---
title: "Purpose"
source: Open Source SOC Documentation
source_url: https://github.com/madirish/ossocdocs
licence: MIT
domain: engineering
subdomain: soc-docs
date_added: 2026-04-25
---

## Purpose
This policy establishes guidelines for the identification, monitoring, and management of known hacking tools within the organization’s environment. It aims to ensure that the SOC maintains an updated inventory of known malicious tools and dual-use tools, provides proper training to its analysts, and coordinates with both the Cyber Threat Intelligence (CTI) team and the Red Team to validate detection mechanisms and maintain a secure operational environment.
## Scope
This policy applies to all SOC personnel, including SOC Analysts, the Cyber Threat Intelligence (CTI) team, the Red Team, and IT teams responsible for managing and monitoring tool installations. It covers all known hacking tools that represent a heightened risk to the environment, whether they are explicitly malicious (e.g., Mimikatz, Responder, Metasploit, Cobalt Strike, etc.) or dual-use tools (e.g., Wireshark, nmap, Bloodhound, etc.) that may be used for legitimate purposes if properly authorized.
## Roles and Responsibilities

| Role       | Responsibility                                                                                                                                                                                                                                                                                                                   |
| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SOC Analst | Maintain and refer to the up-to-date list of known hacking tools.Receive and complete training on the names, nature, and purpose of each tool.Monitor for and detect any unauthorized usage or installation of these tools.Escalate alerts or suspicious activities to the Incident Response (IR) team as necessary. |
| CTI Team   | Provide expert input on the latest trends and emerging hacking tools.Assist the SOC in updating and validating the list of known hacking tools.Collaborate with the Red Team to refine detection rules and contextual intelligence.                                                                                      |
| Red Team   | Offer guidance on the operational characteristics and potential impact of known hacking tools.Coordinate with the SOC to test and ensure the reliability of detection rules and alerts.Advise on evolving tactics, techniques, and procedures (TTPs) related to tool usage.                                              |
| IT Teams   | Track the installation and legitimate use of dual-use tools.Maintain detailed records and documentation of all authorized installations.Ensure that any usage of dual-use tools is in line with approved administrative purposes.                                                                                        |

## Policy Statement
While it is acknowledged that it is impossible to compile a completely exhaustive list of hacking tools, the SOC is responsible for maintaining a dynamic and continually updated inventory of known hacking tools. This inventory shall include both explicitly malicious tools and dual-use tools that could pose a risk if misused. The list will be updated with input from the CTI team and the Red Team. All SOC personnel must understand and be trained on the significance of these tools and the procedures for responding to detections, with an emphasis on rapid escalation of confirmed or suspicious activity to the Incident Response team.
### Policy Elements

### 1. **Inventory Management:**

- The SOC shall maintain a centralized list of known hacking tools.
- This list will include tools that are clearly malicious and those that are dual-use.
- The inventory is subject to continuous review and updates based on new intelligence and threat landscape changes.

### 2. **Collaboration and Input:**

- The CTI team and Red Team shall provide ongoing assistance in updating the tool list and refining detection mechanisms.
- Regular review meetings will be held to incorporate new insights and validate current entries.

### 3.**Training and Awareness:**

- SOC Analysts must be trained on the identification, nature, and intended use of the listed tools.
- Training sessions will be conducted periodically to ensure familiarity with evolving toolsets and associated risks.

### 4. **Detection and Monitoring:**

- The SOC will deploy and maintain detection rules and alerts specifically tailored to the known hacking tools.
- The Red Team shall coordinate tests to ensure that these detection mechanisms are effective and reliable.

### 5. **Authorized Usage Documentation:**

- Any authorized installation or use of the listed tools must be documented in an open and transparent format.
- IT Teams are required to track the installation and usage of dual-use tools, maintaining detailed records to verify legitimate usage.

## Enforcement and Compliance
Unauthorized installation or usage of known hacking tools will be subject to immediate escalation and investigation.  Disciplinary action may be taken against personnel who knowingly violate this policy.  Compliance with this policy is mandatory for all affected departments and will be enforced through regular internal reviews and external audits as necessary.

## Policy Review
This policy will be reviewed annually by all employees to ensure its continued relevance and effectiveness. Feedback and suggestions for improvement are welcome and should be directed to the SOC Leadership.

Effective Date:

|Last Reviewed By     | Date    |
| --- | --- |
|     |     |
