Abuse.ch
Community-driven malware infrastructure tracking; free public feeds for malicious IPs, domains, and hashes. Strong on ransomware family tracking.
THE C.A.T. GLOSSARY · VENDOR & PLATFORM VOCABULARY
Security Tool & Platform Reference
Cybersecurity Applications & Tools.
The vendor and platform vocabulary an analyst meets in the SOC. Each tool is defined by what it does: threat-intel feed, EDR, SIEM, SOAR, IAM, forensics, network security. The name on the slide maps back to a category an analyst can reason about.
No tools matched. Try a different spelling or clear the filter.
Advisories & threat intelligence feeds
Sources of curated indicators, campaign reports, and analyst-grade intelligence.
Vocabulary for: Uncover
AlienVault OTX
Collaborative threat-intel exchange aggregating IOCs from a global community, with SIEM/automated integrations.
Anomali ThreatStream
Collects, analyzes, and prioritizes threat data with enrichment and risk scoring; integrates with existing security stacks.
CISA Advisories
U.S. Cybersecurity and Infrastructure Security Agency advisories on vulnerabilities and active threats, with mitigation guidance.
E-ISAC
Electricity sector ISAC; threat intel, IR support, and risk analysis tailored to grid operators.
FBI Flash Reports
Rapid high-priority notifications about imminent cyber threats targeting public and private partners.
FS-ISAC
Global financial-sector ISAC providing real-time alerts, incident coordination, and member collaboration.
GreyNoise
Filters internet background-scan noise so SOCs focus on targeted attacks. IP context with malicious vs. benign classification.
H-ISAC
Healthcare-sector ISAC; threat intelligence, incident response coordination, and best practices for clinical environments.
Intel 471
Commercial deep/dark-web monitoring with adversary infrastructure, TTP, and threat-actor behavior intelligence.
MITRE ATT&CK
Global knowledge base of adversary tactics, techniques, and procedures. The shared vocabulary of modern SOCs.
MS-ISAC
Multi-State ISAC for U.S. state, local, tribal, and territorial governments; alerts, IR, and risk management resources.
NCSC (UK)
UK National Cyber Security Centre; guidance, threat intelligence, and IR services across public and private sectors.
Microsoft Defender Threat Intelligence (MDTI)
Successor to RiskIQ PassiveTotal (acquired by Microsoft, 2021). Aggregates passive DNS, WHOIS, SSL, and infrastructure data for attribution and threat hunting.
PhishTank
Community-validated database of phishing URLs; supplies security tools and browsers with up-to-date intelligence.
Recorded Future
Threat-intelligence platform combining machine learning with human analysis across open, dark, and technical sources.
Microsoft Defender EASM
External Attack Surface Management, the renamed RiskIQ Illuminate (acquired by Microsoft, 2021). Discovers and monitors internet-facing assets, third-party services, and shadow IT.
SANS Institute
Training, certification, and research; publishes critical threat research and runs the Internet Storm Center.
VirusTotal
Free analysis of files and URLs across many AV engines; community sharing and reputation data.
WHOIS
Protocol and database of domain registration data; used to investigate suspicious domains and attribution.
AWS CloudTrail
Records and logs API activity within an AWS account, the audit trail for security and forensic work.
AWS CloudWatch
Monitoring and observability for AWS resources and applications; metrics, logs, alarms, automation hooks.
Azure AD (Entra ID)
Microsoft’s cloud identity and access management; SSO, MFA, conditional access, and integration with SaaS apps.
Cloudflare Cloudforce One
Cloudflare’s threat-research team and intelligence service; produces actionable indicators, campaign tracking, and disruption support against active adversaries.
Forcepoint
DLP, cloud security, and insider-threat behavior analytics across endpoints, networks, and cloud applications.
Google Security Operations (formerly Chronicle)
Cloud-native security analytics platform from Google Cloud; high-speed search and threat detection at petabyte scale. Chronicle was folded into the Google Security Operations (Google SecOps) brand in 2024.
Microsoft Sentinel
Cloud-native SIEM/SOAR (formerly Azure Sentinel); AI-driven analytics across on-prem, cloud, and hybrid with rich connector library, plus a built-in UEBA module for user and entity behavior analytics.
Orca Security
Agentless cloud security; full-stack visibility, vulnerability management, and risk prioritization across cloud workloads.
Prisma Cloud
Cloud-native security platform from Palo Alto Networks; workload protection, IaC scanning, compliance, runtime defense.
Sysdig
Cloud-native security focused on container runtime, Kubernetes monitoring, and cloud workload protection.
WIZ
Agentless cloud risk visibility; correlates infra/config/workload data to map attack paths and prioritize risk.
Data collection / logging / SIEM
Where the logs go to be aggregated, normalized, and queried. The SOC’s primary lens.
Vocabulary for: Alert
ArcSight
Long-standing SIEM with strong correlation engine for compliance reporting and forensic analysis.
Cribl
Data routing and processing for observability pipelines; filter, enrich, and reduce log data before forwarding.
Elastic Security
Unified security on the Elastic Stack; endpoint protection, prebuilt detections, and customizable monitoring.
Exabeam
Next-gen SIEM with built-in UEBA; user-behavior timelines and automated investigation workflows.
Fluentd
Open-source data collector that unifies log collection and processing across distributed systems via plugins.
IBM QRadar
Enterprise SIEM with real-time correlation, ML-assisted prioritization, and broad ecosystem integration.
Logstash
Server-side pipeline that ingests, transforms, and forwards data; central to the Elastic Stack.
SIEM (concept)
Aggregation and correlation of security event data for centralized detection, compliance, and IR.
Sigma
Open, vendor-neutral detection-rule format: write a detection once in YAML, convert it to the query language of whatever SIEM is in use. The de facto standard for sharing detection logic between teams and tools.
Source: SigmaHQSplunk Enterprise Security
Premium SIEM on the Splunk platform; correlation searches, ML, prebuilt content for SOC workflows.
Sysmon
Windows service that produces rich endpoint telemetry, process creation, network connections, file events, for SIEM ingestion.
Bitdefender GravityZone
EDR with behavior analysis, anti-exploit, root-cause analysis, and policy-based remediation.
CrowdStrike Falcon
Cloud-native EDR with a lightweight agent; combines behavioral analytics, threat intel, and ML.
Cybereason
EDR/XDR focused on endpoint visibility, malware detection, IR, and deep process-tree forensics.
Darktrace
Self-learning AI; builds behavioral baselines, detects anomalies, autonomously responds via its RESPOND module (formerly Antigena).
Digital Guardian
DLP and endpoint security with context-aware policies for data usage across endpoints, networks, cloud.
Falcon OverWatch
Managed threat-hunting service on top of CrowdStrike Falcon; 24/7 human-led analysis to validate stealthy intrusions.
Proofpoint Identity Threat Defense (formerly Illusive)
Deception-based identity-threat detection. Plants fake credentials and decoy paths to surface attacker lateral movement. Illusive Networks acquired by Proofpoint, 2022.
Kaspersky EDR
Attack-chain visualization, IOC search, sandboxing, and threat-intel integration with centralized management. U.S. sales were prohibited by a June 2024 Commerce Department determination; still widely deployed elsewhere.
Malwarebytes EDR
Lightweight EDR with strong remediation; ransomware rollback and post-infection recovery.
Microsoft Defender
Antivirus, endpoint protection, EDR (Defender for Endpoint), and XDR ties to Sentinel and Entra ID.
SentinelOne
Unified EPP/EDR with behavioral AI, autonomous response, rollback on Windows, and threat-hunting telemetry.
Sophos Intercept X
Next-gen AV plus EDR with deep learning and exploit prevention; strong investigation tools for SMB and enterprise.
Symantec (Broadcom)
Endpoint protection, email security, DLP, and EDR; global sensor network feeding detection and response.
Trellix Endpoint Security
Part of the broader Trellix XDR; detection, investigation, and response with behavioral analytics and forensic timelines.
Trend Micro Vision One
XDR correlating telemetry across email, endpoint, server, and cloud workloads.
XDR (concept)
Extended detection and response: correlates telemetry across endpoint, identity, email, network, and cloud into unified detections and response actions, extending EDR beyond the single host.
Forensics / digital evidence / mobile forensics
The kit that turns a disk image, a memory dump, or a phone into a defensible report.
Vocabulary for: Uncover · Escalation
Autopsy
Open-source forensics platform on The Sleuth Kit; timeline analysis, keyword search, file carving, media analysis.
Belkasoft Evidence Center X
DFIR tool focused on memory, disk, mobile, and cloud forensics; parses encrypted containers and RAM dumps.
Cellebrite
Industry standard for mobile-device extraction and analysis; UFED covers a wide range of devices.
EnCase Forensic
Long-standing digital-investigation suite; acquisition, indexing, analysis, and court-admissible reporting.
KAPE
Kroll Artifact Parser and Extractor; free triage tool that collects and parses forensic artifacts from a live system in minutes. A staple for fast evidence capture before (or instead of) full disk imaging.
Source: KrollMagnet AXIOM
Forensics across computers, mobile, cloud, IoT; powerful artifact parsing and cross-source correlation.
MSAB
Mobile forensics for law enforcement; XRY for extraction, XAMN for evidence visualization, XEC for lab management.
Oxygen Forensic Detective
Mobile, cloud, drone, and IoT forensics with deep parsing of app data including secure messengers.
plaso
Open-source engine behind log2timeline; parses disk images and artifacts from many sources into a single super-timeline. The standard tooling for timeline-based forensic analysis.
Source: plaso docsVelociraptor
Open-source endpoint-visibility and DFIR platform (stewarded by Rapid7); hunts for and collects artifacts across entire fleets using its VQL query language.
Source: Velociraptor docsVolatility
Open-source memory-forensics framework; extracts processes, network connections, injected code, and credentials from RAM captures. Volatility 3 is the current generation.
Source: Volatility FoundationX-Ways Forensics
Lightweight, fast forensic suite with strong scripting and hex-level analysis for deep investigations.
Identity & access management / privilege management
Who you are, what you can touch, and how the SOC proves it.
Vocabulary for: Subject
BeyondTrust
Privileged access management; just-in-time access, password vaulting, session monitoring, endpoint privilege management.
CyberArk
Market leader in PAM; credential rotation, secret management, session monitoring, secure remote access.
Duo (Cisco)
MFA, device trust, and contextual access; widely used for remote access and SaaS protection.
Okta
Identity platform with SSO, MFA, lifecycle management, and federation across thousands of apps.
One Identity
IGA with lifecycle, RBAC, privileged access governance; unifies AD, Azure AD, and cloud platform identity.
Ping Identity
Cloud-first identity for SSO, MFA, and customer IAM; strong hybrid and multi-cloud support. Absorbed ForgeRock (acquired by Thoma Bravo, 2023) and now ships its enterprise IAM lifecycle and governance products under the Ping brand.
SailPoint
Identity governance with least-privilege enforcement, access reviews, and ML-driven anomaly detection.
Cisco Umbrella
Cloud-delivered DNS-layer security; blocks malicious domains at resolution time, secures outbound web traffic.
Lansweeper
IT asset discovery and inventory; CMDB foundations and continuous visibility into devices, software, and users.
NetFlow
Cisco-developed protocol for flow-based monitoring and anomaly detection; metadata about traffic sessions.
Nexpose (Rapid7)
Vulnerability management with dynamic scans and exploitability-based prioritization; pairs with Metasploit.
Nessus (Tenable)
Vulnerability scanner with authenticated/unauthenticated scans and compliance framework support.
NIDS (concept)
Network intrusion detection: inspects traffic for signatures, protocol anomalies, and behavioral indicators.
Snort
Open-source NIDS with deep packet inspection and a large community rule set maintained by Cisco Talos.
Suricata
Open-source NIDS/IPS with multi-threaded inspection, file extraction, TLS inspection, and JSON output.
Tripwire
File-integrity monitoring and change detection; enforces baselines and supports compliance.
Wireshark
Open-source packet analyzer; deep protocol decoding for investigation and forensics.
Zeek (formerly Bro)
Behavior-focused network monitoring producing structured session logs for SIEM-friendly analytics.
Incident response / SOAR / automation
Where playbooks live, alerts get enriched, and analysts get back their afternoons.
Vocabulary for: Escalation · Documentation
Cynet AutoXDR
XDR with autonomous investigation and remediation playbooks aimed at small-to-mid SOCs.
DFIR ORC
Open-source forensic-artifact collector from ANSSI (the French national cyber agency). Runs on Windows endpoints to gather a broad, configurable set of artifacts for offline post-compromise analysis. Not a case-management platform.
Sumo Logic Cloud SOAR (formerly DFLabs IncMan)
SOAR with advanced playbooks, threat-intel enrichment, KPI tracking, and human-in-the-loop decisions. DFLabs acquired by Sumo Logic, 2021.
Cortex XSOAR (Palo Alto)
Comprehensive SOAR with case management, threat intel, playbook-driven automation, and hundreds of integrations.
ServiceNow SecOps
ITSM and security workflow with ticketing, change management, CMDB integration, and security automation.
Google Security Operations SOAR (formerly Siemplify / Chronicle SOAR)
SOAR with case management, playbooks, and analyst dashboards; integrated with Google SecOps (Chronicle) telemetry. Siemplify acquired by Google, 2022; fully integrated into Google SecOps.
SOAR (concept)
Security orchestration, automation, and response: define, automate, and orchestrate IR workflows at scale.
Splunk SOAR (formerly Splunk Phantom)
SOAR with Python-based playbooks, 300+ integrations, and deep Splunk analytics ties. Phantom acquired by Splunk in 2018 and renamed Splunk SOAR in 2021; Splunk itself acquired by Cisco, 2024.
Swimlane
Low-code SOAR for SOC analysts to build automation workflows without deep programming expertise.
TheHive Project
IR platform with collaborative case management; integrates with Cortex for automated analysis. TheHive 5 is a commercial product from StrangeBee; the open-source TheHive 4 reached end of life in December 2022.
Tines
No-code automation built for security teams; modular “stories” for alert ingestion, enrichment, and response.
Malware analysis / threat simulation / deception
Sandboxes for malware, honeypots for attackers, and frameworks for stress-testing defenses.
Vocabulary for: Uncover
Any.Run
Interactive malware sandbox with behavioral and network analysis for collaborative investigation.
Canary (Thinkst)
Deception platform deploying low-interaction honeypots that produce high-fidelity alerts on attacker interaction.
Cuckoo Sandbox
Open-source automated malware analysis running suspect files in VMs and capturing behavior. The original project’s final release was 2.0.7 (2019) and it is no longer maintained; community successors (CAPEv2, Cuckoo3) carry the approach forward.
CyberTrap
Deception platform with realistic traps and decoys to misdirect attackers and surface intrusion attempts.
Mandiant Security Validation (formerly Verodin)
Breach-and-attack simulation validating security controls against real-world TTPs. Verodin acquired by FireEye, 2019; renamed 2020; Mandiant acquired by Google Cloud, 2022.
SafeBreach
Breach-and-attack simulation continuously testing defenses across the kill chain.
Zscaler Deception (formerly Smokescreen)
Deception with decoys and lures mimicking real IT; alerts on engagement and provides attacker-TTP insight. Smokescreen acquired by Zscaler, 2021.
ThreatConnect
Threat-intel platform with playbooks for attack simulation, response automation, and intel-driven workflows.
ThreatGRID (Cisco)
Cloud sandbox combining behavior analysis with threat intelligence for advanced-malware investigation.
Commvault ThreatWise (formerly TrapX)
Deception and threat detection with decoys across endpoints, networks, and cloud. TrapX Security acquired by Commvault, 2022; rebranded as ThreatWise.
YARA
Open-source pattern-matching engine for identifying and classifying malware: rules describe strings, byte sequences, and conditions that a file or memory region must satisfy. The lingua franca for sharing malware signatures.
Source: YARA docsZscaler ThreatLabZ
Threat research and malware sandboxing powering Zscaler’s cloud security services.
Network & application security testing
Scanners, fuzzers, and surface-discovery tools that find the holes before adversaries do.
Vocabulary for: Risk
Acunetix
Automated web vulnerability scanner for SQLi, XSS, misconfig, and modern-web/SPA technologies.
Burp Suite
Industry-leading web app security tooling: intercepting proxy, scanning, manual pentest tools, and extensions.
Censys
Internet-wide asset discovery via continuous scanning; SSL/TLS, services, and attack-surface monitoring.
Nikto
Open-source web-server scanner for dangerous files, outdated components, and known issues.
Nmap
Network discovery and security auditing with rich NSE scripting for service detection.
OWASP ZAP
Free, open-source web app security testing with automated and manual capabilities.
Qualys
Cloud-based vulnerability management, policy compliance, and web app scanning across enterprise estates.
Shodan
Search engine for internet-connected devices; identifies exposed services, outdated software, ICS, IoT.
Tenable
Vulnerability management platform; Nessus-based scanning with on-prem, cloud, and hybrid coverage.
W3af
Open-source web app scanner combining automated checks with a manual testing framework.
Wapiti
Open-source command-line web vulnerability scanner; crawls and injects payloads for common flaws.
Backup & data protection
What you actually need before ransomware shows up, backups, immutability, and recovery posture.
Vocabulary for: Risk
Acronis Cyber Backup
Backup with integrated anti-malware; blockchain-based notarization and broad workload coverage.
Arcserve UDP
Unified data protection with replication, HA, and ransomware-resistant immutable storage.
Carbonite
Cloud-based backup and DR for SMBs; encrypted transmission, hybrid backup, ransomware features.
Code42 Incydr (now Mimecast)
Cloud-native endpoint data protection focused on insider risk and self-service restore. Code42 acquired by Mimecast, July 2024; Incydr folded into the Mimecast platform.
Commvault
Unified data management; backup, archive, governance, and SaaS-app protection with AI analytics.
Druva
Cloud-native, agentless data protection for endpoints, data center, and cloud workloads.
Rubrik
Cloud-native data management; instant recovery, immutable backups, and ransomware detection.
Veeam
Backup and recovery across virtual, physical, and cloud workloads with cloud-mobility options.
Veritas NetBackup
Enterprise-grade backup with broad workload coverage and centralized hybrid-cloud management.
Software development & scripting
The languages, frameworks, and editors that the rest of security operations runs on top of.
Vocabulary for: Uncover
Ansible
Open-source automation for config management, deployment, and orchestration via YAML playbooks.
Electron
Cross-platform desktop app framework using web technologies; powers Cursor, VS Code, Slack, and more.
Jenkins
Open-source CI/CD automation server; builds, tests, and deploys with a vast plugin ecosystem.
Node.js
Event-driven JavaScript runtime on V8; backend services, APIs, automation scripts, and tooling.
PowerShell
Task automation and configuration shell built on .NET; cross-platform via PowerShell Core.
Python
High-level language ubiquitous in security tooling, automation, data analysis, and ML.
Visual Studio Code
Lightweight, extensible code editor from Microsoft; rich ecosystem of extensions for development and security.
Security configuration & patch management
Tools that keep the fleet patched, the baselines enforced, and the auditors quiet.
Vocabulary for: Risk
Ansible Tower
Web-based interface for Ansible automation; RBAC, scheduling, visual dashboards, workflow orchestration.
BigFix (HCL)
Endpoint management platform automating patching, compliance, and security configuration at scale. Originally an IBM product; acquired by HCL in 2019.
Chef
Infrastructure-as-code platform enforcing security configurations via recipes and cookbooks.
Microsoft Configuration Manager (MECM)
Formerly System Center Configuration Manager (SCCM). Patching, software distribution, and compliance for Windows ecosystems; now part of the Microsoft Intune family alongside cloud-only endpoint management.
Microsoft WSUS
Free Microsoft tool for centrally approving and distributing Windows updates within an organization.
Ninite Pro
Automates installation and updates of popular third-party software across many endpoints.
Puppet Enterprise
Config management automating patching and continuous compliance through code-defined policies.
Qualys Patch Management
Cloud-based patching tied to vulnerability management; prioritizes patches by risk exposure.
SolarWinds Patch Manager
Centralized patching for Windows and third-party apps; integrates with WSUS and Microsoft Configuration Manager (MECM/SCCM).
Symantec Endpoint Management
Patch management, software distribution, and configuration enforcement across enterprise endpoints.
Physical security
Cameras, badge readers, intrusion detection, and the tools that bridge physical and cyber. In triage this data surfaces almost exclusively in insider cases: badge and camera records corroborate, or contradict, where an account’s owner physically was when the account acted.
Vocabulary for: Subject
Avigilon
HD surveillance, video analytics, and access control with AI-powered anomaly detection.
Axis Communications
Pioneer of network video surveillance; broad IP-camera portfolio with edge analytics.
Bosch Security Systems
Surveillance, intrusion detection, access, and fire across enterprise and critical-infrastructure deployments.
Cisco Physical Security
Converged networking-plus-security platform unifying surveillance, access, and IoT device management.
Genetec
Unified Security Center for video surveillance, access control, and license plate recognition.
Honeywell
Integrated physical security: surveillance, access, intrusion detection, alarms across critical infrastructure.
Johnson Controls
Physical security with OpenBlue platform; security plus building automation, with cybersecurity built in.
Lenel S2
OnGuard access control, video, and alarm management for enterprise environments.
Milestone Systems
Open-platform IP video management with broad camera support and rich analytics.
Pelco
Surveillance cameras, recorders, and VideoXpert management; rugged builds for outdoor and industrial use.
Vicon Industries
End-to-end surveillance with the Valerus VMS platform; open architecture and flexible deployment.
C.A.T. self-check
Three questions on the tool categories. The name on the slide should map to a category you can reason about.
0 of 0 reviewed
· 0 correct
Perimeter logs show constant scanning from the internet, and you need to know which sources are targeting you specifically versus scanning everyone. Which tool answers that?
GreyNoise exists for exactly this cut: it classifies internet-wide background-scan noise so the SOC can subtract it and focus on activity aimed at them specifically. VirusTotal is multi-engine file and URL analysis, PhishTank is a community-validated phishing-URL database, and WHOIS is domain registration data useful for attribution. None of the other three tells you whether a scanner is hitting everyone or just you.
Strip away the vendor names: what is the SIEM category, as a concept?
The SIEM is the aggregation and correlation layer: telemetry from endpoints, network, identity, and cloud lands in one place where correlation rules, search, and reporting run across all of it. The distractors are its neighbors: EDR is the endpoint agent that feeds it, SOAR is the automation layer that acts on what it finds, and vulnerability scanning is a separate discipline. Vendor suites blur these lines constantly, which is why the category behind the product name is the useful thing to hold onto.
An investigation needs to know exactly which AWS API calls a principal made last Tuesday. Which source holds that record?
CloudTrail records API activity within the account: who called what, when, from where. That makes it the audit trail for cloud security and forensic work, and the first pull in a cloud-anchored investigation. CloudWatch is the operations layer (metrics, logs, alarms), and a detection service like GuardDuty raises findings from telemetry but is not itself the audit record.
Quiz reviewed.