A SOC is a team and function; SIEM, SOAR, EDR and XDR are tools it uses; MDR is a service that supplies part of the team. Mixing these up leads to buying a tool when you needed people, or the reverse. This glossary separates them in plain language.
People and services
SOC (security operations center). The function that watches for threats and responds. It can be a room, a rota or an outsourced team. NIST's glossary carries a definition, but the idea is simple: people, process and tools for detection and response.
MDR (managed detection and response). A service in which an outside provider monitors your environment and handles some response. It supplies analysts, usually on top of a tool. It is not a product category you install.
Tier 1, 2, 3. Common labels for analyst levels: first review, deeper investigation, expert response. Many teams do not use tiers formally. Ask how a provider defines them.
IR (incident response). The structured handling of a confirmed incident from containment to recovery. NIST SP 800-61 Rev. 3 treats it as part of overall risk management under CSF 2.0. The SOC may start IR, but IR often involves legal, communications and leadership beyond the SOC.
Tools
SIEM. A system that collects logs, correlates them and raises alerts, and stores them for search. It is a data platform plus rules. It does not respond by itself.
SOAR. Tooling that automates response steps: enrich an alert, open a ticket, disable an account after approval. It runs playbooks. It depends on good alerts coming in.
EDR. Software on laptops and servers that records activity and can contain a device. It sees endpoints, not your whole estate.
XDR. A label for correlation across several sources such as endpoint, identity and email. Meanings differ by vendor, so ask which sources and what correlation.
Threat intelligence platform. Stores and shares information about attackers and indicators. NIST SP 800-150 describes what such information includes. It feeds a SOC but is not one.
Work terms
Alert. A signal that something may be wrong. Many are harmless.
Triage. Deciding quickly whether an alert matters. The core SOC daily task.
Incident. A confirmed event that harms or threatens security. All incidents start as alerts; most alerts never become incidents.
False positive. An alert about something benign. A rate near zero is not realistic; the goal is manageable and decreasing.
Detection engineering. Writing and testing the rules that produce alerts. Often mapped to attacker techniques in MITRE ATT&CK.
Playbook or runbook. A written procedure for handling a known alert type.
Mean time to detect and respond. Averages of how long detection and response take. They can be gamed, because a few extreme cases skew them, so look at distributions too.
How do the terms relate?
| If you need | Think about |
|---|---|
| Central log search and rules | SIEM |
| Endpoint visibility and containment | EDR |
| Cross source incident stories | XDR |
| Automated routine steps | SOAR |
| People watching at night | Internal rota or MDR |
| Handling a confirmed breach | IR plan and team |
A small company can have a SOC function with no SIEM, using an EDR tool and an MDR service. A large company can own a SIEM and have no one reading it.
Why do the mix ups cost money?
A buyer who thinks a SIEM includes response may buy one and wait for it to act. A buyer who thinks MDR is software may look for an installer. A leader who thinks the SOC owns incident response may leave legal and communications out of the plan. Each confusion creates a gap that surfaces during a real event. Before any purchase, ask the vendor to fill in a simple table: what you supply, what we supply, what you must supply yourself. It takes ten minutes and exposes most misunderstandings.
Where Safeguard fits
None of these terms describe Safeguard, which does not offer SOC tooling and does not replace a SOC. It focuses on the application and software supply chain side: reachability analysis, policies and gates at build, CI and release, and compliance evidence. A SOC may use that vulnerability context when deciding how serious an alert is.
What to do
- Write your own one line definition of each term and share it with your vendors.
- Ask providers to state which of the terms they supply and which you must bring.
- Map your gaps: tool, people, process or all three.
- Agree who owns incident response beyond the SOC.
- Review the glossary yearly as vendor language shifts.
Quick check
Is MDR the same as a SOC?
No. MDR is a service that provides monitoring and response, often with its own tools. A SOC is the function itself, which can be built in house or sourced from an MDR provider.
Does a SIEM respond to threats?
Not by itself. It collects and correlates data and raises alerts. Response comes from people or from SOAR automation.
Sources
- NIST SP 800-61 Rev. 3, Incident Response Recommendations
- NIST SP 800-150, Guide to Cyber Threat Information Sharing
- MITRE ATT&CK
Last reviewed: 18 October 2026.
