Reference

Alert

A message from a security tool saying something might be wrong. It is a question, not an answer.

Alert queue

The list of alerts waiting to be worked, usually ordered by severity and age. Your inbox for the shift.

Severity

The detection rule's guess at how urgent an alert is (low to critical). It is a starting point, not a verdict.

Playbook

A written checklist a SOC follows for a given alert type, so every analyst investigates the same way.

Log

A timestamped record of something a system did — a sign-in, a process start, a network connection.

Triage

Quickly deciding what an alert means and what to do about it.

Tier 1 analyst

The first person to look at alerts. Decides what is noise and what needs a specialist.

Tier 2 analyst

A more senior responder who handles confirmed incidents and deep investigation.

SOC

Security Operations Center — the team that watches for and responds to attacks.

True positive

The alert was right: real malicious activity happened.

False positive

The alert was wrong: the detection logic misfired and nothing bad happened.

Benign true positive

The activity really happened, but someone authorized did it for a legitimate reason.

Escalate

Hand the alert to a more senior analyst because it needs more authority or skill.

SLA

Service Level Agreement — the time limit you have to respond to an alert.

EDR

Endpoint Detection and Response — software on laptops and servers that watches what programs do.

SIEM

A system that collects logs from everywhere and runs detection rules across them.

IDS

Intrusion Detection System — watches network traffic for known attack patterns.

WAF

Web Application Firewall — filters malicious web requests before they reach an app.

DLP

Data Loss Prevention — blocks sensitive data from leaving the organization.

Email gateway

The filter that inspects email before it reaches a mailbox.

Cloud audit log

A record of every administrative action taken in a cloud tenant.

Firewall

A device that allows or denies network connections based on rules.

Enrichment

Adding context to an alert: who owns the host, is this IP known bad, etc.

Indicator of compromise

A concrete artifact that shows an attack: an IP, a hash, a domain, a filename.

IOC

Short for Indicator of Compromise.

Threat intelligence

Outside knowledge about attackers, their tools and their infrastructure.

Reputation

A score saying whether an IP or domain has been seen doing bad things before.

WHOIS

A public record of who registered a domain and when. Very new domains are suspicious.

Geolocation

The physical place an IP address appears to be. Approximate, and easily disguised.

File hash

A fingerprint of a file. Same hash means the same file, byte for byte.

SHA-256

The hashing algorithm most commonly used for file fingerprints in security work.

Phishing

Tricking someone into giving up credentials or running malware, usually by email.

Spear phishing

Phishing aimed at one specific person using details about them.

BEC

Business Email Compromise — impersonating an executive or vendor to redirect money.

Look-alike domain

A domain that reads almost like the real one, e.g. northwlnd-mfg vs northwind-mfg.

SPF

A DNS record listing which servers may send email for a domain.

DKIM

A cryptographic signature proving an email was not altered and came from the domain.

DMARC

A policy that tells receivers what to do when SPF and DKIM fail.

Malware

Any software written to do harm: ransomware, stealers, backdoors and so on.

Ransomware

Malware that encrypts files and demands payment for the key.

Canary file

A decoy file nobody should touch. If it changes, ransomware is probably running.

Shadow copy

Windows' own point-in-time backups. Attackers delete them to prevent recovery.

C2

Command and Control — the server malware talks to for instructions.

Beaconing

Malware checking in with its C2 server at regular intervals.

Reverse shell

A connection from a victim machine out to the attacker, giving them a command prompt.

Persistence

Anything that makes malware survive a reboot: scheduled tasks, services, run keys.

Scheduled task

A Windows job that runs a program at a set time or event. Often abused for persistence.

LSASS

The Windows process that holds credentials in memory. Reading it is credential theft.

Credential dumping

Extracting passwords or hashes from a machine's memory or disk.

Masquerading

Naming malware after something legitimate, e.g. svch0st.exe instead of svchost.exe.

Living off the land

Attacking using tools already installed on the system, like PowerShell.

PowerShell

A powerful Windows scripting tool. Legitimate for admins, beloved by attackers.

Base64

A way of encoding text so it is not readable at a glance. Not encryption.

Download cradle

A one-line script that fetches and runs code from the internet in memory.

Brute force

Trying many passwords against one account.

Password spray

Trying one common password against many accounts to avoid lockouts.

Credential stuffing

Reusing username/password pairs leaked from other breaches.

MFA

Multi-Factor Authentication — a second proof of identity beyond a password.

MFA fatigue

Spamming approval prompts until a tired user accepts one.

Kerberos

The ticket-based authentication system used inside Windows domains.

Kerberoasting

Requesting service tickets so their passwords can be cracked offline.

NTLM

An older Windows authentication protocol, weaker than Kerberos.

Domain controller

The server that holds Active Directory and authenticates everyone.

Active Directory

Microsoft's directory of users, computers and groups inside a company.

Domain Admins

The most powerful group in a Windows domain. Members can do anything.

Privilege escalation

Gaining more permissions than you started with.

Lateral movement

Moving from one compromised machine to another inside the network.

Admin share

Hidden shares like C$ that let administrators reach a whole disk over the network.

SMB

The Windows file-sharing protocol, on port 445. Heavily abused for lateral movement.

RDP

Remote Desktop Protocol, port 3389. Remote graphical access to Windows.

Port scan

Probing many addresses or ports to find what is listening.

Exfiltration

Stealing data out of the organization.

DNS tunneling

Hiding stolen data inside DNS lookups to sneak past firewalls.

Insider risk

Harm caused by someone who already has legitimate access.

Crown jewel

The systems or data the business genuinely cannot afford to lose.

Asset criticality

How important a machine is to the business. Drives how urgently you act.

Containment

Stopping an attack from spreading, e.g. isolating a host.

Isolation

Cutting a machine off the network while keeping your security tools connected to it.

Kill chain

The sequence of steps an attacker takes from first access to final goal.

MITRE ATT&CK

A public catalog of attacker tactics and techniques, with ID numbers.

Tactic

In ATT&CK, the attacker's goal at a stage, e.g. Credential Access.

Technique

In ATT&CK, the specific method used, e.g. T1003.001 LSASS Memory.

Baseline

What normal looks like for a host or user, so you can spot abnormal.

Tuning

Adjusting a detection rule so it stops firing on harmless activity.

Change window

An approved period when IT is allowed to make changes. Explains many alerts.

Service account

A non-human account used by software. Should never log in interactively.

Jump host

A hardened machine admins connect through to reach servers.

OT

Operational Technology — the computers that run factory equipment. Safety comes first.

PLC

Programmable Logic Controller — the small computer that drives industrial machinery.

Chain of custody

The documented record of who handled evidence and when.