Security Capabilities Orchestration (SCO). In the PALANTIR platform, the Security Capabilities Orchestration component oversees the overall management of the security capabilities (i.e., security network services, policies, configurations, and similar features), considering their deployment and reconfiguration, as well as part of their monitoring. Specifically, it oversees: • The interaction of the Security Orchestrator (SO) with the NFV Management and Orchestration (MANO) related to the SecaaS services registered in the Security Capabilities Catalogue (SCC): the onboarding of such packages, their instantiation/deployment and configuration in a given infrastructure (VIM), depending on the deployment mode (cloud, lightweight, edge). • The enforcement of the security policies and configuration provided as an output of threat mitigation recommendations or as result of attestation reports. At this layer, reconfiguration takes place on specific services running inside the SecaaS instances. • The monitoring of general or custom metrics on the SC instances and the NFVI environment, such as the VIM or partial data from the SCHI, such as its total availability of resources. Besides the monitoring, it permits the generation of alerts based that relate to specific metrics and thresholds; so, any registered legitimate condition that operates on a metric hitting a specific threshold can be reported, potentially used to display and/or enforce logic in upper layers. • The interaction with other PALANTIR components and the required retrieval, adaptation, and aggregation of any data to be used by such other components (e.g., for monitoring or attestation purposes). The SCO leverages 3rd party tools for the management of the NFVI infrastructure (VIM), on the orchestration of xNFs (NFV MANO). Such tools are integrated with this component yet, since alien to PALANTIR, these cannot be considered part of SCO and are thus not bundled with it.
