Forthcoming from Apress
Security Operations Monitoring
A Practical Guide to SIEM, SOC Workflows, and Operational Excellence
By Christopher Jordan
Co-founder, Fluency Security
Publication
About the book
Prevention will eventually fail. What happens next is security operations.
Every organization eventually learns that the control meant to stop the attack didn’t. Security operations is the discipline that notices and brings the organization back to a secure state. Yet most guidance still treats the SOC as a staffing chart and the SIEM as a place to put logs.
This book treats security monitoring as what it is: a series of decisions. What to collect. Who owns what. How an analyst reaches a defensible conclusion from data that can never fully answer the question. And what each of those choices costs.
Christopher Jordan has spent decades building and running some of the largest security operations centers in government. He works from the origin of the SIEM through the structure of a functioning SOC, the workflows that carry a case from alert to closure, and the data lifecycle that determines whether any of it is affordable. Vendor-neutral throughout.
From alert to closure
What you will learn
Tier 1 validation through Tier 4 hot wash, and the handoffs between them
Validation as a zero-knowledge problem: analysts almost never observe intent, so confidence is built from indirect evidence — a statistical truth, not a certainty
The security data lifecycle as a routing problem — why treating all telemetry equally is what makes a SIEM expensive
The three detection paradigms — signature, behavioral, reputation — and how to write rules a team will actually trust
Network traffic analysis from the ground up: baselines, inbound and outbound exposure, split tunneling, beaconing, fan-in and fan-out
Where this is heading — streaming analytics, pipelines, federated lakehouses — and a direct warning about "vibe detection"
Who this book is for
For security practitioners, operations leads, and the managers responsible for building or improving a monitoring function.
The connection to Fluency
The operating experience behind the platform.
Christopher Jordan co-founded Fluency Security after years spent building and running security operations. The book shares that experience in a vendor-neutral guide. At Fluency, the same operational questions guide how we build The Unbounded SOC: how to make evidence useful, move a case forward, and keep the data pipeline affordable.
Evidence before conclusions
Fluency connects investigation results to the evidence behind them, so analysts and leaders can assess the reasoning and decide what to do next.
Workflows with an owner
Cases, investigation context, and guided workflows help teams carry work through validation, response, and review.
Data choices with a cost
Collection, enrichment, and routing decisions shape both analytical value and the cost of operating the SIEM.
About the author
Christopher Jordan
Chris Jordan’s career spans Army CERT, government security operations, threat intelligence, and Fluency Security. His work brings the analyst’s decisions, the architect’s constraints, and the manager’s operating responsibilities into the same conversation.
Meet the Fluency teamApress · November 29, 2026
Build a monitoring function that works.
Start with the decisions behind the tools.