Which of the following are critical when analyzing and managing events and incidents in a SOC? (Choose two answers)

Effective SOC operations rely heavily on the accurate detection of threats to ensure that genuine security incidents are addressed promptly and effectively. Equally critical is the rapid identification of false positives. Quickly filtering out benign anomalies helps prevent alert fatigue among security analysts, ensuring that valuable SOC resources and time are focused on actual malicious activities rather than chasing non-threats.

B. Escalating every alert causes severe alert fatigue and wastes critical Tier 2/3 analyst resources on low-priority or false-positive events.

D. While system maintenance is necessary for IT infrastructure, periodic downtime is not a critical operational practice for the active analysis and management of security events.

1. Fortinet NSE 7 - SOC AR 7.2 Courseware, Module: SOC Operations and Incident Management.

2. Fortinet, "FortiAnalyzer 7.2 Administration Guide," Section: FortiSoC Overview.