Next Generation Security Operation Centres

NG-SOC envisages the establishment of a network of AI-enabled SOCs, within and across EU member states, that can actively communicate, cooperate, share information and respond to cyber threats effectively. To this end, NG-SOC will architect and deploy a collaborative, interoperable SOC service that holistically combines capacities for shared situational awareness, coordinated incident handling/response, and joint preparedness, while also benefiting from the interplay between them, ultimately enhancing national cybersecurity capabilities and cross-border collaboration, in line with current and upcoming regulatory requirements. The envisioned capacity-focused SOC service will incorporate: a) an interoperable CTI toolbox able to exchange and operationalise, machine- and human-readable CTI from multiple sources (CERT-EU, NIS Cooperation Group, EU CyCLONe), b) incident response capacities in line with good practices established by the CSIRTs Network and CERT-EU, enabling interaction between established SOCs, diverse EU actors and layers and connected third parties, c) dedicated training sessions and educational programmes in digital infrastructure security, tailored to identified training goals and objectives and delivered via different training delivery methods. d) AI-enhanced technologies maximising the capability of the proposed solution to effectively predict, detect and analyse upcoming threats. NG-SOC will combine and deploy several different technologies, tools and techniques concurrently and in unison. In support of an EU-wide collaborative, interoperable SOC service and ecosystem, NG-SOC will adopt an open-standards-based implementation strategy, enabling the exchange of information, insights, analytics, and responses within and across national borders, while mitigating the vendor/software lock-in situation.The proposed solution will be validated in 3 diverse sectors (banking, energy, CSIRT training) over a set of use-cases carefully selected by the end-users.