Security Operations Centre

Security monitoring hub with real-time threat visibility, agent management, and investigation actions.

Overview

The Security Operations Centre (SOC) is a QuoxCORE plugin that provides a dedicated security monitoring view, separate from the infrastructure-focused NOC. It connects to Wazuh for SIEM data, displays security posture metrics, and exposes investigation actions for threat analysis and incident response.

SOC ships with every QuoxCORE instance. Wazuh integration requires a configured Wazuh deployment.

Tier: Free (core view) / Enterprise (advanced integrations)

Layout

The SOC uses a three-column layout mirroring the NOC pattern:

The left column shows available security tool integrations. Each card links to its dedicated view if the integration is configured. Cards for unconfigured tools display a lock icon and a brief description of what the integration provides.

Security Posture Card

The posture card is the primary status indicator at the top of the centre column. It aggregates data from Wazuh to display:

• Health percentage derived from the ratio of active agents to total enrolled agents
• Active agents currently reporting to Wazuh
• Disconnected agents that have stopped reporting
• Total agents enrolled in the Wazuh deployment
• High/Critical alerts count from the current threat feed

Colour Coding

The health percentage uses a traffic-light scheme:

No-Data States

The posture card handles three offline scenarios:

1. Connecting — Wazuh data has not arrived yet. Displays a loading indicator.
2. No agents enrolled — Wazuh is reachable but no agents are registered. Displays guidance to activate the Wazuh plugin and enrol agents.
3. Wazuh unreachable — The connection to Wazuh failed. Displays the error message returned by the client.

Wazuh SIEM Integration

SOC connects to Wazuh through the wazuhClient service. This provides:

Agent Management

The agent grid groups Wazuh agents by status:

• Active — agents currently reporting, shown with a green indicator
• Disconnected — agents that have stopped reporting, shown with a red indicator
• Never connected — agents enrolled but never seen, shown with a grey indicator

Each agent entry displays its name, ID, and current status. The grid updates on each data refresh cycle.

Threat Data

Wazuh alerts are displayed as a threat feed in the centre column. Alerts are colour-coded by severity:

Investigation Actions

The SOC provides eight investigation actions, each with a severity classification and confirmation requirement.

1. Threat Scan

Severity: Warning

Runs a comprehensive threat scan across all monitored systems. Reports suspicious activity, anomalous patterns, and active threats.

2. Firewall Status

Severity: Info

Checks firewall rules across the fleet and reports anomalies, misconfigurations, or rules that deviate from the expected baseline.

3. Auth Logs

Severity: Info

Analyses recent authentication failures and suspicious login attempts. Useful for detecting brute-force attacks or compromised credentials.

4. Incidents

Severity: Info

Lists open security incidents and active alerts. Provides a summary view of all unresolved security events requiring attention.

5. CVE Search

Severity: Info

Searches for recent critical CVEs affecting your infrastructure. Cross-references installed software versions against known vulnerability databases.

6. IDS Alerts

Severity: Info Requires: Suricata or Snort

Queries the intrusion detection system for recent alerts. This action is only available when an IDS backend is configured.

7. Vulnerability Scan

Severity: Warning Requires: Vulnerability scanner (OpenVAS/Nessus)

Runs a vulnerability assessment on key systems. Only available when a vulnerability scanning backend is configured.

8. Baseline Check

Severity: Info Requires: Baseline configuration

Compares the current system state against an established security baseline. Reports deviations and configuration drift.

Confirmation Flow

Every action requires explicit confirmation before execution. The confirmation dialog displays the action name, description, and severity level. Actions that require an unconfigured backend are disabled and display the required integration name.

All action results are available to CommanderQ for interpretation via the chat sidebar.

SOC Suite Plugins

The left column displays four security tool integrations:

Each plugin card uses a distinct accent colour for visual identification. Wazuh links to the dedicated Wazuh view; other plugins will link to their respective views once implemented.

Chat Sidebar

The right column hosts a security-focused chat sidebar connected to CommanderQ. This allows you to:

• Ask questions about the current security posture
• Request analysis of specific threats or alerts
• Send investigation action results to CommanderQ for interpretation
• Get recommendations for remediation steps

The chat sidebar maintains context about the SOC view, so CommanderQ understands that queries relate to security operations.

Security Model

SOC follows the same security principles as the NOC:

• No direct browser-to-host communication. All data flows through QuoxCORE and its configured integrations.
• Audit logging. Every investigation action is logged with the requesting user, action type, and timestamp.
• Confirmation required. No action executes without explicit user confirmation.

See Also

• NOC (Network Operations Centre) — Infrastructure monitoring counterpart
• Wazuh SIEM — Detailed Wazuh integration documentation
• Safety & Security — QuoxCORE security model
• DEFCON Levels — Threat response escalation levels