Tool families

About 16 min read

On this page

U Uncover: Choosing tools › Field reference

One entry per tool family: the question it answers, what it sees, and where it goes blind. Start from the question on the Choosing tools pillar; come here for the family detail.

The fifteen families

The Uncover phase touches fifteen major tool families. Each section opens with the question that family answers, which is the same question the question-to-tool table on the Choosing tools pillar routes to it. The C.A.T. glossary carries the vendor detail.

---

SIEM

The SIEM (Security Information and Event Management) answers “did this happen anywhere else?” It holds normalized events from across the infrastructure Infrastructure The systems, networks, and services that computing runs on. In triage the word points two directions: the organization's infrastructure is what alerts fire on, and attacker infrastructure is the set of C2 servers, domains, and staging hosts an adversary operates, which pivoting on indicators is meant to map. and is where cross-source joins run, for real-time detection and retrospective investigation alike. For security operations Security Operations The people, processes and technology that monitor, detect, investigate and respond to threats day to day, usually organized as a SOC. ASSURED covers the triage slice, from an alert firing to a documented close or escalation. , it is the default query window.

Products in the C.A.T. glossary: SIEM, log pipelines and security data lakes. Query languages and schemas (KQL with ASIM, SPL with CIM, ES|QL and EQL with ECS, YARA-L with UDM, SQL over OCSF): query languages, rule formats and log schemas.

The SIEM is the first stop when the question crosses sources: “did this happen anywhere else?” or “what other systems did this user User The identity behind activity on a system: the account that authenticated, launched the process, or received the email. In triage the user field names an account, not necessarily a person; whether the legitimate owner was actually behind the activity is exactly the question stolen credentials raise. touch?”. It is less useful for deep single-source forensics Forensics The application of scientific methods to collect, preserve, and analyze digital evidence so that findings hold up to scrutiny: disk and memory images, log exports, mobile extractions, each with a documented chain of custody. In triage the forensic move is preservation: capture volatile evidence, and hash what you export, before containment changes the system. , which is where EDR and digital forensics Digital Forensics Forensics applied to computers, networks, cloud services and mobile devices; in a SOC the two terms name the same discipline. See Forensics. earn their keep. For hands-on practice, Lab 5 of the telemetry labs runs Splunk searches over the BOTS v3 dataset, and the capstone pairs a SIEM with packet captures.

---

EDR

Endpoint Endpoint A device that runs an operating system and applications and connects to the network: workstation, laptop, server, virtual machine, phone, tablet. Endpoints are where execution-based tradecraft (malware, scripts, hands-on-keyboard commands) shows up, which is why EDR exists. Identity, SaaS and cloud-control-plane attacks, and attacks on network appliances that cannot run EDR, may never touch one, so endpoint silence is not proof of absence. Detection and Response answers “what ran on this machine, and what did it touch?” It records high-fidelity telemetry Telemetry The event streams that endpoints, network sensors, identity providers, SaaS apps and cloud control planes emit about what happened on them. Triage can only see what was collected: when telemetry is missing for a host or time window, record it as a gap (unknown is not Low), not as clean. on user devices and servers (process execution Execution The ATT&CK tactic (TA0002) for running attacker-controlled code on a local or remote system: through command interpreters, user-run files and lures, scheduled tasks, WMI, or exploits. It rarely stands alone: attackers execute code to discover, steal, move or persist. , file system activity, memory use, and network connections) and can act on the host.

Products in the C.A.T. glossary: Endpoint detection and response / XDR.

---

XDR

Extended Detection and Response platforms grow the EDR model outward: endpoint, identity, email, network, and cloud telemetry land in one console, and the vendor’s correlation logic stitches related events into a single incident before an analyst opens it. Where a SIEM joins whatever you feed it using rules you wrote, XDR ships pre-built joins across the telemetry the vendor controls.

Products in the C.A.T. glossary: Endpoint detection and response / XDR.

---

ITDR

Identity Threat Detection and Response answers “is someone abusing an identity, not a machine?” These tools watch the identity plane itself: directories, identity providers, and the credentials, tokens, and sessions they issue. As attacks shift from breaking endpoints to logging in, ITDR covers the tier where token theft Token Theft Stealing an already-issued bearer credential that has passed MFA (browser session cookie, OAuth access or refresh token, Entra Primary Refresh Token, cloud CLI token) from browsers, disk caches, memory or an AiTM proxy, then replaying it from attacker infrastructure. Theft: T1539 Steal Web Session Cookie, T1528 Steal Application Access Token. Replay: T1550.004, T1550.001. Duplicating a Windows access token on an endpoint is the separate T1134.001 (see Token Impersonation). and session hijack Session Hijack Taking over an active session by stealing or guessing session tokens or cookies, bypassing authentication and MFA. live. EDR can see a process read a browser’s cookie store on the host; only the identity plane sees the stolen session replayed from somewhere else.

Products in the C.A.T. glossary: Identity, ITDR and privileged access.

---

Network analysis

Network analysis answers “where did this traffic go, and what did it carry?” Packet-level and flow-level tools observe communication patterns, which makes them the main source for detecting lateral movement Lateral Movement Moving from the initial foothold to other hosts, identities or tenants to find sensitive data or reach higher-value targets (ATT&CK tactic TA0008). It usually rides legitimate remote-access protocols (RDP, SMB, WinRM, SSH) with stolen credentials, or replays a stolen session into a cloud or SaaS tenant, so the signal is an account authenticating where it does not normally go. Each hop widens the blast radius, and confirmed lateral movement is an escalation criterion. , exfiltration Exfiltration The unauthorized transfer of data out of the environment (ATT&CK TA0010): over the C2 channel, to cloud storage or a file-sharing service, by email, or through DNS. Triage signals are volume and destination: outbound bytes far above the host's baseline, a first-seen upload destination, and staging (archives appearing in temporary folders) shortly before the transfer. Confirmed exfiltration is an escalation criterion, and when the data is regulated it can start notification clocks. , C2 traffic Network Traffic The data moving between hosts on a network, observed as connections, flows, and packets. In triage, traffic metadata (who talked to whom, when, how much, and over which port and protocol) is often the fastest way to confirm or rule out command and control, exfiltration, or lateral movement. , and protocol Protocol The agreed set of rules two systems use to communicate: HTTP, DNS, SMB, RDP. In triage the protocol tells you what a connection is capable of doing, and a mismatch between the protocol and the port it runs on is a classic tell for tunneling or evasion. misuse, especially in environments with unmanaged devices or systems that cannot support EDR. Lab 3 of the telemetry labs reads a packet capture in Security Onion, if you want to practice on real traffic.

Products in the C.A.T. glossary: Network, NDR and web security.

---

Threat intelligence platforms

A threat intelligence platform (TIP) answers “has anyone seen this before, and what did it mean there?” TIPs consolidate external threat Threat Any circumstance or event with the potential to harm the organization's operations, assets, or people (NIST, from CNSSI 4009). The actor behind it is the threat actor; the weakness it uses is a vulnerability. Classical risk models multiply threat, vulnerability, and impact. ASSURED's RATM does not multiply. It scores threat actor intent and exploitation & scope as their own dimensions and lets them inform likelihood, which never rises above what the evidence supports. Risk is then read from the impact-by-likelihood matrix. data and give context for IOCs, attacker infrastructure, and adversary tactics, so triage can correlate internal events with known external intelligence Intelligence Information collected and analyzed to answer a decision-maker's question; in a SOC, usually threat intelligence. See Threat Intelligence for its levels and how to grade sources. . This is the platform view; the methodology for using what it serves is the threat-intelligence pillar, and the feed-as-evidence view is in telemetry sources.

Products in the C.A.T. glossary: Threat-intel platforms, research and knowledge bases.

---

Deception technologies

Deception answers “is someone exploring where nobody legitimate should be?” Deception platforms (Canary, Proofpoint Identity Threat Defense (formerly Illusive), Commvault ThreatWise (formerly TrapX)) flip the asymmetry. Decoy assets, fake credentials, deceptive files, and simulated services have no legitimate business use; interaction with them is high-confidence evidence of malicious activity.

Products in the C.A.T. glossary: Sandboxes, deception and adversary emulation.

---

Digital forensics

Digital forensics answers “what exactly happened on this system, in a form that will hold up?” The tools cover recovery, artifact extraction, timeline reconstruction, and chain-of-custody preservation. At triage depth the common move is targeted collection (for example Velociraptor or KAPE) rather than a full image, and super-timeline tools (Plaso, Timesketch) turn those artifacts into the timeline the correlation page describes. In the tier model this is specialist work, typically owned by Tier 3 or a dedicated forensics function once a case has escalated; the triage analyst’s forensics decision is usually narrower and earlier, preserving the evidence (image before reimage, capture memory before reboot) so that deep analysis stays possible. Preserve before you contain sets the order.

Products in the C.A.T. glossary: Forensics, triage collection and mobile forensics.

---

Sandbox and detonation

A sandbox answers “what does this file or link do when it runs?” Detonation services run a suspicious file or URL inside an instrumented, disposable environment and record everything it does: the process tree it builds, the domains it calls, the files and registry keys it writes. Sandboxing Sandboxing Detonating an unknown file or URL inside an isolated environment to observe what it does. Mature malware checks for sandbox-typical signals (small disk, brief uptime, no mouse activity, suspicious driver names) and stays dormant until it sees a real host. turns “is this attachment malicious?” from a signature lookup into an observed-behavior question, and its report feeds the timeline directly.

Products in the C.A.T. glossary: Sandboxes, deception and adversary emulation.

---

Vulnerability scanners

Vulnerability Vulnerability A defect in a system that can be turned into adversary capability if paired with an exploit and exposure: an unpatched CVE, a misconfiguration, a default credential, a logic flaw. Vulnerability without exposure or exploitability is latent; with both, it's a finding. scanners answer “was this system exposed to what the attacker used?” They assess systems, applications, and configurations for known weaknesses, so the analyst can check exploitability and correlate vulnerabilities with observed threat activity.

Products in the C.A.T. glossary: Asset inventory, exposure and vulnerability management.

---

SOAR

SOAR (Security Orchestration, Automation, and Response) answers “what can run the same way every time, so the analyst does not have to?” These platforms wire tools, data sources, and response actions into playbooks, which makes handling faster and repeatable. SOAR platforms increasingly embed LLM agents alongside deterministic playbooks; those agents fall under the admission gate on the AI-assisted triage page.

Market note (2026): Gartner’s 2024 Hype Cycle for Security Operations rated standalone SOAR “obsolete before plateau”. Its playbook and case-management functions increasingly ship inside SIEM and XDR platforms and no-code workflow tools, and AI SOC agents now run many enrichment steps (see AI-assisted triage). The capability matters more than the product category: whatever runs the playbook, its actions belong in the case record.

Products in the C.A.T. glossary: SOAR, case management and automation.

---

CSPM

Cloud Security Posture Management answers “what could go wrong here?” from configuration. CSPM tools continuously assess AWS, Azure, and GCP environments for misconfigurations, policy violations, and compliance risks across dynamic, multi-account cloud infrastructure.

Market note (2026): CSPM is now commonly sold as one module of a CNAPP (cloud-native application protection platform), which bundles posture (CSPM), workload protection (CWPP), entitlement management (CIEM), and often CDR in one console. The distinction on this page is about the question each capability answers, not the product you bought.

Products in the C.A.T. glossary: Cloud detection, audit and posture.

---

CDR

Cloud Detection and Response answers “what is going wrong right now?” from activity, which CSPM cannot see. Where CSPM reads static configuration, CDR watches the control plane ( CloudTrail AWS CloudTrail Records API activity in an AWS account: the audit trail for security and forensic work. Management events are on by default (90 days in Event history); data events such as S3 object reads and Lambda invokes must be enabled on a trail or event data store. , Azure Activity Log and Entra audit logs, Google Cloud Audit Logs) and workload runtimes for attacks in progress: unusual API sequences, role chaining, containers spawning shells they never spawn.

Products in the C.A.T. glossary: Cloud detection, audit and posture.

---

Security data lakes

A security data lake answers “what happened months ago, at a volume the SIEM cannot afford to keep?” These are centralized repositories for large volumes of structured and unstructured security data. By consolidating logs, alerts, network flows, endpoint telemetry, and threat intelligence Threat Intelligence Evidence-based knowledge about existing or emerging threats, including context, mechanisms, indicators, implications, and actionable advice (after Gartner's widely cited definition). It is consumed at strategic, operational, and tactical levels. Before acting on it, weigh the source's reliability, the information's credibility (the Admiralty code is one common scheme), and its age. , data lakes enable cross-source correlation and long-term retention for investigations that reach back months.

Products in the C.A.T. glossary: SIEM, log pipelines and security data lakes.

---

AI assistants and agents

AI assistants and agents answer “what does this mean, and what should I query next?” faster than a person can type it. Most SOC platforms now embed them: they draft summaries, enrich indicators, turn a question into a query, and in agentic form run multi-step enrichment on their own. The methodology treats them as tools under the admission gate on the AI-assisted triage page. Accountability is never delegated. Execution may be, at Level 0 parity. Above that line an assistant is advisory: it drafts and recommends, and an analyst decides. Governing automated triage covers the gate owner’s side.

Products in the C.A.T. glossary: AI assistants and triage agents.

---

Also in the toolkit

Four more families appear in the worked examples and earn a place in the analyst’s map, even where the methodology covers them as data sources rather than tools:

• Email security and message trace: gateway verdicts, URL click records, and the trace that says who received what. Two of the four Uncover worked examples pivot through it.
• Identity provider consoles and sign-in logs: the authoritative record of who authenticated, from where, with what factor, and which session or token resulted.
• Data loss prevention (DLP): content-aware controls at egress and on the endpoint that answer whether sensitive data left and by which path.
• SSPM and CASB: SaaS posture management and cloud access security brokers, where consented third-party apps, their scopes, and risky SaaS sessions show up.

---