Why You Should Train Your SOC Like a Triathlete

Using a swim/bike/run triathlon metaphor, the article argues that SOC effectiveness is limited by data quality: improve coverage and retention (target ~90–95% coverage and 6–12 months of searchable data), standardize and cross-link definitions across network, endpoint, threat intelligence, and identity sources, and treat logs as an investigation-ready product. It advises automating high-volume, well-understood workflows first, then applying AI to augment investigation of outliers, and tracking metrics such as reductions in "cause unknown" and containment outcomes to measure defensive fitness.