Cybatar includes correlation records and execution together with security-orchestration rule creation and rule execution, allowing repeatable logic to connect security records and response workflows.
Current workflow surfaces
The following product surfaces are represented in the current Cybatar application. They describe workflow scope, not a guarantee that every deployment has every integration, data source or automation configured.
Operational records
These records help preserve context and accountability across the capability:
How it connects to the wider platform
Security Operations
A connected operating layer for turning security signals into owned, traceable response work.
SIEM Event Pipeline
Structured event intake and normalization designed to feed wider security operations rather than operate as an isolated log screen.
Incident Response & Playbooks
Keep ownership, chronology, evidence and response work attached to the same incident record.
Threat Intelligence & Hunting
Preserve threat context around indicators and investigations instead of treating IOCs as isolated values.
Related evidence and decision resources
Questions about Correlation & Security Orchestration
What is the difference between correlation and orchestration?
Correlation combines or evaluates security observations to identify meaningful relationships. Orchestration coordinates configured actions or workflows in response to defined conditions.
Does Cybatar include correlation execution?
Yes. The current application includes correlation records, a correlation-run workflow and event-level correlation.
Should every security action be automated?
No. Automation should match risk, confidence, reversibility and approval requirements. High-impact actions may require human review.
Claim boundary
These pages describe Cybatar workflow capabilities visible in the current application. Availability can depend on deployment configuration, enabled modules, connected data sources and organisational process. Cybatar does not claim that the platform alone guarantees breach prevention, regulatory compliance, certification, uninterrupted availability or replacement of every specialist security control.