Instance: Analysts manually examine firewall alerts and protection party logs to trace and mitigate anomalies. Degree 0 – guide: All protection operations are guide and reactive. Danger detection relies on isolated knowledge sources with no automation or danger searching. SOC anal