Managed Detection and Response (MDR)
An outsourced service that continuously monitors your environment for threats and actively responds to them, not just alerts you.
MDR combines technology (endpoint, network, and cloud detection tools) with a human team that monitors, investigates, and responds to threats around the clock. Unlike a self-managed SIEM or a basic monitoring tool, MDR includes active response (isolating a compromised device, for example) rather than just generating an alert someone still has to act on.
24/7 SOC Monitoring & MDR →Security Operations Center (SOC)
A team and platform dedicated to continuously monitoring, detecting, and responding to security threats.
A SOC is the combination of people, process, and technology responsible for an organization's ongoing security monitoring. It can be built in-house or outsourced (as with THREAT-WATCH's SOC-grade platform). A functioning SOC ingests telemetry from endpoints, networks, and cloud services, correlates it to detect real threats, and coordinates the response when something is found.
24/7 SOC Monitoring & MDR →Endpoint Detection and Response (EDR)
Software that monitors laptops, servers, and other devices for malicious activity and can respond automatically or via a SOC.
EDR agents run on individual devices (endpoints) and continuously record activity (process execution, network connections, file changes) looking for signs of compromise. When something suspicious is found, EDR can alert, and in a managed setup, a SOC can isolate the device from the network to stop an attack from spreading.
Endpoint Protection (EDR) →Extended Detection and Response (XDR)
An approach that correlates detection data across endpoints, network, cloud, and email into a single view, rather than siloed tools.
XDR extends the idea behind EDR beyond just endpoints, pulling in signals from network traffic, cloud workloads, identity systems, and email to build a fuller picture of an attack. The goal is to catch multi-stage attacks that wouldn't be obvious from any single data source alone, and to reduce the number of disconnected alerts an analyst has to manually piece together.
24/7 SOC Monitoring & MDR →Incident Response
The structured process of detecting, containing, investigating, and recovering from a security incident.
Incident response typically follows a lifecycle: preparation, detection and analysis, containment, eradication, recovery, and post-incident review. Organizations with a pre-agreed incident response plan (and ideally a retainer with a response provider) recover faster and with less damage than those improvising after the fact.
Incident Response →Cyber Threat Intelligence (CTI)
Information about active and emerging threats, attacker tactics, and indicators of compromise, used to inform detection and defense.
Threat intelligence turns raw data about attacker behavior, infrastructure, and tools into actionable context: for example, feeding known-malicious indicators into detection tooling, or informing which vulnerabilities to prioritize based on active exploitation. Good CTI is applied, not just collected: it changes what a SOC actually watches for.
24/7 SOC Monitoring & MDR →SIEM (Security Information and Event Management)
A platform that aggregates and correlates log and event data across an organization to support threat detection and compliance reporting.
SIEM tools centralize logs from firewalls, servers, applications, and other systems, then apply correlation rules to surface potentially malicious patterns. A SIEM alone generates alerts; it takes a team (in-house or via MDR) to actually investigate and respond to what it surfaces.
24/7 SOC Monitoring & MDR →Threat Hunting
The proactive search for threats already present in an environment that automated detection tools haven't flagged.
Rather than waiting for an alert, threat hunters form a hypothesis (based on threat intelligence, unusual patterns, or known attacker techniques) and actively investigate an environment to confirm or rule it out. This catches sophisticated attackers who've specifically evaded automated detection, and it's one of the reasons a human-led SOC finds threats that a purely tool-driven setup misses.
24/7 SOC Monitoring & MDR →Log Management
The practice of collecting, storing, and analyzing the activity records ('logs') generated by systems, applications, and network devices.
Logs record who did what, when, and from where, across every system in an environment, and are the raw material a SOC or SIEM correlates to detect threats and reconstruct what happened during an incident. NIS2 and ISO 27001 both expect adequate log retention specifically because logs are often the only evidence available during a post-incident investigation.
24/7 SOC Monitoring & MDR →Indicator of Compromise (IOC)
A piece of forensic evidence, like a malicious IP address, file hash, or domain, that suggests a system has been breached.
IOCs are the concrete, technical artifacts security teams look for: known-malicious IP addresses, file hashes matching identified malware, unusual outbound connections, or specific registry changes. Threat intelligence feeds distribute IOCs so detection tools across many organizations can be updated with the latest known indicators from active campaigns.
24/7 SOC Monitoring & MDR →MITRE ATT&CK
A publicly available knowledge base cataloging real-world attacker tactics and techniques, used as a common reference framework across the security industry.
MITRE ATT&CK organizes known attacker behavior into tactics (the attacker's goal, like 'initial access' or 'privilege escalation') and techniques (the specific method used to achieve it), based on documented real-world incidents. Security teams use it to map their detection coverage, identify gaps, and communicate about threats using a shared vocabulary instead of vendor-specific terminology.
24/7 SOC Monitoring & MDR →Sandboxing
Running an untrusted file or program in an isolated environment to observe its behavior without risking the real system.
Sandboxing lets security tools detonate a suspicious email attachment or download in a disposable, isolated virtual environment first, watching what it actually does (what files it creates, what connections it makes) before deciding whether to allow it on real systems. It's particularly effective against malware designed to evade signature-based detection, since behavior is harder to disguise than file content.
Endpoint Protection (EDR) →Digital Forensics
The scientific process of collecting, preserving, and analyzing digital evidence to determine what happened during a security incident.
Digital forensics reconstructs an attacker's actions, entry point, and scope of access by examining logs, memory, disk images, and network traffic, following strict evidence-handling procedures (chain of custody) so findings hold up for legal, regulatory, or insurance purposes. It's a core part of proper incident response, not just an academic exercise after the fact.
Incident Response →