What SOC leaves behind: The evidence DFIR needs

Every decision a SOC analyst makes during triage can either preserve or destroys forensic value and most don't realise it.

This talk draws on direct experience working across both security operations and digital forensics and incident response (DFIR) to explore a problem that rarely gets discussed openly: the evidence gap created between detection and investigation. When an incident escalates from the SOC to a DFIR team, critical artefacts are often already gone not because of attacker anti-forensics, but because of how the initial response was handled.

This session will cover three core technical areas:​

1. Log sources SOC doesn't preserve that DFIR needs:​Most SIEM configurations are built for detection, not investigation. Analysts are trained to chase alerts, not to think about what an investigator will need 48 hours later. I’ll look at specific log sources that are routinely missing, misconfigured or insufficiently retained at the point DFIR engages and what that means for reconstruction of attacker activity.
2. Tooling gaps between the SIEM and the forensic toolchain:​ SOC and DFIR teams operate fundamentally different toolsets. Where a SOC analyst works with a SIEM, a DFIR investigator relies on purpose-built forensic tools - such as Velociraptor for live endpoint interrogation at scale and forensic imaging platforms. While EDR solutions increasingly bridge this gap and can collect rich endpoint telemetry, they don't always capture what a forensic investigator actually needs in the format they need it. I’ll explore where these toolchains diverge, why that creates blind spots and what each side can do to reduce the gap.
3. What DFIR actually needs at handover:​The handover moment is where investigations can be won or lost. I’ll break down what information, context and preserved data DFIR teams need from SOC at the point of escalation and how SOC teams can build this into their playbooks.

Ryan hopes that attendees will leave with an understanding of how their triage and detection decisions directly impact investigative outcomes, practical knowledge of where the forensic toolchain begins and why it matters and concrete steps they can take to improve evidence preservation before DFIR ever gets called.

Ryan aims for the talk to be grounded in real-world investigative experience and is aimed primarily at SOC analysts, detection engineers and IR practitioners who want to understand both sides of the incident lifecycle.