{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,22]],"date-time":"2026-10-22T00:11:54Z","timestamp":1792627914494,"version":"4.5.0"},"publisher-location":"New York, NY, USA","reference-count":55,"publisher":"ACM","license":[{"start":{"date-parts":[[2019,11,6]],"date-time":"2019-11-06T00:00:00Z","timestamp":1572998400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100007297","name":"Office of Naval Research","doi-asserted-by":"publisher","award":["KK1847"],"award-info":[{"award-number":["KK1847"]}],"id":[{"id":"10.13039\/100007297","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000185","name":"Defense Advanced Research Projects Agency","doi-asserted-by":"publisher","award":["HR001118C0060"],"award-info":[{"award-number":["HR001118C0060"]}],"id":[{"id":"10.13039\/100000185","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["1703644"],"award-info":[{"award-number":["1703644"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000183","name":"Army Research Office","doi-asserted-by":"publisher","award":["92675527"],"award-info":[{"award-number":["92675527"]}],"id":[{"id":"10.13039\/100000183","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2019,11,6]]},"DOI":"10.1145\/3319535.3354239","type":"proceedings-article","created":{"date-parts":[[2019,11,7]],"date-time":"2019-11-07T13:08:32Z","timestamp":1573132112000},"page":"1955-1970","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":103,"title":["Matched and Mismatched SOCs"],"prefix":"10.1145","author":[{"given":"Faris Bugra","family":"Kokulu","sequence":"first","affiliation":[{"name":"Arizona State University, Tempe, AZ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ananta","family":"Soneji","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, AZ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tiffany","family":"Bao","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, AZ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yan","family":"Shoshitaishvili","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, AZ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ziming","family":"Zhao","sequence":"additional","affiliation":[{"name":"Rochester Institute of Technology, Rochester, NY, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Adam","family":"Doup\u00e9","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, AZ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Gail-Joon","family":"Ahn","sequence":"additional","affiliation":[{"name":"Arizona State University and Samsung Research, Tempe, AZ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2019,11,6]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"U.S Army. Persistent cyber training environment (pcte). https:\/\/www.peostri.army.mil\/persistent-cyber-training-environment-pcte. Accessed: 2019-04--16.  U.S Army. Persistent cyber training environment (pcte). https:\/\/www.peostri.army.mil\/persistent-cyber-training-environment-pcte. Accessed: 2019-04--16."},{"key":"e_1_3_2_2_2_1","volume-title":"Michael Goldsmith, and Sadie Creese. Sonification in security operations centres: what do security practitioners think?","author":"Axon Louise","year":"2018"},{"key":"e_1_3_2_2_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/1031607.1031672"},{"key":"e_1_3_2_2_4_1","volume-title":"Social research methods: Qualitative and quantitative approaches","author":"Russell Bernard H","year":"2012"},{"key":"e_1_3_2_2_5_1","first-page":"35","volume-title":"The operational role of security information and event management systems","author":"Bhatt Sandeep","year":"2014"},{"key":"e_1_3_2_2_6_1","volume-title":"Snowball sampling: Problems and techniques of chain referral sampling. Sociological methods & research, 10(2):141--163","author":"Biernacki Patrick","year":"1981"},{"key":"e_1_3_2_2_7_1","volume-title":"Here's what the military's 'flight simulator' for cyberwarfare might look like. https:\/\/www.cyberscoop.com\/cyber-command-training-raytheon-lockheed-martin-pcte","author":"Bing Chris","year":"2018"},{"key":"e_1_3_2_2_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/1280680.1280693"},{"key":"e_1_3_2_2_9_1","volume-title":"Learning science: Computer games, simulations, and education workshop sponsored by the National Academy of Sciences","author":"Clark Douglas","year":"2009"},{"key":"e_1_3_2_2_10_1","doi-asserted-by":"publisher","DOI":"10.1177\/154193120504900304"},{"key":"e_1_3_2_2_11_1","doi-asserted-by":"publisher","DOI":"10.5555\/1149126.1149144"},{"key":"e_1_3_2_2_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243794"},{"key":"e_1_3_2_2_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/2076732.2076740"},{"key":"e_1_3_2_2_14_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-39483-1_43"},{"key":"e_1_3_2_2_15_1","unstructured":"Inc. FireEye. Cyber security experts & solution providers. https:\/\/www.fireeye.com. Accessed: 2019-08--13.  Inc. FireEye. Cyber security experts & solution providers. https:\/\/www.fireeye.com. Accessed: 2019-08--13."},{"key":"e_1_3_2_2_16_1","unstructured":"Micro Focus. Intelligent security operations solutions: It secops software tools. https:\/\/www.microfocus.com\/en-us\/solutions\/security-operations. Accessed: 2019-08--13.  Micro Focus. Intelligent security operations solutions: It secops software tools. https:\/\/www.microfocus.com\/en-us\/solutions\/security-operations. Accessed: 2019-08--13."},{"key":"e_1_3_2_2_17_1","volume-title":"Are we there yet? data saturation in qualitative research. The qualitative report, 20(9):1408--1416","author":"Fusch Patricia I","year":"2015"},{"key":"e_1_3_2_2_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2018.2865029"},{"key":"e_1_3_2_2_19_1","first-page":"1","volume-title":"Proceedings of the 2007 Symposium on Computer Human Interaction for the Management of Information Technology","author":"Haber Eben M"},{"key":"e_1_3_2_2_20_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"e_1_3_2_2_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.38"},{"key":"e_1_3_2_2_22_1","volume-title":"Security operation center (soc). https:\/\/www.nascio.org\/portals\/0\/awards\/nominations2018\/2018\/NASCIO-IL-2018-Cybersecurity-SOC.pdf","author":"Hill C.","year":"2017"},{"key":"e_1_3_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.compedu.2012.05.009"},{"key":"e_1_3_2_2_24_1","unstructured":"McAfee Inc. Device-to-cloud cybersecurity. https:\/\/www.mcafee.com\/en-us\/index.html. Accessed: 2019-08--13.  McAfee Inc. Device-to-cloud cybersecurity. https:\/\/www.mcafee.com\/en-us\/index.html. Accessed: 2019-08--13."},{"key":"e_1_3_2_2_25_1","unstructured":"McAfee Inc. What is an advanced persistent threat (apt)? https:\/\/www.mcafee.com\/enterprise\/en-us\/products\/network-security-platform.html. Accessed: 2019-08--13.  McAfee Inc. What is an advanced persistent threat (apt)? https:\/\/www.mcafee.com\/enterprise\/en-us\/products\/network-security-platform.html. Accessed: 2019-08--13."},{"key":"e_1_3_2_2_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2005.64"},{"key":"e_1_3_2_2_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/SACI.2018.8440963"},{"key":"e_1_3_2_2_28_1","volume-title":"Boeing's wannacry run-in is a reminder to patch your systems. https:\/\/www.pcmag.com\/news\/360164\/boeings-wannacry-run-in-is-a-reminder-to-patch-your-systems","author":"Kan M.","year":"2018"},{"key":"e_1_3_2_2_29_1","volume-title":"Qualitative research methods for the social sciences","author":"Berg Bruce L","year":"2001"},{"key":"e_1_3_2_2_30_1","first-page":"159","volume-title":"The measurement of observer agreement for categorical data. biometrics","author":"Richard Landis J","year":"1977"},{"key":"e_1_3_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978315"},{"key":"e_1_3_2_2_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/CASON.2011.6085959"},{"key":"e_1_3_2_2_33_1","first-page":"282","volume-title":"First International Early Research Career Enhancement School on Biologically Inspired Cognitive Architectures","author":"Miloslavskaya Natalia","year":"2017"},{"key":"e_1_3_2_2_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/997150.997156"},{"key":"e_1_3_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10648-007-9048-1"},{"key":"e_1_3_2_2_36_1","first-page":"1","volume-title":"Data Analytics and Assessment (CyberSA), 2015 International Conference on","author":"Onwubiko Cyril","year":"2015"},{"issue":"1","key":"e_1_3_2_2_37_1","first-page":"11","article-title":"Security breach at target","volume":"29","author":"Plachkinova Miloslava","year":"2018","journal-title":"Journal of Information Systems Education"},{"key":"e_1_3_2_2_38_1","unstructured":"Inc. Proofpoint. Cyber security solutions from proofpoint. https:\/\/www.proofpoint.com\/us. Accessed: 2019-08--13.  Inc. Proofpoint. Cyber security solutions from proofpoint. https:\/\/www.proofpoint.com\/us. Accessed: 2019-08--13."},{"key":"e_1_3_2_2_39_1","unstructured":"D. Ritchey. Creating the gsoc: 4 leading examples of successful security operations centers. https:\/\/www.securitymagazine.com\/articles\/87849-creating-the-gsoc-4-leading-examples-of-successful-security-operations-centers 2017.  D. Ritchey. Creating the gsoc: 4 leading examples of successful security operations centers. https:\/\/www.securitymagazine.com\/articles\/87849-creating-the-gsoc-4-leading-examples-of-successful-security-operations-centers 2017."},{"key":"e_1_3_2_2_40_1","volume-title":"Why do data breaches happen? https:\/\/www.marshall.usc.edu\/blog\/why-do-data-breaches-happen","year":"2017"},{"key":"e_1_3_2_2_41_1","first-page":"621","volume-title":"27th $$USENIX$$ Security Symposium ($$USENIX$$ Security 18)","author":"Stevens Rock","year":"2018"},{"key":"e_1_3_2_2_42_1","volume-title":"Basics of qualitative research: Procedures and techniques for developing grounded theory","author":"Strauss Anselm","year":"1998"},{"key":"e_1_3_2_2_43_1","first-page":"347","volume-title":"Eleventh Symposium On Usable Privacy and Security ($$SOUPS$$ 2015","author":"Sundaramurthy Sathya Chandran","year":"2015"},{"key":"e_1_3_2_2_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/2663887.2663904"},{"key":"e_1_3_2_2_45_1","volume-title":"Proc. 12th Symp. Usable Privacy and Security","author":"Sundaramurthy Sathya Chandran","year":"2016"},{"key":"e_1_3_2_2_46_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2014.84"},{"key":"e_1_3_2_2_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/MIC.2017.265103212"},{"key":"e_1_3_2_2_48_1","unstructured":"Splunk Technology. Siem aiops application management log management machine learning and compliance. https:\/\/www.splunk.com\/. Accessed: 2019-08--13.  Splunk Technology. Siem aiops application management log management machine learning and compliance. https:\/\/www.splunk.com\/. Accessed: 2019-08--13."},{"key":"e_1_3_2_2_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/1358628.1358931"},{"key":"e_1_3_2_2_50_1","doi-asserted-by":"publisher","DOI":"10.1108\/09685220910944722"},{"key":"e_1_3_2_2_51_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijhcs.2009.03.002"},{"key":"e_1_3_2_2_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/2523649.2523670"},{"key":"e_1_3_2_2_53_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCSN.2011.6013727"},{"key":"e_1_3_2_2_54_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2018.02.011"},{"key":"e_1_3_2_2_55_1","volume-title":"MITRE Corporate Communications and Public Affairs. Appendices","author":"Zimmerman Carson","year":"2014"}],"event":{"name":"CCS '19: 2019 ACM SIGSAC Conference on Computer and Communications Security","location":"London United Kingdom","acronym":"CCS '19","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3319535.3354239","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3319535.3354239","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3319535.3354239","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T23:24:03Z","timestamp":1750202643000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3319535.3354239"}},"subtitle":["A Qualitative Study on Security Operations Center Issues"],"short-title":[],"issued":{"date-parts":[[2019,11,6]]},"references-count":55,"alternative-id":["10.1145\/3319535.3354239","10.1145\/3319535"],"URL":"https:\/\/doi.org\/10.1145\/3319535.3354239","relation":{},"subject":[],"published":{"date-parts":[[2019,11,6]]},"assertion":[{"value":"2019-11-06","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}