince PHB that endpoints are just as important...). I'm hungry to learn, just need to know where to start. Should I pursue something like GCIA/GCIH? GMON? Screw SANS and go for something else entirely?

just fuarrrk around with security onion

Whether you will need or want any certs or SANS is probably best determined on your knowledge and familiarity with the data you will be ingesting. If you already have a good understanding of what threats look like, there may not be a need for anything. In the case that you do not, of your list, GCIA probably is the one to most strongly consider. GMON second. What you seem to be doing now is correct. Take a step back and look at what you can do with what you have right now. Take a look at what you want to have (e.g. endpoint solutions). With your budget in mind, start thinking about how much it will cost you (time and money) to put together certain tools together. See if there is anywhere that you can design a solution where it will be beneficial in demonstrating the usefulness of the more expensive things that you want that you can't have. Honestly, >>5717 , despite it's brevity, is not the worst piece of advice. Network level, you are probably going to want to get some Bro going if you don't have it already. The other tools that you choose are based on the scope that you determine. Do not underestimate the power of scripting your way to victory. There is a lot that you can do with just some python scripts. I am firm believer in the fact that python scripts (or insert your favorite scripting language here) in the hands of someone who knows what they are doing are much more useful than any enterprise SIEM in the hands of an idiot who has no idea what or where to be looking. It won't be pretty and it make take time, but it is an acceptable option sometimes depending on your budget.

learn how to get up an NIDS and read logs. Put HIDS on endpoints. this defcon video might help, https://www.youtube.com/watch?v=ZlOMmycpusw