Radio Access Network is an industry term refer to everything that sits between the end-user device and the core network, its the part of the network owns the air interface. as shown below. RAN territory, it's converts radio waves into standardized data streams and signaling, manages every radio resources (channels, Power, Handover) and hand a clear traffic to the Core Network. As an Example, In GSM the RAN is the BSS (BTS + BSC); in UMTS it is the UTRAN (Node B + RNC). In practice engineers say "RAN" for both, All the equipment responsible for the actual radio link. It is a generation-agnostic concept — every generation has its own officially constructed RAN:

1.1 ↪ RAN - Different types of RANs

• O-RAN (open radio access network)

• C-RAN (cloud or centralized radio access network)

• GRAN (GSM radio access network)

• GERAN (specifies the inclusion of EDGE packet radio services)

• UTRAN (universal mobile telephone system RAN)

• E-UTRAN (evolved universal terrestrial RAN)

1.2 ↪ RAN - Anatomy of A Cell Site

RAN is the portion of the mobile network that provides the radio connection between the subscriber device and the rest of the network.

RAN Site have 2 fundamentals jobs:

1. Radio Communication Base station connected to Core by fiber cables and connected to users by radio signals which process done through RAN Compute and Radio units.

   

2. Resource management

   • Radio resources

   • Users Management

   • Scheduling

   • Power Management

   • Modulation

   • Coding

   • Mobility

   • Interference

   • Channels

   • QoS

   • Synchronization

   • Handovers

What is mounted on RAN Site ?

According to photo below we will categorize site to 2 parts:

• Top on Tower

  • Antennas

  • Radio Units

  • Ret Actuators

  • TMA / MHA

  • Grounding Kits

  • Lighting Arrestors

  • Fiber Cables

• Ground on Tower

  • BaseBand Unit / RAN Compute

  • VDC Power Supply

  • Transmission

  • Shelter

  • Alarms Sensors

  • Alarms Monitoring

  • Fiber Cables

RAN Compute / Baseband Unit

BB is a electronic Box contains a backplane fitted with various modular plug-in boards and units to process digital baseband signals. It is a sophisticated computing platform responsible for processing and controlling radio communication. Core Functions:

• Baseband Processing

• Radio Resource Management

• Mobility Management

• Error Correction

• Interface with RRU

Selecting BBU and BBU Slots Matter!: Start from 2G till 5G, BBU must be selected based on the technology will be on service and site location if it will be outdoor or indoor BTS. A BBU shelf has a limited number of slots, some of which are dedicated to the main + power boards. AS Fig above (Huawei BBU3900) show dedicated slots for the boards. the rest for baseband boards. Capacity planning then becomes arithmetic: "how many carriers per baseband board × boards per shelf = site capacity", with a footnote for CPRI bandwidth and license keys (software-locked capacity — the modern monetization layer).

Radio Unit / RF Processing

Imagine your baseband produces digital radio information. That information needs to become an actual RF waveform. RU Functions:

• Digital Signal Processing

• Signal Transceiver

• Digital-to-Analog / Analog-to-Digital Conversion

• Up / Down Conversion

• Power Amplification

• Optical and Electromagnetic Interfacing

• Smart Antenna and MIMO Support

02. RAN Equipment (Huawei, Ericsson, Nokia)

This Section maps the generic vendor hardware BBU/RRU module as consider the most changeable 2 parts between each vendor. beside site hardware onto the real product families of the 3 Vendors that built the worlds Telecom all G-RAN.

2.1 ↪ Huawei RAN

Huawei's RAN hardware strategy since roughly 2008 has centered on SingleRAN: one physical cabinet/BBU platform capable of running GSM, UMTS, and LTE simultaneously, differentiated mainly by which boards are installed. A Traditional base station (BTS) was one big cabinet at the bottom of the tower. Modern networks split the base station into two parts RRU and BBU.

⇒ Baseband / RAN Compute

The brain of the base station, baseband performs digital processing needed to transform network traffic into radio information. Huawei BTS3900 (as photo below):

• Most common Huawei setup sites are BTS3900 chassis with UMPT control Board and UBBP baseband board. feeding one or RRUs over CPRI.

• BBU & RRU: They are connected via fiber cable using the CPRI Protocol ( Common Public Radio Interface), eCPRI term in 5G

BBU Generation:

39xx BBU Series: Supports flexible configurations of main control and baseband boards, while the A/C variants are integrated units with fixed capacity .

Inside the BBU — BBU Boards

The BBU is modular, it's populated with boards depending on the network.

⇒ Remote Radio Unit — RRU

Modular radio frequency hardware devices used in distributed base stations to convert and amplify signals between antennas and baseband units (BBU) across 2G, 3G, 4G, and 5G networks

RRU vs AAU

• RRU: radio only → connects to a passive antenna via coax jumpers. Used for 2G/3G/4G and low-band 5G.

• AAU (Active Antenna Unit): RRU + antenna array integrated in one box. Essential for 5G Massive MIMO (32T32R, 64T64R — too many antenna elements for coax cables). Examples: AAU5612/5613, AAU5636 (multi-band sub-6 GHz), AAU5973 (mid-band).

Huawei RRU Functions

1. Receives downlink baseband data from the BBU and sends uplink baseband data back over CPRI fiber

2. Up-converts baseband → RF for transmission, down-converts and digitizes received RF signals

3. Contains a duplexer so TX and RX share one antenna

4. Has a built-in bias tee to power a Tower Mounted Amplifier (TMA)

5. Supports an external monitoring extension box (RS-485 alarms)

6. Optionally an AC/DC module makes it an "AC RRU"

RRU Model Families / Generation:

Huawei RRU model numbers follow a rough pattern: frequency band + generation + Tx/Rx count + output power.

2.2 ↪ Ericsson RAN

Ericsson describes Radio System as a complete RAN platform including radio, RAN Compute, transport, power, enclosure, antenna and site solutions under common management. while innovate RBS (Radio Base Station) to be the main box for an entire radio access node assembled from functional hardware and software. RBS can support multiple radio technologies while the software and configuration determine the deployed technology.

For Example, an Ericsson RBS 6000 series boxes was explicitly designed around multi-standard operation. RBS 6601 was a modular main-remote RBS consisting of a main unit and external radio units connected by optical fiber.

⇒ Baseband / RAN Compute

The brain of the base station, baseband performs digital processing needed to transform network traffic into radio information. Ericsson Baseband functions:

1. Radio Signal Processing

2. Resource Management

3. Transmission Related functions

4. IP Traffic Management

5. Operation & Maintenance

6. Timing & Synchronization

Baseband 5216

Ericsson’s Baseband 5216 is a multi-standard RBS 6000 baseband unit. Ericsson documentation states that the 5216 provides: Ericsson BB5216 characteristics:

• RBS Chassis mandatory for BB5216

• Support 6 radio interfaces (RI A-F)

• -48V architecture in host RBS for Power Consumption

• Supports LTE, WCDMA, GSM

• Colling Host/system dependent

• RBS 6000 main-unit / chassis - not the main remote

Baseband 6630

The Ericsson Baseband 6630 was introduced as a standalone 19-inch 1U baseband optimized for main-remote configurations. Ericsson BB6630 characteristics:

• Standalone 19-inch 1U

• Support 15 CPRI Ports

• Dual -48V feeding for Power Consumption

• Supports LTE, WCDMA, GSM with higher capacity

• Colling Self-contained; replaceable fan

• Main-remote Ericsson documentation describes 6630 capability as broadly equivalent to Baseband 5216 while changing the physical/deployment architecture: 6630 is standalone with its own climate control, whereas 5216 is a compact baseband used inside the RBS 6000 chassis/main-unit context.

⇒ Radio Units

Remote radio unit essentially the RF engine on site, which BB after doing RAN processing, through fiber cables give these info to Radio to start think in electromagnetic propagation for these info Radio Unit Functions:

• Digital processing

• D/A Conversion

• RF Up / Down Conversion

• Filtering

• Power Amplification

• Low Noise Amplification

Ericsson Radio Unit end with T & R letter, the are refer to Transmitter & Receiver which show how many TX & RX Radio support

Radio 2217 2T/2R

The macro Radio 2217 is a 2T/2Rradio with 2x40W output power. As part of the Ericsson Radio System portfolio Radio 2217 has best in class design when it comes to radio performance and power efficiency for wide area 3GPP radio products.

Radio 2219 2T/2R

The Outdoor macro radio with up to 2x80W output power, it's a part of Ericsson radio system portfolio.

2.3 ↪ Nokia RAN

Nokia's hardware has gone through four distinct eras, start from 1990s Talk Family support GSM through Flexi Family from 2006 till 2016 and AirScale Family which currently the RAN Flagship from Nokia ending with CloudRAN. Nokia's eras are still visibly separate product families that frequently sit side by side on the same site today. and as usual will pick up baseband part and radio units which RAN functions lives on both.

⇒ Baseband / Radio Units

BB - Flexi Multiradio 10

Flexi Multiradio 10 BTS is abased on Flexi Multiradio system module and Multiradio capable RF module/remote radio head variants. Flexi is high capacity, SRAN and LET-A ready Multiradio BTS. Nokia documentation describes the platform as supporting GSM/EDGE, WCDMA/HSPA+, and LTE (FDD/TDD) and providing capacity sharing and flexible expansion. The platform was designed for indoor/outdoor deployment. Flexi Multiradio 10 BB variants available:

• FSMF

  • Indoor/Outdoor Site

  • High Capacity

  • Support GSM/WCDMA/LTE

  • Extension Sub-Module: FBBA / FBBC extension cards

• FSIH

  • Indoor Site

  • High Capacity

  • TDD-LTE System Module

  • Extension Sub-Module: FBIH extension card

Flexi Radio Units:

• Flexi RRH — Nokia's Remote Radio Head line for this generation, in 2T2R and 4T4R configurations, connected to the System Module over CPRI/OBSAI fiber, mounted at the antenna exactly per the Section 8.3 model.

• Flexi Zone — a small-cell sub-family (not a macro product): the Flexi Zone Micro BTS integrates radio and baseband into one compact box, aimed at adding LTE capacity in dense urban areas where a full macro site isn't practical or available.

BB - AirScale

A modular baseband is a chassis/sub-rack with plug-in processing and control cards. Nokia AirScale system module offers more than 20 times the performance of the previous generation of Nokia base station. it's scalable, simple plug-in units to increase capacity as needed. Nokia AirScale BTS is part of complete radio access that comprises: • AirScale Base Station: o RF Module o Single, dual and triple band Remote Radio Heads o Radio Antenna System o AirScale System Module Indoor o AirScale System Module Outdoor • Power elements o Power Rectifier o Power Battery o Power Prioritize • AirScale Active Antennas o AirScale Compact Active Antennas o AirScale massive MIMO Adaptive Antennas • AirScale Cloud RAN o AirScale Cloud Base Station Server on AirFrame Data Center Solution o AirScale Radio Network Controller • Wi-Fi Access including cloud-based Wi-Fi Controller and access points

AirScale Baseband Cards:

• Ponente (2G/3G/4G/5G control card) - A high/ultra-performance control card.

  • control-plane functions

  • high-speed transport connectivity

  • system control

• Levante (4G/5G control card) - A high-performance capacity card for 4G/5G.

  • baseband capacity

  • intensive RAN processing

  • large cell/site configurations

• Lodos (4G/5G control card) - 4G/5G capacity card used to scale processing.

  • Baseband capacity scaling

AirScale Radio Unit

Nokia uses several families of radio hardware. At macro sites, the most useful learning categories are:

• FDD RRH

• TDD RRH

• Massive MIMO

RU Example:

• Doksuri - Modern FDD macro remote radio heads.

• Osprey 8 - A TDD remote radio head family.

• Osprey 32 / 64 - Massive MIMO radio family.

• Habrok 32 / 64 - Newer Massive MIMO radio family based on ReefShark.

5G RAN will be added Soon...

This Document provide a structured ref for Telecom & Enterprise managed services and operation center, through define each role and how it simple structure inside Companies. while service delivery models may contain one or more center for daily operations based on the scope of work.

The most important distinction is that these concepts do not all describe the same type of thing:

• Managed Services is primarily a service delivery / outsourcing model.

• Network Operations Center (NOC) is an operational function focused on network resources and infrastructure.

• Telecom Service Operations (Telco SOC) is an operational function focused on end-to-end services and customer impact.

• Managed Security Services (MSS) is a security service delivery model.

• Telecom Security Operations (Telco SOC) is a security operational function specialized for telecom environments.

• Security Operations Center (SOC) is a security operational function for enterprise IT, cloud, identity, applications, and related environments.

Operations Models:

1. Service Delivery Models

1.1 — Telecom Managed Services - T-MS

Definition: A service model where a telecom operator outsources the day-to-day running, maintenance, and optimization of its network and supporting IT systems to a specialized third party — typically an equipment vendor (Ericsson, Nokia, Huawei, ZTE), a system integrator, or a dedicated managed service provider — under a contract with defined SLAs, covering anywhere from a single domain (e.g., field maintenance) to full end-to-end network operation.

↪ 1. T-MS — Scope

• Network operations: 24x7 monitoring, fault handling, and performance management (RAN, core, transport, IP/MPLS, fiber, data centers)

• Field maintenance: preventive (site visits, battery/generator checks) and corrective (failure fixes), plus spare parts logistics

• Change and release management: software upgrades, patches, configuration changes, new site rollouts

• Network optimization and planning: coverage/capacity analysis, parameter tuning, traffic forecasting

• OSS/BSS and IT operations support: billing, provisioning, CRM systems

• Service desk operations

• Energy and site management: power, fuel, tower operations

• Enterprise variant: managed WAN/SD-WAN, managed LAN/Wi-Fi, managed voice/UC

↪ 2. T-MS — Objective

• Optimize operating cost and resource utilization

• Let the operator focus on core business (customers, services, growth) rather than day-to-day network running

• Gain access to scarce technical skills and vendor-specific expertise

• Ensure 24x7 coverage without building an equivalent internal workforce

• Accelerate adoption of new technology (5G rollout, cloud-native core, automation)

• Provide predictable, SLA-bound cost and performance

↪ 3. T-MS — Teams

• Transition/Onboarding Team — knowledge transfer, tooling setup at contract start

• NOC Engineers (L1/L2/L3) — provided by the MSP as part of the managed scope

• Field Maintenance Technicians — site visits, preventive/corrective maintenance

• Network Optimization Engineers — RF/parameter tuning, capacity planning

• OSS/BSS Support Engineers — billing, provisioning systems

• Vendor Management/Service Governance Office — retained on the operator's side to manage the contract and hold the MSP to SLAs

• Account/Delivery Managers (MSP side) — day-to-day relationship and escalation ownership

↪ 4. T-MS — Tools/Technologies

• Vendor Element/Network Management Systems (Huawei iMaster NCE, Ericsson ENM, Nokia NetAct)

• Fault, performance, and configuration management platforms

• OSS/BSS platforms (billing, provisioning, CRM)

• Workforce management and field dispatch tools

• Ticketing/ITSM systems (ServiceNow, Remedy)

• Network planning and optimization tools

• Automation/AIOps platforms for predictive maintenance

↪ 5. T-MS — KPIs/SLAs

• Network/site availability (%)

• MTTA (Mean Time to Acknowledge) and MTTR (Mean Time to Repair)

• First-time-fix rate

• Ticket SLA compliance rate

• Call setup success rate, dropped call rate

• Outage minutes and frequency

• Preventive maintenance completion rate

• Cost savings/OPEX reduction vs. baseline

↪ 6. T-MS — Typical Outputs

• Network availability and performance reports

• SLA compliance/penalty reports

• Incident and outage reports with root cause

• Preventive maintenance completion logs

• Network optimization and capacity planning reports

• Transition and knowledge-transfer documentation

• Periodic governance/steering committee reports

• Contract renewal/exit transition plans

1.2 — Managed Security Services - MSS

Definition: Managed Security Services (MSS) is a security service-delivery model in which an organization contracts a specialized provider, commonly an MSSP (Managed Security Service Provider), to operate, monitor, manage, or support some or all of its cybersecurity controls and processes under a defined scope, service model, KPIs, and SLAs.

↪ 1. MSS — Scope

• Security device management: firewalls/NGFW, IPS/IDS, secure web and email gateways, VPN, WAF

• Managed detection and response (MDR/XDR) across endpoints, network, cloud, and identity

• Security Operation Center - Manage SIEM through monitoring and detection and response

• Vulnerability management: scanning, prioritization, and remediation tracking

• DDoS protection and anti-fraud monitoring

• Threat intelligence and dark web/brand monitoring

• Incident response and digital forensics (often as a retainer)

• Identity security: managed IAM/PAM

• Cloud security: CSPM, CWPP, SASE/SSE

• Data protection: DLP, encryption key management

• Governance, risk, and compliance (GRC) support, including virtual CISO (vCISO) services

• Security awareness training and phishing simulation

↪ 2. MSS — Objective

• Provide continuous (24x7x365) protection against cyber threats without the cost and difficulty of building an in-house SOC

• Reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) to security incidents

• Close the skills gap — give access to specialized analysts, threat hunters, and forensic experts that are scarce and expensive to hire directly

• Maintain and demonstrate regulatory compliance (ISO 27001, PCI DSS, GDPR, NIS2, etc.)

• Lower total cost of ownership compared to building equivalent capability internally

• Improve overall security posture through continuous monitoring, tuning, and threat intelligence

• Provide predictable, subscription-based security spending (OPEX vs. CAPEX)

↪ 3. MSS — Teams

• SOC Analysts (Tier 1): monitor alerts, perform initial triage, escalate confirmed incidents

• Incident Responders (Tier 2/3): investigate escalated incidents, contain and remediate threats

• Threat Hunters: proactively search for hidden threats not caught by automated detection

• Threat Intelligence Analysts: track threat actors, TTPs, and emerging campaigns relevant to the customer

• Detection Engineers: build and tune detection rules/use cases

• Forensic Analysts: conduct deep-dive investigations and evidence collection after major incidents

• Vulnerability Management Analysts: run scans, prioritize findings, track remediation

• Compliance/GRC Specialists: manage audit evidence, policy alignment, and regulatory reporting

• vCISO (Virtual CISO): provides strategic security leadership, often for smaller customers without a dedicated CISO

• Customer Success/Account Managers: manage the relationship, SLA reporting, and escalation ownership

• Customer-side counterpart: a smaller retained in-house team (often under the CISO) that owns the MSSP relationship and makes final incident decisions

↪ 4. MSS — Tools/Technologies

• SIEM (Splunk, Microsoft Sentinel, QRadar, Elastic) for log correlation

• SOAR platforms for automated playbook-driven response

• EDR/XDR (CrowdStrike, SentinelOne, Microsoft Defender) for endpoint detection

• NDR for network-based detection

• Firewalls/NGFW, IPS/IDS, WAF for perimeter and application protection

• Vulnerability scanners (Qualys, Tenable, Rapid7)

• Threat Intelligence Platforms (TIP) and threat feeds

• UEBA for behavioral anomaly detection

• CSPM/CWPP tools for cloud workload and posture security

• IAM/PAM platforms (Okta, CyberArk) for identity-based access control

• DLP solutions for data loss prevention

• Case management/ticketing systems (ServiceNow, Jira) for incident tracking

• Sandboxing tools for malware analysis

↪ 5. MSS — KPIs/SLAs

• MTTD (Mean Time to Detect) — how fast a threat is identified

• MTTR/MTTC (Mean Time to Respond/Contain) — how fast an incident is acted on and contained

• Alert response time — SLA on acknowledging alerts by severity tier (e.g., Critical within 15 min, High within 1 hour)

• False positive rate — quality of detection tuning

• Coverage metrics — percentage of assets/endpoints under monitoring, MITRE ATT&CK technique coverage

• Patch/vulnerability remediation SLA — time to remediate critical vulnerabilities (e.g., 7 days for critical, 30 for high)

• Incident escalation accuracy — proportion of escalations that are true positives

• Uptime/availability of managed security devices and monitoring platforms

• Compliance audit pass rate and time to produce audit evidence

• Customer satisfaction (CSAT) and reporting cadence adherence

↪ 6. MSS — Typical Outputs

• Real-time and periodic (daily/weekly/monthly) security dashboards and reports

• Incident reports with root cause, impact, and remediation actions

• Threat intelligence briefings and advisories relevant to the customer's industry

• Vulnerability assessment reports with prioritized remediation recommendations

• Compliance reports and audit-ready evidence packages

• Executive summaries and risk posture reports for leadership/board

• Post-incident reviews and lessons-learned documentation

• Tuned detection rules and updated playbooks

• SLA performance reports against contracted targets

• Security awareness training completion and phishing simulation results

2. Operation Centers Models

2.1 — Telecom Service Assurance/Operation Center - T-SOC

Definition: Monitors end-to-end customer-facing services (voice, data, broadband, VAS) rather than individual network elements — focused on customer experience and SLA compliance, not raw equipment alarms.

↪ 1. T-SOC — Scope

• End-to-end service quality monitoring (CEM) for voice, SMS, mobile data, VoLTE, broadband, leased lines, IPTV, VAS, IoT

• Customer-impacting incident management, prioritized by number/value of affected customers

• Major incident and crisis coordination

• Problem management (root cause of recurring issues)

• SLA management for enterprise/wholesale customers

• Service activation/provisioning follow-up

• Coordination across NOC, field teams, vendors, IT, and customer care

↪ 2. T-SOC — Objective

• Ensure customers receive the service quality they're paying for

• Minimize customer-perceived downtime and degradation

• Meet contractual SLAs for enterprise/wholesale clients

• Translate technical faults into business/customer impact

• Reduce churn caused by poor service experience

• Provide one point of accountability for service quality across silos

↪ 3. T-SOC — Teams

• Service Operations Analysts (L1) — monitor KPIs, log tickets

• Service Assurance Engineers (L2) — investigate degradations

• Major Incident Managers — own coordination during big outages

• Problem Managers — drive root cause analysis

• SLA/Account Managers — track contractual compliance

• Customer Experience Analysts — correlate network issues to customer impact

↪ 4. T-SOC — Tools/Technologies

• Service assurance platforms and service inventory/CMDB

• Customer Experience Management (CEM) tools and probes

• Service Quality Monitoring (SQM) dashboards

• ITSM/ticketing (ServiceNow, Remedy)

• Fault-to-service correlation engines

• Synthetic transaction monitoring

↪ 5. T-SOC — KPIs/SLAs

• Service availability (per service type)

• SLA breach count and time-to-breach

• Mean Time to Restore Service (MTRS)

• Customers/services impacted per incident

• First-call resolution rate

• Major incident frequency and duration

↪ 6. T-SOC — Typical Outputs

• Service availability and SLA compliance reports

• Major incident post-mortems and customer communications

• Root cause analysis reports

• Executive dashboards on customer-impacting issues

• SLA credit/penalty calculations

2.2 — Telecom Network Operation Center - T-NOC

Definition: NOC is a centralized operational function, typically operating 24x7 in telecom environments, that monitors, maintains, troubleshoots, and coordinates restoration of network infrastructure and network resources across domains such as RAN, core, transport, fixed access, and supporting infrastructure.

↪ 1. T-NOC — Scope

• RAN (2G/3G/4G/5G base stations)

• Core network (packet core, voice core, IMS)

• Transport (microwave, fiber, DWDM, IP/MPLS, routers, switches)

• Fixed access (FTTH, DSL)

• Data centers, power, and environmental systems

• FCAPS: Fault, Configuration, Accounting, Performance, (basic) Security management

↪ 2. T-NOC — Objective

• Maximize network uptime/availability

• Detect and resolve faults before or as soon as they affect customers

• Keep network performance within target thresholds

• Execute planned maintenance/upgrades with minimal disruption

• Provide a real-time, accurate picture of network health

↪ 3. T-NOC — Teams

• L1 Monitoring/Triage Engineers — alarm monitoring, ticketing handling

• L2 Field/Remote Engineers — deeper troubleshooting

• L3 Specialist/Vendor Engineers — software fixes, design issues

• Field Maintenance Technicians — on-site repairs, preventive maintenance

• Change/Release Managers — planned maintenance windows

• NOC Shift Managers — oversee operations and escalations

• Vendor Support — supplier-specific technical escalation

• Problem Management — recurring-incident and RCA coordination

• Capacity / Performance Engineers — trend and resource analysis

↪ 4. T-NOC — Tools/Technologies

• Element/Network Management Systems (Huawei U2020, Ericsson ENM, Nokia NetAct)

• Fault and performance management systems

• Alarm correlation engines

• Ticketing and workforce management tools

• AIOps/automation for predictive maintenance and auto-healing

↪ 5. T-NOC — KPIs/SLAs

• Network/site availability (%)

• MTTA (Mean Time to Acknowledge)

• MTTR (Mean Time to Repair)

• Number and duration of outages

• Alarm backlog and resolution rate

• Call setup success rate, dropped call rate

↪ 6. T-NOC — Typical Outputs

• Real-time alarm/fault dashboards

• Network availability and performance reports

• Outage/incident reports with root cause

• Maintenance schedules and change logs

• Capacity planning and trend reports

2.3 — Telecom Security Operation Center - T-SOC

Definition: Telco SOC is a security capability specialized for threats and telemetry associated with telecom infrastructure, signaling, interconnects, subscribers, RAN, core networks, IMS, telecom applications, and telecom management planes. A telecom operator does not necessarily need a separate dedicated Telco SOC. Telecom-security responsibilities may instead be integrated into the enterprise SOC, network-security teams, fraud-management teams, or dedicated signaling-security operations.

↪ 1. T-SOC — Scope

• Signaling security: SS7, Diameter, GTP monitoring and firewalling

• Fraud: SIM box bypass, IRSF, Wangiri, subscription fraud (paired with FMS)

• SIM swap/account takeover monitoring

• 5G core security: service-based architecture APIs, slicing isolation

• IMS/VoLTE and SIP security

• RAN threats: rogue base stations, IMSI catchers

• OSS/BSS and management-plane security

• Subscriber data protection (CDRs, HLR/HSS/UDM)

• Lawful interception system integrity

↪ 2. T-SOC — Objective

• Protect telecom-specific infrastructure that generic IT security tools don't cover

• Prevent signaling-based attacks (interception, tracking, fraud)

• Minimize revenue loss from telecom fraud

• Maintain compliance with GSMA guidelines and national regulators

• Protect subscriber privacy and data

• Secure the network without compromising its availability requirements

↪ 3. T-SOC — Teams

• Telecom Security Analysts — security monitoring with telecom-domain knowledge

• Signaling Security Analysts / Engineers — SS7, Diameter, GTP and interconnect security

• Fraud Management Analysts — fraud investigation and loss analysis

• Signaling Firewall Engineers — signaling-security controls and policy

• Telecom Threat Intelligence Analysts — telecom-relevant actors, vulnerabilities and campaigns

• Incident Responders — coordinated investigation and containment

• 5G Core Security Specialists — SBA/SBI and cloud-native security

• RAN Security Specialists — RAN/RF security where applicable

• Security Assurance Specialists — hardening, testing and assurance

↪ 4. T-SOC — Tools/Technologies

• Signaling firewalls (SS7/Diameter/GTP)

• Fraud Management Systems (FMS)

• Telecom-specific SIEM use cases

• Core network/SBC log monitoring

• GSMA threat intelligence feeds

• NESAS/3GPP SCAS compliance tooling

↪ 5. T-SOC — KPIs/SLAs

• Signaling attack detection/block rate

• Fraud loss reduction (value and volume)

• MTTD/MTTR for telecom-specific incidents

• SIM swap fraud detection rate

• Compliance audit pass rate (GSMA FS.11, FS.19, NESAS)

• Cloud-native monitoring for 5G core

• RAN security telemetry where available

↪ 6. T-SOC — Typical Outputs

• Signaling-security incident reports

• Telecom fraud reports

• Threat-intelligence briefings

• Security incident reports

• Telecom-specific detection reports

• Signaling firewall policy/tuning reports

• Regulatory/assurance evidence

• 5G security posture reports

• Cross-team incident reports with NOC/fraud/SOC

• Security-control effectiveness reports

2.4 — Cybersecurity Operation Center - CSOC/SOC

Definition: SOC is a security operational function that continuously monitors, detects, investigates, responds to, and helps contain cybersecurity threats across enterprise IT, endpoints, networks, identity, applications, cloud, and other monitored environments.

↪ 1. SOC — Scope

• Continuous monitoring across endpoints, network, cloud, identity, applications

• Detection engineering and rule tuning

• Incident response lifecycle (detect, contain, eradicate, recover)

• Threat hunting and threat intelligence

• Vulnerability management support

• Digital forensics and malware analysis

↪ 2. SOC — Objective

• Detect and respond to attacks before significant damage occurs

• Reduce MTTD/MTTR for security incidents

• Provide continuous visibility across the attack surface

• Support regulatory and audit compliance

• Validate detection coverage (e.g., against MITRE ATT&CK)

↪ 3. SOC — Teams

• Tier 1 Analysts — alert monitoring and triage

• Tier 2 Incident Responders — investigation and containment

• Tier 3 Threat Hunters / SMEs — proactive analysis and advanced investigations

• Threat Intelligence Analysts

• Detection Engineers

• Digital Forensics / Malware Analysts

• Cloud Security Specialists

• Identity Security Specialists

• SOC Manager / Shift Manager

• Incident / Problem / Crisis Managers where applicable

↪ 4. SOC — Tools/Technologies

• SIEM (Splunk, Sentinel, QRadar)

• SOAR for automated response

• EDR/XDR (CrowdStrike, SentinelOne, Defender)

• NDR and UEBA

• Threat intelligence platforms

• Vulnerability scanners, sandboxing tools

• Case management / ITSM

• Digital-forensics tooling

• Vulnerability / exposure-management systems

↪ 5. SOC — KPIs/SLAs

• MTTD / MTTR / MTTC

• False positive rate

• Alert volume and escalation rate

• MITRE ATT&CK technique coverage

• SLA compliance on response time by severity

↪ 6. SOC — Typical Outputs

• Security incidents

• Incident reports

• Investigation notes

• Post-incident reviews

• Threat-intelligence briefings

• Detection-content changes

• Detection coverage/gap reports

• Compliance evidence packages

• Executive security posture reports

• Security-health dashboards

• Automation/playbook improvements

3. Escalation Matrix

Escalation matrix the one of most playbook used on daily basis for operation handling incident and problem over technology or people operation, it show you where to go to get solution when need assist.

[Note] Escalation Matrix defined by MNO or Vendor based on contract with customer. above table for learning purposes

4. RACI Concept

A detailed RACI is operator-specific, but a common pattern is: A = Accountable, R = Responsible, C = Consulted, I = Informed.

[Note] RACI defined by MNO or Vendor based on contract. above table for learning purposes

5. Reference Frameworks and Standards

The following sources/framework families are useful:

• ITU-T network management and FCAPS-related recommendations

• 3GPP security architecture specifications, including 5G security architecture

• 3GPP Security Assurance Specifications (SCAS)

• GSMA security guidelines

• GSMA NESAS

• TM Forum service assurance and customer experience assurance frameworks

• NIST Cybersecurity Framework

• NIST incident-response guidance

• MITRE ATT&CK for detection and telemetry mapping

6. Key Terminology Summary