Enterprise SOC architecture integrating perimeter defense, centralized log collection, and SIEM processing into a full-stack security operations platform. Traffic from external users and threat actors flows through Firewall, WAF, and IDS/IPS before reaching internal assets, while logs from all security layers feed into a Log Server, Event Bus, and multi-stage SIEM pipeline including Parsing, Normalization, and Correlation engines. The SIEM Core generates alerts routed to SOC Console/SOAR for Incident Investigation and Threat Hunting, with results feeding Monitoring Dashboard, Reporting Engine, and Response Playbooks executed by SOC Analysts. This architecture demonstrates defense-in-depth with centralized visibility, enabling rapid threat detection and coordinated incident response across the enterprise.