Security operations architecture
Design of processes tools and data flows that support monitoring detection response and improvement of security controls
Security operations center
Central team and facility that monitors security telemetry analyzes alerts and coordinates response to incidents
Use case in detection
Documented scenario describing what malicious or risky behavior to detect which data sources to use and what logic to apply
Security information and event management
Platform that collects normalizes correlates and analyzes events from many sources to support detection and reporting
Log management
Processes and tools to collect store index and retain logs from systems applications and security devices
Log source coverage
Extent to which critical systems cloud resources applications and network elements send logs into the central monitoring platform
Baseline behavior
Model of typical activity patterns for users systems or networks used to identify deviations and anomalies
Alert correlation
Technique of combining related events and alerts into a single incident or story to reduce noise and improve context
Incident
Confirmed or reasonably suspected event that jeopardizes confidentiality integrity or availability of information or systems
Event triage
Initial evaluation and prioritization of alerts to determine severity scope and whether further investigation is needed
Incident response plan
Document that defines roles procedures communication and decision points for handling security incidents
Incident response lifecycle
Phases such as preparation detection analysis containment eradication recovery and post incident lessons learned
Containment strategy
Approach for limiting the impact of an incident such as isolating hosts disabling accounts or blocking network paths
Eradication and recovery
Activities that remove the threat actor or malware and restore systems and data to trusted operation
Post incident review
Structured analysis of an incident to identify root causes lessons and improvements for controls and processes
Forensic readiness
Preparation of systems so they capture reliable evidence such as synchronized time detailed logs and chain of custody procedures
Time synchronization
Use of consistent time sources so that events across different systems can be accurately correlated during investigations
Vulnerability management
Continuous process of discovering assessing prioritizing and remediating vulnerabilities in systems and applications
Patch management
Structured approach to evaluating testing and deploying updates to software and firmware within defined timeframes
Configuration management
Definition and control of baseline configurations and changes to them to reduce misconfiguration risk
Change control
Process to evaluate approve implement and document changes to systems and security controls to avoid unintended consequences
Endpoint security monitoring
Collection and analysis of telemetry from servers workstations and mobile devices to detect malicious activity
Endpoint detection and response
Tools that provide advanced endpoint visibility behavior analysis and remote response actions such as isolation
Network security monitoring
Observation and analysis of network traffic metadata or packets to detect anomalies intrusions or policy violations
