- False Negative
- A failure to detect and alert on activity that is actually malicious, allowing a real threat to go unnoticed.
- CySA+
- CompTIA Cybersecurity Analyst+, an intermediate-level certification validating skills in threat detection, vulnerability management, incident response, and security reporting using behavioral analytics.
- SIEM
- Security Information and Event Management; a platform that aggregates and correlates log and event data from across an environment to support detection and investigation.
- SOAR
- Security Orchestration, Automation, and Response; tools that automate playbook-driven remediation and coordinate actions across multiple security products.
- IOC
- Indicator of Compromise; forensic artifact (file hash, IP address, domain, registry key) suggesting a system has already been breached.
- TTP
- Tactics, Techniques, and Procedures; the behavioral patterns describing how a specific threat actor operates, used to profile and detect adversaries.
- MITRE ATT&CK
- A publicly available knowledge base that catalogs real-world adversary tactics and techniques, used for threat modeling, detection engineering, and gap analysis.
- CVSS
- Common Vulnerability Scoring System; a standardized framework that produces a numeric severity score for a vulnerability based on exploitability and impact factors.
- CVE
- Common Vulnerabilities and Exposures; a publicly maintained, uniquely identified catalog entry for a specific known software or hardware vulnerability.
- CWE
- Common Weakness Enumeration; a categorized list of common software and hardware weakness types that can lead to exploitable vulnerabilities.
- EDR
- Endpoint Detection and Response; software that continuously monitors endpoint activity, detects suspicious behavior, and enables analysts to investigate and respond, such as isolating a host.
- UEBA
- User and Entity Behavior Analytics; a detection approach that baselines normal behavior for users and devices and flags statistically significant deviations as potential threats.
- SOC
- Security Operations Center; the team and facility responsible for continuous monitoring, detection, and initial response to security events.
- Threat Intelligence
- Processed, contextualized information about existing or emerging threats, adversary capabilities, and infrastructure that supports proactive defensive decision-making.
- Attack Surface
- The complete set of points — systems, services, accounts, interfaces — through which an unauthorized party could attempt to gain access to an environment.
- Chain of Custody
- A documented record tracking who collected, accessed, and handled a piece of digital evidence, preserving its integrity for potential legal use.
- Order of Volatility
- The standard sequence for collecting forensic evidence, prioritizing the most transient data sources (memory, cache) before more persistent ones (disk, backups).
- SBOM
- Software Bill of Materials; a formal inventory of all software components and dependencies in an application, used to assess supply-chain exposure.
- Playbook
- A documented, repeatable set of procedures that guides analysts through handling a specific category of security incident consistently.
- False Positive
- An alert or detection that flags activity as malicious when it is actually benign.
- Lateral Movement
- Techniques an attacker uses to move from an initially compromised system to other systems within the same network in pursuit of further access or objectives.
- IPS
- Intrusion Prevention System; a network security control that sits inline with traffic and can actively block or drop packets identified as malicious.
- Legal Hold
- A formal instruction to preserve data and records relevant to anticipated or ongoing litigation or investigation, overriding normal retention/deletion schedules.
- Vulnerability Management
- The continuous, cyclical process of identifying, evaluating, prioritizing, and remediating security weaknesses across an organization's assets.
- Zero-Day Vulnerability
- A previously unknown software flaw for which no official patch exists at the time it is discovered or exploited, leaving defenders with no vendor-provided fix.