SOC Operations / Review incoming alerts and correlate users, hosts, IPs, processes, and related events. Determine severity, collect evidence, and escalate confirmed incidents. · size 20 · threshold 4 · max attempts 3