Mitigate is a core security operations function. Security operations teams identify, detect, investigate, mitigate, and improve. Mitigation means reducing the impact or likelihood of an incident, threat, vulnerability, or unsafe condition. In practice, mitigation may include isolating an endpoint, blocking a malicious domain, disabling a compromised account, applying a firewall rule, removing malware, or containing suspicious traffic. Migration is an IT or cloud transformation activity and is not a standard SOC function. Elimination may be a desired outcome in some contexts, but security operations generally uses containment, mitigation, eradication, and recovery language. Orchestrate is related to SOAR tooling, but it describes coordination of automated actions rather than a named security operations function in the objective set. Mitigation is the practical bridge between investigation and recovery: after the team understands enough about the incident, it acts to reduce damage and prevent further spread. Reference/topics: Security Operations 6.1, Identify/Detect, Investigate, Mitigate, Improve.