Where the evidence lives
A SOC watches many data sources: packet captures (PCAP), NetFlow (who talked to whom, how much), firewall and IDS/IPS logs, proxy/DNS logs, and endpoint/auth logs. No single source tells the whole story - you correlate them, which is why synchronized time (NTP) matters so much.
The 5-tuple and reading a flow
Every network conversation is identified by a 5-tuple: source IP, destination IP, source port, destination port, and protocol. Pulling the 5-tuple out of a log or capture is the first move in almost any investigation - it tells you who, to where, and what service.
Common attack patterns
Recognize the shapes: port/host scanning (one source touching many ports/hosts), brute force (many failed logins to one service), DoS/DDoS (overwhelming traffic), MITM/ARP spoofing (intercepting a conversation), DNS abuse and tunnelling (data smuggled over DNS), and C2 beaconing (an infected host phoning home on a regular interval).
SOC triage and incident response
Triage separates true positives from false positives and ranks by severity, impact and scope. The incident response lifecycle is: preparation, detection & analysis, containment, eradication & recovery, and lessons learned. Good triage preserves evidence (don't tamper) and contains the threat without tipping off the attacker prematurely.