Operate security monitoring, triage, case management, escalation, containment automation, threat intelligence, metrics, and continuous control improvement.