New In-Person Event locations added! Choose your event, and join us for practical cyber security training.


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

Common and Best Practices for Security Operations Centers: Results of the 2019 SOC Survey

  • Wednesday, July 10, 2019 at 1:00 PM EDT (2019-07-10 17:00:00 UTC)
  • Christopher Crowley


  • Anomali
  • BTB Security
  • CYBERBIT Commercial Solutions
  • DFLabs
  • ExtraHop
  • Siemplify
  • ThreatConnect
  • CyberProof

You can now attend the webcast using your mobile device!



The 2019 SANS Security Operations Center (SOC) Survey is focused on providing objective data to security leaders who are looking to establish a SOC or optimize an existing one. This webcast will capture common and best practices, provide defendable metrics that can be used to justify SOC resources to management, and highlight the key areas that SOC managers should prioritize to increase the effectiveness and efficiency of security operations.

Attendees at this webcast will learn:

  • What types of SOC infrastructures are used most frequently
  • How SOCs interact with network operations centers and incident response teams
  • What activities typically define a SOC and how many of them are outsourced
  • Which SOC-related technologies organizations are most satisfied with
  • How organizations use metrics to evaluate SOC performance
  • What challenges inhibit integration and utilization of a centralized SOC model

Register for this webcast and be among the first to receive the associated whitepaper written by SOC expert and SANS Senior Instructor Chris Crowley, with advice from SANS Director of Emerging Technology John Pescatore.

Click here to register for our panel discussion webcast on July 11 at 1:00 PM to join survey author Chris Crowley and representatives from ExtraHop, Siemplify and ThreatConnect as they explore key themes of this survey.

View the associated whitepaper here.

Speaker Bio

Christopher Crowley

Christopher Crowley, a senior SANS instructor and course author for SANS courses in Managing Security Operations and MGT535 Incident Response Team Management, holds multiple certifications. He received the SANS 2009 Local Mentor of the Year award for excellence in providing mentor classes to his local community. Chris is a consultant based in Washington, D.C., who has more than 15 years of experience in managing and securing networks. His areas of expertise include network and mobile penetration testing, mobile device deployments, security operations, incident response and forensic analysis.

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.