This covers the full arc practitioners keep asking about: what tools a modern SOC actually needs, the real steps to build one from scratch, what automation genuinely delivers versus marketing claims, where AI fits without replacing analysts, and how automation ties into SOC 2 compliance and security questionnaire response. Structured for direct reference, not a narrative read. **What tools and technologies are commonly used in a SOC** A modern SOC tech stack breaks into a handful of core categories, and understanding what each one actually does (rather than treating them as interchangeable) matters more than the specific vendor you pick: * **SIEM (Security Information and Event Management)**: the foundation. Ingests logs from firewalls, endpoints, identity providers, cloud platforms, and applications, normalizes them, and applies correlation rules to generate alerts. Common choices include Splunk, Microsoft Sentinel, IBM QRadar, and Elastic Security. * **EDR/XDR (Endpoint Detection and Response / Extended Detection and Response)**: visibility into endpoint activity specifically, watching for malicious behavior on laptops, servers, and increasingly cloud workloads. XDR extends that visibility across endpoint, network, and cloud telemetry into a single correlated view. * **SOAR (Security Orchestration, Automation, and Response)**: automates repetitive response workflows. When a SIEM fires an alert for a known phishing pattern, SOAR can enrich the indicator, check it against threat intelligence, block the sender domain, and open a ticket without a human having to do each step manually. * **TIP (Threat Intelligence Platform)**: aggregates threat data from free feeds, paid subscriptions, and private intelligence sharing groups, then helps analysts figure out which of it actually matters to their specific environment. * **Case management and investigation platforms**:...