Cybersecurity area
Security Operations
Security Operations helps security teams collect signals, analyze incidents, automate responses, and manage organizational incident readiness.
Acronym Glossary
This glossary explains acronyms used in this part so the intended security function is clear.
- SIEM
- Security Information and Event ManagementCollection, normalization, correlation, and analysis of security events from multiple sources.
- SOAR
- Security Orchestration, Automation and ResponseOrchestration and automation of security responses, playbooks, approvals, and integrations.
- UEBA
- User and Entity Behavior AnalyticsBehavior analytics for users and entities to detect deviations, account compromise, or insider risk.
What This Area Covers
Security Operations covers the tools and processes that help security teams work with events, incidents, threats, and response. It starts with log collection, but continues with correlation, prioritization, automation, threat intelligence, incident management, reporting, and continuous improvement of detection.
Why It Matters
Without mature security operations, even good technologies become large volumes of isolated alerts. SIEM collects and correlates events, SOAR automates repeatable responses, UEBA monitors behavior, threat intelligence adds context, and incident management keeps the full incident lifecycle under control. Data quality matters as much as data volume.
How To Navigate This Area
In operations, it is critical that technologies do not increase the number of isolated consoles, but help correlate data, reduce noise, and accelerate decisions. SIEM, SOAR, XDR, threat intelligence, incident management, and automation make sense when connected to clear use cases, a data model, processes, and measurable detection quality.
The right solution depends on team maturity. A smaller organization may need an easy-to-use platform or service with high automation. A larger organization often focuses on integrations, data model, playbooks, escalation paths, detection rule quality, threat hunting, and measurable response.
The technology list below works as a map of the Security Operations area. The practical sequence is to name the security problem first, select the closest technology category second, and only then compare relevant vendors. This helps separate similar-sounding solutions and reduces the risk of adding another tool without a clear architectural role.
Technical Section Schema
Questions To Ask When Selecting A Solution
- Which event sources are available today and which are missing?
- Is the priority monitoring, correlation, automation, or incident management?
- Who will analyze alerts and who will execute response actions?
- Are detection use cases, playbooks, SLAs, and escalation paths defined?
- How will noise reduction, response speed, and detection quality be measured?
How To Use This Section
Each technology page expands one category, explains its architectural role, and lists SecTec portfolio vendors related to that area. The section page is therefore the orientation layer, while the detail pages support concrete mapping to solutions.
Vendors From The SecTec Portfolio
Attack coverage and defensive context
MITRE ATT&CK® Enterprise version 19.1 is used as a reference model. The mapping is a SecTec expert interpretation and does not imply endorsement by MITRE.
Practical attack scenarios
- Phishing and identity abuseAn adversary manipulates a user, obtains credentials, or abuses a trusted account to gain access to the environment.
- Credential theftAn adversary obtains passwords, tokens, sessions, or other authentication material and uses it to expand access.
- Public application or API abuseAn adversary exploits a vulnerable web application, API, client-side code, or software component for initial access and execution.
- Cloud and SaaS compromiseAn adversary abuses cloud identities, permissions, configurations, or application integrations to access services and data.
- Lateral movement inside the networkAfter initial access, an adversary discovers systems, accounts, and services and moves toward higher-value assets.
- Malware and Command and ControlMalicious code executes, maintains access, and communicates with adversary infrastructure through common or covert channels.
- Data exfiltration and leakageAn adversary searches for, collects, and transfers sensitive data from endpoints, cloud services, email, or internal repositories.
- Ransomware and availability impactAn adversary encrypts or manipulates data, stops services, inhibits recovery, and creates operational impact.
- Supply chain and trusted accessAn adversary abuses a supplier, software dependency, external access path, or trusted relationship to bypass normal controls.
- Attacks on OT and IoT environmentsAn adversary discovers industrial or connected devices, abuses remote access and network services, and threatens operational availability.
- Reconnaissance and attack surface mappingAn adversary collects information about people, systems, cloud services, and internet-facing infrastructure and searches for a viable initial-access path.
- Business Email Compromise and mailbox takeoverAn adversary takes over or impersonates a trusted email identity and abuses communications for fraud, payment diversion, data collection, or further phishing.
- Privilege escalation and persistenceAn adversary expands privileges, creates or modifies accounts and policies, and establishes repeatable access to systems, identities, or cloud environments.
- Insider threat and authorized access abuseAn insider or an adversary with a valid account abuses legitimate permissions to discover, copy, manipulate, or transfer sensitive data.
- BOLA – Broken Object Level AuthorizationAn adversary changes an object identifier in an API request and gains access to data or operations belonging to another user, account, or tenant.
- BOPLA – Broken Object Property Level AuthorizationAn API exposes or allows modification of sensitive object properties that the user should not access, including excessive data exposure and mass assignment.
- BFLA – Broken Function Level AuthorizationA regular or unauthenticated user invokes an administrative or privileged API function that should not be available to them.
- Broken API authentication and token abuseAn adversary bypasses login, password recovery, or token validation and assumes the identity of a user or service.
- Sensitive business flow and bot abuseAn automated adversary abuses legitimate functionality such as purchasing, booking, registration, voting, commenting, or account recovery.
- SSRF – Server-Side Request ForgeryAn adversary causes a server or API to fetch an attacker-controlled address and reaches internal services, cloud metadata, or protected network targets.
- API security misconfiguration and exposed interfacesInsecure defaults, debug endpoints, broken CORS, verbose errors, or missing security headers expose data and functionality to an adversary.
- Shadow and zombie APIs without managed inventoryUnknown, forgotten, or outdated API versions remain reachable without current controls, ownership, documentation, and monitoring.
- Unsafe consumption of third-party APIsAn application trusts data or redirects from a partner API more than ordinary input and propagates a supplier compromise into its own environment.
- Credential stuffing and password sprayingAn adversary automatically tests leaked username-password pairs or a small set of common passwords against many accounts.
- MFA fatigue, push bombing, and interceptionAn adversary floods a user with MFA prompts, intercepts a code, or uses social engineering to make the user approve an unauthorized sign-in.
- Session and access-token hijackingAn adversary steals a cookie, OAuth token, or another session artifact and accesses a service without re-entering a password or MFA.
- Injection and command executionUntrusted input changes the meaning of a command, query, or template and enables data access, logic bypass, or code execution.
- Path traversal and file inclusionAn adversary manipulates a file path or imported name and reads, writes, or executes content outside the permitted directory.
- Malicious file upload and unsafe deserializationAn application accepts or processes a malicious file or serialized object and enables code execution, control bypass, or compromise of other users.
- Client-side injection and Cross-Site ScriptingAn adversary injects untrusted content into a user's browser and executes script in the context of a trusted application.
Relevant ATT&CK techniques
- T1005 · Data from Local SystemDetect, Respond
- T1018 · Remote System DiscoveryDetect, Respond, Validate
- T1021 · Remote ServicesDetect, Respond, Validate
- T1041 · Exfiltration Over C2 ChannelDetect, Recover, Respond, Validate
- T1046 · Network Service DiscoveryDetect, Respond, Validate
- T1059 · Command and Scripting InterpreterDetect, Respond
- T1071 · Application Layer ProtocolDetect, Recover, Respond, Validate
- T1078 · Valid AccountsDetect, Recover, Respond, Validate
- T1083 · File and Directory DiscoveryDetect, Respond, Validate
- T1087 · Account DiscoveryDetect, Respond, Validate
- T1098 · Account ManipulationDetect, Respond
- T1110 · Brute ForceDetect, Respond
- T1114 · Email CollectionDetect, Respond
- T1190 · Exploit Public-Facing ApplicationDetect, Recover, Respond, Validate
- T1486 · Data Encrypted for ImpactDetect, Recover, Respond, Validate
- T1539 · Steal Web Session CookieDetect, Respond
- T1550 · Use Alternate Authentication MaterialDetect, Respond
- T1566 · PhishingDetect, Recover, Respond, Validate
- T1595 · Active ScanningDetect, Respond, Validate
- T1685 · Disable or Modify ToolsDetect, Respond