SÜREKLİ DENETİMİN SOC OPERASYONLARINA ENTEGRASYONU: DENETİM ODAKLI TEHDİT İZLEME MODELİ

Öz

Makalede, gerçek zamanlı Güvenlik Operasyon Merkezi (SOC) log analizlerini sürekli denetim süreçleriyle bütünleştiren ve operasyonel tehdit izleme faaliyetleri ile iç denetim fonksiyonu arasındaki teknik boşluğu kapatmayı amaçlayan bir model geliştirilmektedir. Günümüzde SOC birimleri, kimlik doğrulama kayıtları, ağ trafiği ve uç nokta aktiviteleri gibi yüksek hacimli veriler üretmesine rağmen, bu veriler iç denetim faaliyetlerinde sistematik olarak kullanılmamaktadır. Geliştirilen yapı, gerçek zamanlı log akışlarını kontrol etkinliğinin değerlendirilmesi, risk göstergelerinin belirlenmesi ve sapma analizlerinin yürütülmesi açısından denetim kanıtı olarak ele almaktadır. Bu kapsamda SOC kuralları, denetim testleri ve risk senaryoları bütünleşik bir yapı içerisinde ilişkilendirilmektedir. Yöntemsel olarak çalışma, Tasarım Bilimi Araştırması (Design Science Research - DSR) yaklaşımına dayanmaktadır. Modelin uygulanabilirliğini değerlendirmek amacıyla sanallaştırılmış üç sunuculu bir SOC ortamı tasarlanmış ve uygulanmıştır. Model, mesai saatleri dışında gerçekleştirilen ayrıcalıklı erişim faaliyetlerini temel alan bir kavram kanıtlama (proof-of-concept) senaryosu üzerinden test edilmiştir. Elde edilen bulgular, log seviyesindeki görünürlüğün iç denetimdeki kör noktaları azalttığını, kontrol tasarımını güçlendirdiğini ve özellikle savunma sanayi gibi yüksek güvenlik gereksinimi bulunan sektörlerde proaktif bir yönetişim yaklaşımını desteklediğini göstermektedir.

Anahtar Kelimeler

• Sürekli Denetim
• SOC
• Log Analitiği
• İç Denetim
• Siber Güvenlik

INTEGRATING CONTINUOUS AUDITING INTO SOC OPERATIONS: AN AUDIT-DRIVEN THREAT MONITORING FRAMEWORK

Öz

This article develops a model that integrates real-time Security Operations Center (SOC) log analytics with continuous auditing processes and aims to bridge the technical gap between operational threat monitoring activities and the internal audit function. Although SOC units generate high volumes of data, including authentication records, network traffic, and endpoint activities, these data sources are not systematically used in internal audit activities. The developed structure treats real-time log streams as audit evidence for assessing control effectiveness, identifying risk indicators, and analyzing deviations. Within this scope, SOC rules, audit tests, and risk scenarios are linked within an integrated structure. Methodologically, the study is based on the Design Science Research (DSR) approach. To evaluate the feasibility of the model, a virtualized three-host SOC environment was designed and implemented. The model was tested through a proof-of-concept scenario based on privileged access activities occurring outside business hours. The findings indicate that log-level visibility reduces blind spots in internal audit, strengthens control design, and supports a proactive governance approach, particularly in sectors with high security requirements such as the defense industry.

Anahtar Kelimeler

• Continuous Auditing
• SOC
• Log Analytics
• İnternal Audit
• Cybersecurity

Teşekkür

Doç. Dr. Onur CERAN

Kaynakça

1. Alles, M. G., Kogan, A., & Vasarhelyi, M. A. (2008). Putting continuous auditing theory into practice: Lessons from two pilot implementations. Journal of Information Systems, 22(2), 195–214. https://doi.org/10.2308/jis.2008.22.2.195
2. Alles, M., & Vasarhelyi, M. A. (2004). Continuous assurance and auditing: A prototype implementation. International Journal of Accounting Information Systems, 5(2), 143–168.
3. Antunes, M. G., Maximiano, M., & Gomes, D. (2022). A client-centered information security and cybersecurity auditing framework. Applied Sciences, 12(9), 4102.
4. Behl, A., & Behl, K. (2017). Cyberwar: The next threat to national security and what to do about it. Oxford University Press.
5. Behloul, A., Ait Chellouche, M., & Lakhoua, N. (2015). Audit policy compliance and log analysis for information systems security. In Proceedings of the 2015 IEEE Security and Privacy Workshops (SPW) (pp. 183–188). IEEE. https://ieeexplore.ieee.org/document/7166125
6. Briliyant, A. S., Ramadhani, N., & Nugraha, A. A. (2025). Beyond automation gap: A survey on continuous compliance audit for IoT security. SSRN. https://doi.org/10.2139/ssrn.xxxxx
7. Chamkar, A., Maleh, Y., & Gherabi, N. (2024). Security operations centers: Use case best practices, coverage, and gap analysis based on MITRE ATT&CK. Journal of Cybersecurity and Privacy, 4(4), 36–52.
8. Chandola, V., Banerjee, A., & Kumar, V. (2009). Anomaly detection: A survey. ACM Computing Surveys, 41(3).

9. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2013). Internal control-Integrated framework.
10. Danish, S. (2025). Enhancing cyber security through predictive analytics: Real-time threat detection and response. International Journal of Advanced Computer Science and Applications, 16(8), 25–37.
11. Fort Worth Internal Audit Department. (2021). Cybersecurity audit report.
12. Gregor, S., & Hevner, A. R. (2013). Positioning and presenting design science research for maximum impact. MIS Quarterly, 37(2), 337–355.
13. Hevner, A., March, S., Park, J., & Ram, S. (2004). Design science in information systems research. MIS Quarterly.
14. Huang, M., et al. (2024). SAGA: A synthetic audit log generator for anomaly detection in cybersecurity. arXiv. https://arxiv.org/abs/2411.13138
15. Institute of Internal Auditors (IIA). (2017). Global technology audit guide (GTAG) 4: Management of IT auditing.
16. Institute of Internal Auditors. (2020). The IIA’s Three Lines Model: An update of the Three Lines of Defense.
17. Institute of Internal Auditors.
18. Islam, M. A., et al. (2018). Factors associated with cybersecurity audit by internal audit function: An international study. SSRN. https://doi.org/10.2139/ssrn.xxxxx
19. Kent, K., & Souppaya, M. (2006). Guide to computer security log management (NIST SP 800-92). National Institute of Standards and Technology.
20. Kestane, A. (2021). Siber güvenliğin etkinleştirilmesinde sürekli süreç denetimi modeli. Yönetim Bilimleri Dergisi, 19(40), 245–263.
21. Kuzu, A. (2013). Tasarım tabanlı araştırma yaklaşımı ve eğitim alanındaki uygulamaları. Akademik Bilişim, Eğitim ve Sosyal Bilimler Dergisi. https://dergipark.org.tr/tr/pub/ajesi/article/18728
22. Le, T., et al. (2025). Cybersecurity analytics for the enterprise environment: A systematic literature review. Electronics, 14(11), 2252.
23. MITRE Corporation. (2023). MITRE ATT&CK framework: Techniques, tactics, and adversary behaviors. https://attack.mitre.org
24. Moeller, R. R. (2016). Executive’s guide to IT governance. John Wiley & Sons.
25. National Institute of Standards and Technology (NIST). (2018). *Framework for improving critical infrastructure cybersecurity. https://www.nist.gov
26. Peffers, K., Tuunanen, T., Rothenberger, M. A., & Chatterjee, S. (2007). A design science research methodology for information systems research. Journal of Management Information Systems, 24(3), 45–77. https://doi.org/10.2753/MIS0742-1222240302
27. Reddy, K. (2024). Real-time predictive log analytics: A scalable Java-driven pipeline for dynamic insights in modern data environments. JNAO Journal.
28. Tharwat, H., Hafez, S. T., Elgohary, I. E., & Hassanein, A. (2025). A decade of cybersecurity research in internal auditing: Bibliometric mapping and future research agenda.
29. Torkura, K. A., et al. (2021). Continuous auditing and threat detection in multi-cloud infrastructure. Computers & Security.
30. Vasarhelyi, M. A., & Halper, F. B. (1991). The continuous audit of online systems. Auditing: A Journal of Practice & Theory, 10(1), 110–125.
31. Vasarhelyi, M. A., Alles, M. G., & Kogan, A. (2004). Principles of analytic monitoring for continuous assurance. Journal of Emerging Technologies in Accounting, 1(1), 1–21. https://doi.org/10.2308/jeta.2004.1.1.1
32. Vasarhelyi, M. A., Alles, M., & Williams, K. T. (2010). Continuous assurance for the now economy. The Institute of Chartered Accountants in Australia.
33. Vasarhelyi, M. A., Alles, M. G., & Kogan, A. (2010). Continuous auditing: Theory and application. Emerald Group Publishing.