Glossary
Plain-English meanings for the words you will see in alerts, logs and playbooks.
- Alert
- A warning raised by a security tool that something might be wrong. An alert is a question, not a conclusion.
- Asset inventory / CMDB
- The list of company machines and who owns them. Check it to find out what a host is for.
- Audit log
- A record of who did what to a system, such as changing a permission.
- Beaconing
- A program contacting its controller at regular intervals, like a heartbeat.
- e.g. A connection every 60 seconds
- Brute force
- Trying many passwords until one works.
- Bucket (cloud storage)
- A container for files in the cloud. A public bucket can be read by anyone on the internet.
- Business email compromise (BEC)
- Fraud where an attacker uses a hijacked or fake email account to trick staff or suppliers into sending money.
- C2 / command and control
- The server an attacker uses to send orders to infected machines.
- Change window
- A pre-approved time when planned work, such as a scan or maintenance, is allowed to happen.
- Credential harvesting
- Collecting usernames and passwords, usually through a fake login page.
- DLP
- Data Loss Prevention. Tools that spot sensitive files leaving the company.
- EDR
- Endpoint Detection and Response. Software on computers that records what programs do and can detect or block threats.
- EICAR
- A harmless 68-byte test file that antivirus tools are designed to flag, used to check they work.
- Encoded command
- A command hidden as scrambled text (often Base64) so it is hard to read. Common in malicious PowerShell.
- e.g. powershell -enc ...
- Escalate
- Hand a case to a more senior analyst or another team because it needs more skills, authority or speed than L1 has.
- False positive
- The alert fired, but the activity is harmless or expected.
- e.g. A scheduled vulnerability scan.
- Handover
- The notes an analyst leaves for the next shift: what is closed, what is open and what to watch.
- Hash
- A fixed-length fingerprint of a file. Two files with the same hash are the same file, so a hash lets you look up a file safely.
- e.g. MD5, SHA-1, SHA-256
- Impossible travel
- Two sign-ins from places too far apart to travel between in the time. It can mean stolen credentials, or just a VPN.
- Insider risk
- Harm that comes from someone with legitimate access, on purpose or by accident.
- IOC / indicator
- A clue that points to an attack, such as an IP address, domain, file hash or file name.
- e.g. 198.51.100.200
- Isolate (host)
- Cutting an infected machine off from the network to stop the problem spreading, while keeping it on so evidence is kept.
- L1 / L2
- Support levels in a SOC. L1 triages alerts, L2 investigates deeper and responds to incidents.
- Log
- A record of something that happened on a system, such as a login, a web request or a blocked connection.
- Look-alike domain
- A web address that is nearly the same as a real one, to fool people.
- e.g. harborpine-hr.test instead of harborpine.test
- Macro
- A small program inside an Office document. Attackers abuse macros to run commands when a document is opened.
- MFA
- Multi-factor authentication. A second proof of identity, such as a code or an approval on a phone, on top of a password.
- MFA fatigue
- Spamming someone with approval prompts until they tap Approve just to make them stop.
- On-call
- An engineer on a rota who is contacted out of hours to fix urgent problems.
- Persistence
- Something an attacker sets up to keep access after being found, such as a new MFA device or a forwarding rule.
- Phishing
- A fake message that tricks someone into giving away logins or money, or opening something harmful.
- Playbook / runbook
- A checklist that tells an analyst what steps to take for a type of alert.
- Port scan
- Checking many network ports to find which services are open. Attackers and security teams both do it.
- Process tree
- A view of which program started which other program. A Word document starting PowerShell is a red flag.
- Quarantine
- Antivirus moving a suspicious file to a safe place where it cannot run.
- Severity
- How serious an alert might be: critical, high, medium or low. It is a starting point, not the final answer.
- SIEM
- Security Information and Event Management. A system that collects logs from everywhere and lets analysts search them and raises alerts.
- SLA
- Service-level agreement. The time targets for responding to alerts, usually shorter for higher severity.
- SOC
- Security Operations Center. The team that watches for, investigates and responds to security alerts.
- SPF / DKIM / DMARC
- Email checks that prove a message really came from the domain it claims. A failure on a message pretending to be from your company is suspicious.
- SQL injection
- An attack that sneaks database commands into a web form or URL to read or change data.
- e.g. ' OR 1=1--
- Threat feed
- A list of addresses, domains and files that researchers have flagged as dangerous.
- Triage
- Quickly looking at an alert to decide how serious it is and what to do with it. This is the main job of a Level 1 analyst.
- True positive
- The alert was right: something harmful or against policy really happened.
- e.g. A brute-force attack that got in.
- VPN
- A secure tunnel to the company network. It makes a user's traffic appear to come from the VPN's exit address.
- WAF
- Web Application Firewall. Blocks harmful web requests before they reach a website.
Found something confusing or unrealistic?