## 2 Background
### Mitre Att&CK Matrix for Enterprise  
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is an open framework for establishing cybersecurity detection and response programs developed by MITRE Corporation, which has facilitated the codification and standardization of knowledge for defenders. The creation of Atomic Red Team, an open-source test library, has put into practice the theoretical concepts of the MITRE ATT&CK\({}^{\circledR}\) framework, allowing organizations to quickly, portably, and reproducibly test their organization's defenses. [16, 17]. MITRE ATT&CK matrices are widely used by IT and security professionals, including red teamers, risk managers, and SOC analysts, for threat hunting and modeling and improving detection capabilities [18]. Our primary concern is directed towards its Enterprise Matrix and its 14 tactics representing an adversary's tactical objective for acting, as shown in Table 2. \begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt} p{142.3 pt} p{142.3 pt}} \hline \hline
**Type of SOC** & **Description** & **Benefits** & **Limits** \\ \hline Centralized SOC & All security operations are managed from a single central location. & Ease of management, direct communication, and uniformity in operations. & Risk of single points of failure, especially in case of attack or compromise. \\ \multirow{3}{*}{Decentralized SOC} & Security responsibilities are distributed among multiple sites or divisions within the organization. & Adaptability to local needs and less dependence on a single center. & Complex coordination, risk of lack of consistency in security policies. \\ \multirow{3}{*}{Virtual or Cloud SOC} & Security functions are outsourced cloud services or managed security service providers (MSSP). & Avoids physical infrastructure management, scalability, and access to external expertise. & Dependence on third parties and concerns about data confidentiality. \\ \multirow{3}{*}{Hybrid SOC} & Combination of centralized and decentralized elements to balance the benefits of both approaches. & Flexibility and ability to tailor the structure to specific organizational needs. & Requires careful management to ensure effective coordination. \\ \multirow{3}{*}{Collaborative SOC} & The SOC works in close collaboration with other teams within the organization, such as IT and compliance teams. & Real-time information sharing and deep understanding of business aspects. & Requires constant communication and coordination to prevent information silos. \\ \multirow{3}{*}{Distributed SOC} & Security operations are managed by multiple entities, each responsible for its security. & Local adaptability reduces risks of single points of failure. & Possibility of lacking a global overview and necessary coordination to ensure a coherent response. \\ \multirow{3}{*}{Mobile SOC} & A mobile security team that can intervene at different sites based on needs. & Rapid response to local incidents, itinerant expertise. & Requires effective coordination to ensure adequate coverage, which can be costly in terms of travel. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Different SOC architectures and organizational structures.