1. A method comprising: starting, by a security information and event management (SIEM) device associated with a private network, a work flow instance by deriving said work flow instance from a work flow template, including translating information contained within the work flow template, defining a plurality of security tasks at an abstract level, into commands and parameters (i) for accomplishing the plurality of security tasks by a plurality of security devices from at least two different manufacturers and (ii) that are specific to the plurality of security devices, wherein the plurality of security devices are associated with the private network and managed by the SIEM device, wherein the plurality of security tasks include operations that are intended to protect the private network against attacks; and scheduling the plurality of security devices to perform the plurality of security tasks defined in the work flow template by sending the commands and parameters to the plurality of security devices through a device adapter layer implemented by the SIEM device; and collecting, by the STEM device, results of the plurality of security tasks after they are performed by the plurality of security devices.