The first time a security engineer told me “we need to talk about your baselines”, I nodded the way you nod at a stranger’s wedding. I ran data pipelines. My servers were the things upstream of the warehouse. Two years later, having sat through one too many audits, I can explain the whole subject to a data person in about ten minutes, because SecOps \u2014 the working agreement between security and operations, not the monitoring centre and not Google’s product \u2014 runs on concepts you already own. You know contracts, versions, test environments and drift. That is most of the vocabulary. The rest is a glossary, which is what this piece hands you, plus one war story that makes the words stick.<\/p>\n
The word gets used loosely. Some people mean the collaboration between security and IT operations. Some mean the monitoring centre itself. Google renamed a product to include it in April 2024, which muddied things further. The Ops Atlas sorts the mess by choosing the first sense and spelling it out as a contract: hardened baselines, one remediation queue carrying owners and deadlines, exceptions with expiry dates, and a scoreboard the two camps read side by side. No founding document exists and NIST’s glossary skips the term entirely; BMC’s press office was already grumbling about the two-camps gap in January 2016. What does exist is a lineage of guidance you can actually read \u2014 and for a data engineer, that lineage reads like documentation for a very strict schema registry.<\/p>\n
The lifecycle mirrors the four phases of NIST SP 800-128, with its cousins SP 800-70 supplying the idea of configuration checklists and SP 800-40 Rev. 4 covering patching discipline. In practice it runs as six moves.<\/p>\n
In August 2020, Microsoft shipped the first phase of its fix for CVE-2020-1472, the Netlogon flaw that let an attacker impersonate a domain controller. The rollout is the best public demonstration of the log-only playbook I know. From 11 August 2020, vulnerable connections were not blocked \u2014 they were logged, under event IDs 5827 and 5828 for denials, 5830 and 5831 for connections that used the escape hatch, and 5829 for those still permitted but recorded for follow-up. The escape hatch itself was a wonderfully bureaucratic group \u2014 “Allow vulnerable Netlogon secure channel connections”, filed among the Domain controller policy settings \u2014 and owners had months to read their own logs and empty it. On 9 February 2021 the second phase arrived, and enforcement became irreversible. The success measure was beautifully concrete: your exception list had to be at zero before the vendor’s date, because after it, the machine decided for you. Read logs, fix what the logs name, then let the hammer fall \u2014 that sequencing is the whole craft.<\/p>\n
One embarrassment worth knowing early. Benchmark publishers and automation projects do not release in lockstep. CIS moved its Ubuntu benchmark to v2.0.0 while the ComplianceAsCode project was still following the v1.0.0 content from 2024, so an automated check and the paper benchmark could disagree about the same server. Anyone who has chased a package version mismatch across environments will recognise the shape. Pick your source, note its version in the baseline record, and re-check when either side moves. NIST refreshed SP 800-70 itself in May 2026 with a Rev. 5 \u2014 the checklists ecosystem keeps moving, and your baseline record should say which edition it was built on.<\/p>\n
More than you would think. The observability habits behind pipeline observability<\/a> are the same habits that make telemetry believable to a monitoring team. The discipline of data standardization<\/a> is the discipline of baselines: agree the standard, record deviations, stop hand-tuning each row. And the reason pilot rings work is the reason repeatability<\/a> works \u2014 a change you cannot run twice safely is a change you do not understand yet. If you want the term pinned to an authoritative page, the Ops Atlas’s SecOps entry<\/a> is the reference the contract reading comes from, and it takes about five minutes to read.<\/p>\n That is the whole starter kit. Baselines are schemas, log-only mode is a dry run, exceptions are expiring NULLs, and the scoreboard is grouped, never summed. Learn the seven words and the six moves, and the next time a security engineer wants to talk, you will be the one setting the agenda.<\/p>\n","protected":false},"excerpt":{"rendered":" Baselines as schemas, log-only mode as a dry run: a data engineer’s tour of SecOps vocabulary, the six-move baseline lifecycle and the Netlogon story.<\/p>\n","protected":false},"author":6,"featured_media":4306,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[815],"tags":[],"class_list":["post-4305","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dataops-basics"],"_links":{"self":[{"href":"https:\/\/dataopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/4305","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dataopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dataopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dataopsschool.com\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/dataopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=4305"}],"version-history":[{"count":1,"href":"https:\/\/dataopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/4305\/revisions"}],"predecessor-version":[{"id":4317,"href":"https:\/\/dataopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/4305\/revisions\/4317"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dataopsschool.com\/blog\/wp-json\/wp\/v2\/media\/4306"}],"wp:attachment":[{"href":"https:\/\/dataopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=4305"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dataopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=4305"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dataopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=4305"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}