  Modern security operations centers (SOCs) employ a variety of tools for
intrusion detection, prevention, and widespread log aggregation and analysis.
While research efforts are quickly proposing novel algorithms and technologies
for cyber security, access to actual security personnel, their data, and their
problems are necessarily limited by security concerns and time constraints. To
help bridge the gap between researchers and security centers, this paper
reports results of semi-structured interviews of 13 professionals from five
different SOCs including at least one large academic, research, and government
organization. The interviews focused on the current practices and future
desires of SOC operators about host-based data collection capabilities, what is
learned from the data, what tools are used, and how tools are evaluated.
Questions and the responses are organized and reported by topic. Then broader
themes are discussed. Forest-level takeaways from the interviews center on
problems stemming from size of data, correlation of heterogeneous but related
data sources, signal-to-noise ratio of data, and analysts' time.
