Skip to main content

​
The defender’s toolkit

Cybersecurity professionals don’t fight threats with guesswork - they use a range of specialized tools to find vulnerabilities, detect attacks, and respond to incidents. This page covers the most important tools in a defender’s arsenal, how vulnerabilities are scored and tracked, and what security features are already built into the operating systems you use every day.
You don’t need to memorize every tool on this page. Focus on understanding what each category of tool does and when you would use it. That’s what matters in the real world.

​
Security appliances and tools

​
Vulnerability scanners

What they do: Automatically scan systems, networks, and applications for known weaknesses - missing patches, misconfigurations, default passwords, and known software flaws. When you use them: Before attackers find the holes. Security teams run vulnerability scans regularly (weekly, monthly, or after every change) to identify problems before they’re exploited. Example products:
  • Greenbone (OpenVAS) - Open-source network vulnerability scanner
  • Nessus - Industry-standard vulnerability scanner by Tenable
  • Burp Suite - Web application vulnerability scanner (finds SQL injection, XSS, etc.)
Think of a vulnerability scanner like a home inspector. They walk through your house and write a report of everything that needs fixing - leaky pipes, cracked foundations, unlocked windows. You still have to fix the problems, but at least you know where they are.

​
Antivirus / anti-malware

What they do: Detect, quarantine, and remove malicious software (malware) from computers and servers. Modern antivirus tools use signature-based detection (matching known malware patterns) and behavioral analysis (watching for suspicious activity). When you use them: Always. Antivirus runs continuously in the background on every endpoint - laptops, desktops, and servers. Example products: Windows Defender, Malwarebytes, CrowdStrike Falcon, Sophos

​
Firewalls

What they do: Filter network traffic based on predefined rules. Firewalls decide what traffic is allowed into and out of your network. Analogy: A firewall is like a bouncer at a club. The bouncer checks IDs (source/destination IP, port, protocol) and only lets in people who are on the list. Everyone else gets turned away at the door.
WatchGuard Firebox M4800 physical firewall appliance with network ports

A WatchGuard Firebox - a physical firewall appliance used in enterprise networks

Types: Example products: Palo Alto Networks, Cisco ASA, pfSense, Windows Firewall

​
IDS - Intrusion Detection System

What it does: Monitors network traffic and system activity for suspicious behavior, then alerts security teams. An IDS watches and reports - it does not block anything. Analogy: An IDS is like a security camera. It records everything and notifies you when something looks wrong, but it can’t physically stop an intruder. Types:
  • NIDS (Network-based): Monitors network traffic for suspicious patterns
  • HIDS (Host-based): Monitors a single computer for suspicious file changes, processes, or log entries
Example products: Snort, Suricata, OSSEC

​
IPS - Intrusion Prevention System

What it does: Monitors network traffic and system activity for suspicious behavior, then blocks the threat automatically. An IPS watches AND acts. Analogy: An IPS is like a security guard. They don’t just watch - they physically stop the intruder from entering.
The key difference between IDS and IPS is the response. IDS detects and alerts. IPS detects, alerts, and blocks. Many modern security appliances combine both functions.

​
SIEM - Security Information and Event Management

What it does: Collects logs from every device, server, application, and security tool across the organization, stores them in one place, correlates events across sources, and generates alerts when suspicious patterns emerge. Why it matters: Without a SIEM, security teams would have to manually check logs on hundreds of individual systems. A SIEM aggregates everything into a single dashboard, makes patterns visible, and can trigger automatic alerts. What it looks like in practice:
  1. The firewall logs a blocked connection from a suspicious IP
  2. The email server logs a phishing email received by an employee
  3. The antivirus logs a malware detection on that employee’s laptop
  4. The SIEM correlates all three events and generates a high-priority alert: “Possible phishing attack - malware delivered via email, attacker attempted network access”
Example products: Splunk, Elastic (ELK Stack), IBM QRadar, Microsoft Sentinel
Splunk is one of the most widely used SIEMs in the industry. You’ll encounter it in Day 4 when discussing incident response and log analysis.

​
SOAR - Security Orchestration, Automation and Response

What it does: Automates incident response workflows. When a SIEM detects a threat, SOAR can automatically execute a response - isolate a compromised machine, block an IP address, send alerts to the team, and create an incident ticket - all without human intervention. Why it matters: Security teams are overwhelmed with alerts. SOAR handles repetitive, time-sensitive responses so analysts can focus on complex investigations. Example products: Palo Alto XSOAR, Splunk SOAR, IBM Resilient

​
DLP - Data Loss Prevention

What it does: Prevents sensitive data from leaving the organization. DLP monitors emails, file transfers, USB drives, and cloud uploads for sensitive content (credit card numbers, Social Security numbers, medical records, trade secrets) and blocks unauthorized transfers. Example scenario: An employee tries to email a spreadsheet of customer credit card numbers to their personal Gmail account. DLP detects the credit card numbers in the file and blocks the email. Example products: Symantec DLP, Microsoft Purview, Digital Guardian

​
FIM - File Integrity Monitoring

What it does: Tracks changes to critical files and alerts you when something is modified. If an attacker alters a system configuration file, replaces a binary, or modifies a web page, FIM detects the change. Example scenario: An attacker gains access to a web server and modifies the login page to capture passwords. FIM detects the change to the login page file and alerts the security team. Example products: Tripwire, OSSEC, SolarWinds

​
UBA - User Behavior Analytics

What it does: Establishes a baseline of normal behavior for each user, then detects anomalies. If a user who normally logs in from Virginia at 9 AM suddenly logs in from Russia at 3 AM and downloads 10 GB of files, UBA flags this as suspicious. Example scenario: An employee’s account is compromised via phishing. The attacker logs in after hours and accesses files the employee has never touched before. UBA detects the anomalous behavior and alerts the SOC (Security Operations Center). Example products: Microsoft Sentinel UEBA, Exabeam, Securonix

​
How the tools work together

In a real Security Operations Center (SOC), these tools don’t work in isolation. They form a connected pipeline:

​
CVSS - Common Vulnerability Scoring System

When a vulnerability is discovered, security professionals need a way to measure how dangerous it is. CVSS provides a standardized severity score from 0.0 to 10.0.

​
Score ranges

​
What the score considers

CVSS scores are calculated based on several factors:
How does the attacker reach the vulnerability?
  • Network: Exploitable remotely over the internet (most dangerous)
  • Adjacent: Requires access to the local network (e.g., same Wi-Fi)
  • Local: Requires access to the device itself
  • Physical: Requires physical contact with the hardware
How difficult is the exploit to execute?
  • Low: Easy to exploit, no special conditions needed
  • High: Requires specific conditions, timing, or knowledge
Does the attacker need an account or special access?
  • None: No authentication needed (worst case)
  • Low: Requires a basic user account
  • High: Requires admin/root access
Does the victim need to do something (like click a link)?
  • None: No user interaction needed (worst case)
  • Required: Victim must perform an action (e.g., open a file, click a link)
What happens if the vulnerability is exploited? Measured across three dimensions:
  • Confidentiality: Can the attacker read data they shouldn’t?
  • Integrity: Can the attacker modify data they shouldn’t?
  • Availability: Can the attacker disrupt the system?

​
CVE - Common Vulnerabilities and Exposures

CVE is a standardized naming system for known vulnerabilities. Every publicly disclosed vulnerability gets a unique CVE ID so that security professionals worldwide can refer to the same vulnerability with the same name.

​
CVE format

Example: CVE-2021-44228 - this is the famous Log4Shell vulnerability in the Apache Log4j logging library. It scored a 10.0 on CVSS (the maximum) and was one of the most critical vulnerabilities in internet history.

​
Where to look up CVEs

When a new CVE is published, it’s a race between defenders patching and attackers exploiting. Critical CVEs (9.0+) should be patched within hours, not days. The Log4Shell vulnerability was actively exploited within hours of public disclosure.

​
Operating system built-in security

You don’t always need to buy third-party tools. Every major operating system ships with built-in security features. Knowing what’s already available helps you use it.

​
Daily security operations

Security isn’t a one-time project - it’s an ongoing operation. Here’s what a typical day looks like in a Security Operations Center (SOC):
1

Log aggregation

Collect logs from all systems - firewalls, servers, endpoints, applications, cloud services. Everything flows into the SIEM.
2

Alert triage

Review the alerts generated by the SIEM, IDS/IPS, and other tools. Determine which alerts are real threats and which are false positives.
3

Vulnerability scanning

Run scheduled scans against internal and external systems. Review new findings, compare against known CVEs, and prioritize remediation.
4

Patch management

Apply security patches to operating systems, applications, and firmware. Critical patches are applied immediately; others follow a scheduled cycle.
5

Incident response

Investigate and respond to any confirmed security incidents. Follow the incident response framework (you’ll learn PICERL on Day 4).
6

Reporting and archiving

Generate reports on security posture, incidents, and vulnerabilities. Archive logs for compliance and forensic analysis. Most regulations require logs to be retained for 1-7 years.
A SOC analyst’s job is often described as “finding the needle in the haystack.” With millions of log entries per day, the tools on this page are what make it possible to find the one event that matters.

​
Key takeaways

  • Security professionals rely on a layered toolkit - vulnerability scanners, firewalls, IDS/IPS, SIEM, SOAR, DLP, FIM, and UBA all work together.
  • CVSS scores vulnerabilities from 0.0 to 10.0 based on how exploitable they are and how much damage they cause.
  • CVE IDs give every known vulnerability a unique, standard name so the entire industry can communicate clearly.
  • Every operating system has built-in security features - use them.
  • Security is an ongoing operation, not a one-time setup. Daily log review, scanning, patching, and alerting are the heartbeat of any SOC.