Press Attack. Close Alert. Repeat.
Why working in a SOC feels like walking through a Dragon Quest, and how to stop fighting slimes all day.
If you played old JRPGs, think about the ancient ones, you know this feeling. You take three steps. The screen flashes. Battle music starts. It’s a slime. You kill it. You take two more steps. The screen flashes again. Another slime.
After twenty minutes, you are not playing the game anymore. You are just pressing “Attack” and thinking about dinner.
Welcome to the SOC.
Meet the Slimes
Most alerts are slimes. They are not dangerous, but they are always there.
A user enters the wrong password five times. (Caps Lock was on.) A tool checks a server. (It was our own tool, a vibe-coded one.) Someone opens a suspicious PDF. (It was the lunch menu. The food was the real threat.)
Each one is small. But each one still needs a decision: close, escalate, or investigate. And small decisions, repeated 300 times a day, are no longer small.
Grinding Is Not Leveling
In games, grinding makes you stronger. You fight many weak enemies, you get experience, and you level up.
In a SOC, it works the other way. Closing your 200th false positive does not make you a better analyst. It makes you a faster button-masher. Your brain learns one lesson: “This is probably nothing.”
And this is the dangerous part. Because one day, the battle music sounds the same, the enemy looks like a slime, but it’s not a slime.
It’s a valid login. Correct password. Normal working hours. Nothing loud, nothing strange. Just someone using an account that isn’t theirs. (MITRE calls this T1078, Valid Accounts. I call it “the slime with a boss health bar.”)
When you are tired, you press “Attack” and move on. The real enemy walks right past you.
How Games Fixed This (And How We Can Too)
Game designers noticed this problem a long time ago. Their solutions translate surprisingly well to security.
Get Serhan Eraslan’s stories in your inbox
Join Medium for free to get updates from this writer.
Lower the encounter rate. Newer games show fewer, more meaningful fights. In a SOC, this is called tuning. If a rule fires 500 times a week and nobody has ever found anything real, it’s not a rule. It’s background noise with a severity.
Use auto-battle for weak enemies. Many JRPGs let you auto-fight easy battles. This is exactly what SOAR is for. A playbook can check the IP, look up the user, compare the hash with threat intel, and close the obvious cases while you drink your coffee. Your attention is limited. Spend it on the fights that matter.
Keep a bestiary. Good games have an enemy book: weaknesses, behavior, where it appears. Good SOCs have this too. It’s called enrichment and documentation. When an alert arrives with context already attached, you don’t start every fight from zero.
Use save points. Shift handovers and case notes are save points. Without them, the next analyst starts the dungeon from the beginning and fights the same slimes you already killed.
A Small Warning About Auto-Battle
Auto-battle is great until it isn’t. If you set it up badly, your party walks into a boss fight and keeps using the wrong attack until everyone is dead.
Automation works the same way. If you automate a bad rule, you don’t fix it. You just make the mistake faster and with better logging. Before you automate a decision, make sure a human would make that same decision every time.
The Goal Is Not Zero Fights
You will never have a SOC with no alerts. That’s not the point. The point is to make sure that when the music changes, when something is really different, you still have the energy to notice.
So tune your encounter rate. Let the playbooks fight the slimes. And save your attention for the thing that looks harmless but has way too much HP.
Seron Out
;
Original illustrations created with ChatGPT. The Dragon Quest Slime image is credited separately above.
