Instance: Analysts manually examine firewall alerts and stability function logs to trace and mitigate anomalies. Level 0 – manual: All security operations are guide and reactive. Menace detection relies on isolated data sources without automation or danger searching. SOC analysts