Security Hub

Purpose and map of the hub

The Security Hub is the umbrella for operational security: SOC (triage and management of security alerts/incidents), XDR (cross-domain correlation and threat hunting), vulnerability management, PAM (Privileged Access Management), SecOps administration (SOAR: scoring, approvals, rollback) and security reporting. Tickets in this area (the SOC-* family) are under strictest confidentiality: some types (e.g. SOC-INCIDENT) are visible only to SOC analysts and the tenant’s CISO.

This page covers the landing page, the operational consoles (SOC L1, XDR), the Vulnerability Cockpit, the five PAM pages and the PAM Console, SecOps Admin, the Security Report Center and Agent Monitoring. GRC/ICC and the SOC/XDR director views are mentioned but described on their own pages (GRC, risk, compliance and legal, Cockpits and management views, Customer Service, Enterprise Service and ICC).

Security Hub landing page

What it is for. It is the entry point to security: it collects the tiles for SOC, XDR, vulnerabilities, PAM, SecOps Admin, reporting and the linked areas (GRC, ICC).

When to use it. At the start of your security session, to choose the area you work on.

How to open it. From the Core Home (Security Hub tile) or from the Security Hub of another context.

What it shows. The tiles link to: SOC L1, XDR, Vulnerabilities, PAM, SecOps Admin, IT Security Report Center, SOC domain KB, GRC, ICC, Operations Cockpit in security scope, Agent Control Tower in security scope, CMDB with security focus, ITOM with security focus and the SOC/XDR/GRC/ICC director views.

How to use it. Click the tile of the area you want; the visible tiles depend on your role (profiles SOC, XDR, SECHUB, etc.).

What happens next. You reach the chosen page/console with the context carried over.

Notes. Visibility is especially restricted: much of the content requires SOC/CISO roles.

SOC L1, security alert triage

What it is for. It is the SOC operational console: it collects alerts from the SIEMs (via webhook) and governs their L1→L2→L3 triage, up to confirmed incidents. It uses the same layout engine as the IT console, with domain SOC.

When to use it. It is the SOC analyst’s workstation for triage and management of alerts and incidents.

How to open it. From the Security Hub landing page, SOC L1 tile.

What it shows. The three-panel layout (queue · detail · tools) with auto-refresh and filters. The KPI strip for L1: Active alerts, Triaged in the last hour, FP rate (false positives), Triage SLA, L2 escalations. The L1 quick actions: Assign to me, Escalate L2, ✓ True Positive, False Positive.

When you move to the higher tiers (L2/L3, analysis/IR), KPIs and actions change: KPIs Open cases, Breaches, Active hunts, PIR pending, IOC ingested; actions Take over, Escalate L3, Isolate host, Block IOC, IR Playbook. You can open the SOC KPI dashboard in a modal («SOC L1 Dashboard»).

How to use it. You triage alerts (SOC-ALERT), classifying them as True/False Positive; you promote a confirmed alert to SOC-INCIDENT (strictest confidentiality, PIR mandatory); you handle phishing reports (SOC-PHISH, which users can also open from the user portal) and malware alerts (SOC-MALWARE). Containment actions (Isolate host, Block IOC) trigger SOAR remediations.

What happens next. «True Positive» starts the escalation/incident; «Isolate/Block» run response actions (subject to the SOAR barriers); every action is tracked and notified.

Notes. The most sensitive remediation actions (e.g. execute_script) are protected by multiple barriers (see SecOps Admin). Incident visibility is restricted to SOC/CISO.

XDR Ops

What it is for. XDR (eXtended Detection & Response) provides cross-domain correlation of threats and the tools for proactive hunting, threat intelligence and sharing with vendors.

When to use it. For correlated analysis of multi-source signals, hunting campaigns, IOC management and executive threat briefs.

How to open it. From the Security Hub landing page, XDR tile.

What it shows. A console organised in sub-views (initial view: Correlation), each with KPIs, tables and tabs:

Sub-view	Content
Correlation	Cross-domain correlation of signals
Threat Intel	IOCs and intelligence (SOC-THREAT-INTEL: TLP, confidence, CVE, threat actor, expiry)
Unified Timeline	Unified timeline of events
Executive Brief	Executive summary of the threat
Escalation	Escalation management
Lessons Learned	Lessons learned after the event
Hunting Queries	Threat hunting queries (SOC-THREAT-HUNT: hypothesis, technique)
Vendor Sharing	Sharing with vendors/partners
Knowledge Base	XDR knowledge base
Threat Landscape	Threat landscape
Reports & Analytics	Reports and analytics (shared reporting module, with scheduling)

How to use it. You move between sub-views; you correlate signals, manage IOCs and hunting campaigns, and produce briefs and reports. Attack Surface Management findings (SOC-ASM) and Security Cases (SOC-CASE, investigations that group several alerts/incidents/IOCs via ticket links) are handled here.

What happens next. Correlations can generate incidents/cases; confirmed IOCs feed the defensive systems; reports can be scheduled.

Notes. The Reports view uses the platform’s shared reporting module.

Vulnerability Cockpit

What it is for. It manages vulnerabilities (SOC-VULN) detected by scanners (Tenable, Qualys, Nessus): from discovery to remediation.

When to use it. To prioritise and track vulnerability fixes.

How to open it. From the Security Hub landing page, Vulnerabilities tile.

What it shows. The vulnerability cockpit with CVSS score, affected host/CI, source and remediation status; when there are no open findings it shows «No open findings».

How to use it. You review vulnerabilities by severity, plan remediation and link them to changes and assets.

What happens next. Remediation updates the status; critical vulnerabilities can generate incidents.

Notes. Fed by the scanners through ingestion.

PAM Hub

What it is for. It is the entry point to Privileged Access Management: governance of privileged access, accounts, credentials, sessions and compliance.

When to use it. To manage and monitor privileged access to sensitive systems.

How to open it. From the Security Hub landing page, PAM tile.

What it shows. The tiles for the PAM pages: Access, Accounts, Vault, Sessions, Compliance.

How to use it. You choose the PAM area; the functions are described in the following sections.

What happens next. PAM operations are fully tracked in the audit log.

Notes. PAM is reserved for security roles (SOC/CISO/PAM admin).

PAM JIT/JEA access

What it is for. It manages privileged access requests with the JIT/JEA model (Just-In-Time / Just-Enough-Access): time-limited, minimal grants.

When to use it. When a user needs temporary privileged access to a system.

How to open it. From the PAM Hub, Access tile.

What it shows and how to use it. The access requests (SOC-ACCESS-REQ) with approval (CISO/SOC) and expiry; you grant access for the window needed and revoke it on expiry.

What happens next. The granted access is time-limited and revoked automatically; every grant is tracked.

Notes. The JIT/JEA model minimises standing privileges.

PAM privileged accounts

What it is for. It manages the inventory of privileged accounts (administrative, service) and their lifecycle.

When to use it. To register, rotate and deactivate privileged accounts.

How to open it. From the PAM Hub, Accounts tile.

What it shows and how to use it. The list of privileged accounts with owner, system and status; the rotation/deactivation actions.

What happens next. Changes are tracked; non-compliant accounts show up in PAM Compliance (PAM Compliance).

Notes. Linked to the Vault (PAM credential vault).

PAM credential vault

What it is for. It is the safe for privileged credentials: secure custody and controlled distribution of secrets.

When to use it. To store and retrieve privileged credentials securely.

How to open it. From the PAM Hub, Vault tile.

What it shows and how to use it. The items held in the vault with controlled access; retrieval requires authorisation and is tracked.

What happens next. Every access to a secret is recorded in the audit log.

Notes. Credentials are never shown in clear text in the interface beyond what is necessary; entering secrets is up to the user.

PAM privileged sessions

What it is for. It manages and records privileged sessions to systems.

When to use it. To start/monitor a privileged session and review its recording.

How to open it. From the PAM Hub, Sessions tile.

What it shows and how to use it. Active and past sessions with user, system, duration and recording; from here you can start a session (also via the PAM Console, PAM Console (zero-knowledge access)).

What happens next. Sessions are recorded for audit and review.

Notes. Supports the zero-knowledge model (PAM Console (zero-knowledge access)).

PAM Compliance

What it is for. It checks the compliance of privileged access and accounts against policy.

When to use it. For periodic PAM compliance reviews.

How to open it. From the PAM Hub, Compliance tile.

What it shows and how to use it. The compliance status (excessive access, orphaned accounts, missed rotations) and the corrective actions.

What happens next. Non-compliances feed findings and remediation actions.

Notes. Linked to GRC/audit.

PAM Console (zero-knowledge access)

What it is for. It opens a zero-knowledge privileged console to a CI/system, without exposing the credentials to the operator.

When to use it. When you need to work on a system while handling a ticket (e.g. an incident on a host).

How to open it. From the PAM Console button in the Ticket editor (Ticket editor) when the ticket concerns a CI, or from the PAM Sessions page.

What it shows and how to use it. The session console to the system, brokered by PAM: credentials are injected from the vault without being revealed.

What happens next. The session is recorded (PAM privileged sessions) and tracked in the audit log.

Notes. Zero-knowledge model: the operator works without knowing the secret.

SecOps Admin

What it is for. It is the configuration of security automation (SOAR) and of response policies.

When to use it. To configure risk scoring and to manage the approval and reversibility of remediation actions.

How to open it. From the Security Hub landing page, SecOps Admin tile.

What it shows. Three tabs:

1. Risk Scoring — Weights Configuration — the weights and criteria of the risk score.
2. Approvals Queue — the queue of remediation action approvals.
3. Rollback Stack — the stack of reversible actions (to undo a remediation).

How to use it. You define the scoring weights; you approve/reject queued actions; you manage the rollback of executed actions.

What happens next. Approved actions are run by the SOAR playbooks; rollback undoes the effects where supported.

Notes. The configuration of security tools (Azure Tenant/Client ID/Secret, Type, Endpoint URL) has moved to the Integration Center (Integration Hub and import). Sensitive actions (e.g. execute_script) are protected by four barriers and strict secret management.

IT Security Report Center

What it is for. It is the security reporting area: posture, vulnerabilities by severity, incidents, compliance.

When to use it. To produce and view security reports.

How to open it. From the Security Hub landing page, IT Security Report Center tile.

What it shows and how to use it. The catalogue of security reports scoped to the SOC domain, with preview, scheduling and export.

What happens next. Reports can be scheduled and exported.

Notes. Scope restricted to the security domain.

Agent Monitoring

What it is for. It monitors the security agents/endpoints installed on systems.

When to use it. To check agent coverage and status (EDR/monitoring).

How to open it. From the Security Hub landing page / SecOps area.

What it shows and how to use it. Agent status per host (version, connectivity, health); from here you spot uncovered or unhealthy endpoints.

What happens next. Anomalies can generate alerts/tickets.

Notes. Complements Attack Surface Management (XDR Ops).

Pages linked to the hub (described elsewhere)

From the Security landing page you also reach pages described on their own pages in this guide: GRC (GRC, risk, compliance and legal), ICC (Project / Customer registry), CMDB with security focus (Asset Management and CMDB), ITOM with security focus (NOC, Observability and ITOM), Agent Control Tower (AI Hub and agents), Operations Cockpit and the Service Director SOC/XDR/GRC/ICC views (Cockpits and management views).