Defense in depth

MITRE ATT&CK

MITRE ATT&CK is a public knowledge base that organizes the tactics and techniques real attackers use, from how they get in to how they steal information. Security teams use it as a common language to design detections, evaluate tools and measure how well their defenses are covered.

View term →

Threat intelligence

Threat intelligence is collected and analyzed information about who is attacking, with which techniques and against what kind of companies, so you can get ahead of attacks instead of only reacting. It includes indicators such as malicious IP addresses or domains and context on active campaigns that affect your industry or region.

View term →

Incident response

Incident response is the organized process a company uses to detect, contain, eliminate and recover from an attack or security failure, so it limits the damage and gets back to normal operations quickly. It follows defined phases: preparation, identification, containment, eradication, recovery and lessons learned.

View term →

SNMP and NetFlow

SNMP (Simple Network Management Protocol) lets you check the status of routers, switches, servers and printers, such as CPU usage or whether an interface went down. NetFlow records who talks to whom on the network and how much traffic they send. Together they are the foundation of a NOC's network monitoring.

View term →

Logs (event logs)

Logs, or event logs, are the files where systems, applications and network devices automatically record what happens: sign-ins, errors, configuration changes or connections. In cybersecurity they are the evidence used to detect attacks and investigate incidents, which is why they are centralized in a SIEM and kept for a defined period.

View term →