SHARED VOCABULARY

The C.L.E.A.R. Glossary

Common Lexicon of Essential Analyst References.

The plain-language definitions for the words analysts use most. Alphabetized, searchable, and shareable. When two people on a call mean different things by “scope” or “alert,” this is the page to settle it.

RANDOM SPOTLIGHT · refresh or click 🎲

A

Access Control: Rules and procedures that regulate who can access certain systems, data, or resources.
Access Pattern: The way a user or system interacts with resources, such as login times, frequency of access, and volume of data transferred.
Advanced Persistent Threat (APT): A sophisticated, well-resourced adversary, often state-sponsored, that gains and maintains prolonged, covert unauthorized access to a network while avoiding detection. The term names the actor; the campaign it runs is APT activity.
AI/ML (Artificial Intelligence / Machine Learning): Technologies that enable systems to learn from and make decisions based on data, used in security for threat detection, pattern recognition, and automated response.
Alert: An automated notification produced when detection logic decides an event might be malicious, anomalous, or in violation of policy. The detection engine’s hypothesis, not a verdict; the analyst makes the call.
Alert De-duplication: The process of consolidating multiple identical or related alerts into a single notification to reduce noise and improve analyst efficiency.
Alert Fatigue: The desensitization of security analysts to alerts due to high volumes of notifications, potentially leading to missed critical threats.
Alert Parsing: The systematic process of breaking down and analyzing the components of a security alert to understand its technical details and significance.
Alert Validation: The step where an alert is examined and confirmed as legitimate or false-positive before initiating further investigation or response.
Analyst Burnout: Physical and mental exhaustion experienced by security analysts due to high-stress environments, constant alert monitoring, and pressure to maintain security.
Anomaly: An observation that deviates from an established baseline. Anomalies are statistical, not malicious; an analyst still has to decide whether the deviation matters.
Anomaly-Based Detection: A security detection method that identifies suspicious activity by comparing current behavior against established baselines of normal activity.
Application-Layer Protocol: A protocol at the top of the network stack that applications speak directly: HTTP, DNS, SMTP, SMB. Triage cares because adversaries tunnel command-and-control and exfiltration through these common protocols to blend with legitimate traffic, which is why destination and payload matter more than port alone.
Application Programming Interface (API): An interface a service exposes for programmatic access, typically authenticated with keys, tokens, or certificates instead of an interactive login. In cloud and SaaS triage the API audit log is often the only record of what a stolen credential actually did, since an attacker holding a valid key or token never touches a login page and sidesteps login-centric controls such as MFA.
Arbitrary Commands: Unauthorized commands that an attacker can execute on a compromised system, often with the same privileges as the compromised application.
Artifacts: Digital evidence or traces left behind by system activity or security incidents, used in forensic analysis and incident investigation.
Asset: Something the organization owns, depends on, or is accountable for: data, a system, an identity, a credential, or a service. An asset’s criticality is what turns a generic alert into a prioritized one.
Asset Criticality: The level of importance or sensitivity of an asset, which determines the level of protection it requires.
Asset Role: The defined function or purpose of an asset within an organization, helping prioritize its security importance.
ASSURED Methodology: A structured approach to event triage in security operations, comprising seven phases: Alert, Subject, Scope, Uncover, Risk, Escalation, and Documentation.
Attack Chain: The ordered sequence of steps an attacker takes from initial access through their objective. Useful as a framework (Lockheed Martin’s Kill Chain, MITRE ATT&CK’s tactics) because it lets defenders intervene at any link, not only the first.
Attack Patterns: Common techniques or behaviors used by attackers that help in recognizing and defending against threats.
Attack Vector: The entry point an attacker uses to reach a target: a phishing email, an exposed RDP port, a third-party vendor with trusted access, a misconfigured cloud bucket. Each vector implies a different control to harden.
Attribute-Based Access Control (ABAC): Restricts access based on user attributes, environment conditions, and resource characteristics to enforce fine-grained security policies.
Authentication: Proving who you are to a system: a password, a hardware token, a biometric, a certificate. Distinct from authorization, which is what that identity is then allowed to do.
Authorization: The process of granting or denying access to resources based on a user’s or system’s identity and permissions.
Automation: The use of technology to perform security tasks with minimal human intervention, including alert triage, incident response, and threat hunting.
Autonomous System Number (ASN): A globally unique number identifying a network routed under a single operator, such as an ISP, cloud provider, or hosting company. During enrichment the ASN behind an IP address tells the analyst who operates it, which is how a connection resolves to a residential ISP, a corporate egress, or a hosting range with a reputation for abuse.

B

Base64 Encoding: A binary-to-text encoding scheme used to represent binary data using a set of 64 characters, often used by malware to obfuscate payloads or communications.
Baselining: The process of documenting and measuring normal system behavior over time to identify deviations that might indicate security issues.
Behavior Analytics: The process of collecting and analyzing user and system behavior patterns to identify potential security threats or anomalies.
Behavioral Drift: Gradual changes in normal behavior patterns that may complicate detection of anomalies.
Benign True Positive: An alert that fired on exactly the activity its detection logic describes, where that activity turns out to be authorized or expected in the local context: a red-team exercise, an admin’s sanctioned use of a dual-use tool, a scanner doing its job. The detection worked; the context clears it. Distinct from a false positive, where the logic matched something it should not have. The close still feeds tuning, because the record is what teaches the detection about the local context.
Biometric Verification: Authentication method that uses unique biological characteristics like fingerprints or facial recognition.
BITSAdmin: A command-line tool for managing Background Intelligent Transfer Service (BITS), often monitored for abuse by attackers.
Blast Radius: The set of systems, identities, and data an incident can plausibly reach from its current foothold: everything the compromised entity can touch, authenticate to, or influence. Scope draws boundaries around it, lateral movement grows it, and containment exists to stop it growing.
Border Gateway Protocol (BGP): The routing protocol that exchanges reachability information between the autonomous systems that make up the internet. Security-relevant because BGP hijacks and route leaks can silently redirect traffic through attacker-controlled networks, so a connection’s destination is not always where the packets actually went.
Bring Your Own Device (BYOD): A policy allowing employees to use personal devices for work, which introduces unique security challenges.
Business Continuity: An organization’s capacity to keep critical operations running during and after a disruptive incident such as a ransomware outbreak or a destructive attack. In triage, a credible threat to business continuity is part of what raises an alert’s risk rating and escalation urgency.
Business Email Compromise (BEC): Phishing’s no-payload variant: an email impersonating an executive, vendor, or counterparty that asks the recipient to move money or change payment details. With no attachment to detonate and no link to rewrite, gateway verdicts stay quiet; the evidence lives in lookalike domains, display-name and reply-to mismatches, and hijacked threads sent from a compromised counterparty’s real mailbox. Consistently among the costliest cybercrime categories by reported losses.

C

California Consumer Privacy Act (CCPA): A law that regulates the collection, use, and protection of personal data in California.
Cardholder Data Environment (CDE): Systems and networks that store, process, or transmit payment card data and must comply with PCI DSS requirements.
certutil.exe: A Windows command-line tool used for certificate management and sometimes exploited by attackers for malicious purposes.
CIA Triad: Core principles of information security: Confidentiality, Integrity, and Availability.
Cloud Security Posture Management (CSPM): Tools and processes that continuously monitor cloud infrastructure for misconfigurations, compliance violations, and security risks.
Command and Control (C2): Infrastructure used by attackers to communicate with and control compromised systems within a target network.
Command Line: In SOC analysis, the argument string a process was launched with. Often the load-bearing forensic field on an EDR alert because it reveals what the process was actually told to do.
Command Line Analysis: The examination of command-line parameters, arguments, and execution context to understand process behavior and intent.
Common Event Format (CEF): A standardized log format designed to simplify event management across security devices and systems.
Common Vulnerability Scoring System (CVSS): A standardized way to assess the severity of security vulnerabilities.
Compliance: Adherence to regulatory requirements, industry standards, and security frameworks that govern data protection and system security.
Concatenation: The process of combining multiple strings or commands, often used by attackers to bypass security controls or obfuscate malicious code.
Configuration Management Database (CMDB): A database of an organization’s systems and services (configuration items) and the relationships between them; during triage an analyst queries it to learn what an alerting system actually is: its owner, business role, criticality, and dependencies. A stale CMDB is a common reason a scoping question takes hours instead of minutes.
Containers: A lightweight workload isolation unit that shares the host operating system’s kernel instead of running its own, making its isolation boundary weaker than a virtual machine’s. For triage, containers mean ephemeral evidence: a compromised container can be torn down and rescheduled before anyone looks at it, so telemetry shipped off the container is often all that remains.
Containment: The incident-response phase between detection and eradication: isolate the affected hosts, revoke the compromised credentials, block the C2 destinations, freeze the situation so it stops getting worse while the investigation continues.
Credential: Whatever the system accepts as proof of identity: a password, an API key, an OAuth token, a Kerberos ticket, an NTLM hash. Credentials are the highest-value loot in most intrusions; their theft is usually the pivot point.
Critical Infrastructure: Systems and services whose disruption would endanger public safety, economic stability, or national security: power, water, healthcare, financial services, telecommunications, and similar sectors. The United States designates 16 critical infrastructure sectors by presidential directive (PPD-21, reaffirmed by NSM-22) with CISA as national coordinator; organizations in them face heightened nation-state targeting and sector-specific incident-reporting obligations.
Cybercriminals: Individuals or groups who use technology to commit crimes, including data theft, fraud, and system compromise for financial gain.

D

Data Breach: The unauthorized access, theft, or exposure of sensitive data.
Data Exfiltration: The unauthorized transfer of data from a computer or network to an external location or system.
Data Integrity: Ensuring data is accurate, complete, and unaltered during storage, processing, and transmission.
Data Loss Prevention (DLP): A set of tools and processes that help prevent sensitive data from being lost, stolen, or compromised.
Data Retention: How long logs, telemetry, and other records are kept before they roll off or are purged. Retention windows bound every investigation: if the intrusion began before the oldest retained log, the earliest attacker activity cannot be reconstructed from logs and may be recoverable only through host or disk forensics, if at all.
Deception Technology: Security tools and techniques that deploy decoys and traps to detect, deflect, and analyze unauthorized system access attempts.
Deep Packet Inspection (DPI): Inspecting the full contents of network packets, payload included, rather than only headers and flow metadata. This is what lets a network sensor see the actual request, file, or command inside the traffic, though pervasive encryption steadily shrinks what it can read.
Detection Engineering: The discipline of building, testing, tuning, and retiring detection logic as an engineered product: version-controlled rules, measured false-positive rates, coverage mapped against ATT&CK. Triage feeds it every time a close records why an alert was right or wrong; a SOC without that feedback loop is running detections nobody maintains.
Detection Logic: The rule, model, or heuristic that decides whether a given input fires an alert. The logic that produced the alert matters as much as the alert it produced; two engines can name the same alert for very different reasons.
Detection Mechanism: Tools or methods employed to identify security incidents, including signature, anomaly, and behavioral detections.
Device Fingerprint: A unique identifier derived from hardware or software characteristics used to recognize devices.
Digital Forensics: The analysis and examination of digital evidence to investigate and solve crimes or security incidents.
Digital Signatures: Cryptographic techniques that validate the authenticity and integrity of digital messages or documents.
Disaster Recovery: The capability to restore systems and data after a destructive incident, most often tested by ransomware. Attackers deliberately disable it first, so alerts showing backup deletion, shadow copy removal, or tampering with recovery tooling warrant immediate escalation.
Distributed Denial-of-Service (DDoS): A type of attack where multiple systems are used to flood a targeted system or network with traffic in an attempt to overwhelm it.
DLL Loading: The process of loading Dynamic Link Libraries into a program’s memory space, which can be exploited by attackers for malicious code execution.
DLL Search Order Hijacking: A persistence and privilege-escalation technique that places a malicious DLL where an application looks for libraries before the legitimate location, so a trusted, signed binary loads attacker code. Detected by watching for DLLs loaded from application or user-writable directories instead of their expected system paths.
Domain: Either a DNS name like example.com that identifies internet infrastructure, or a Windows Active Directory domain, the identity and authentication boundary attackers aim to own; context makes the sense clear. As an indicator, a DNS domain’s age, registrar, and reputation are among the first pivots in triage.
Domain Admin: The most powerful account class in a Windows Active Directory domain: full administrative control over every domain-joined host, every domain user, and the directory itself. Compromise of a Domain Admin account is generally treated as a domain compromise.
Domain-based Message Authentication, Reporting, and Conformance (DMARC): An email authentication policy protocol built on SPF and DKIM: the domain owner publishes in DNS how receivers should treat mail that fails alignment (monitor, quarantine, or reject) and where to send reports. During phishing triage, a DMARC failure on mail claiming to come from a trusted domain is strong spoofing evidence.
Domain Controller: A server that responds to security authentication requests in a Windows domain environment.
Domain Depth: The number of subdomain levels beneath the registered domain in a fully qualified domain name; a.b.example.com has a depth of two below example.com. Depth is a triage feature: DNS tunneling and machine-generated phishing infrastructure tend to produce long subdomain chains, while most legitimate names stay shallow.
Domain Name System (DNS): The distributed system that resolves human-readable names to IP addresses. For an analyst it is one of the richest telemetry sources available: nearly every connection begins with a query, so DNS logs surface C2 lookups, tunneling, DGA noise, and newly registered domains that other data misses.
Domain Name System Exfiltration: A technique where data is covertly sent out of a network using DNS queries.
Domain Name System Query: A request sent to a DNS server to resolve a domain name into an IP address.
Domain Trusts: Authentication relationships between Active Directory domains that let identities in one domain access resources in another. Attackers enumerate and abuse trusts to extend a compromise across domain and forest boundaries, which makes the trust map a lateral-movement map.
DomainKeys Identified Mail (DKIM): An email authentication method in which the sending infrastructure signs selected message headers and a hash of the body with a private key, and receivers verify the signature against a public key published in the signing domain’s DNS. A valid signature shows the signing domain took responsibility for the message and that the signed content arrived unaltered; it says nothing about whether the content is safe.
Dwell Time: The interval between initial compromise and detection, measured per incident and tracked as a program metric. The reason retention windows matter (“did this start before the alert?”) is that dwell time is routinely longer than anyone’s comfort; sophisticated intrusions have historically measured it in weeks to months.
Dynamic Link Library (DLL): A Windows shared library whose code is loaded into a process’s address space at runtime. Module-load telemetry matters in triage because attackers run code inside trusted processes by supplying their own DLLs through injection, sideloading, or search-order hijacking.
Dynamic Prioritization: Adaptive adjustment of alert or incident priority based on contextual risk factors.

E

Electron Framework: A framework for building desktop applications from web technologies; Slack, VS Code, and Cursor are Electron apps. It matters in triage because Electron apps legitimately spawn helper processes with long vendor-standard command lines and sometimes disabled sandboxes, behavior that pattern-matches post-exploitation tooling, while a helper whose parent is not its own main app process is a genuine lineage anomaly.
Encoded Payloads: Malicious code or commands that have been transformed into a different format to avoid detection or bypass security controls.
Encryption: The process of converting plaintext data into unreadable ciphertext to protect it from unauthorized access.
Endpoint: A device that initiates network connections and runs user-facing software: laptop, desktop, server, phone, tablet. Endpoints are where most adversary tradecraft eventually shows up, which is why EDR exists.
Endpoint Detection and Response (EDR): Security technology that continuously monitors and responds to threats on endpoint devices, providing advanced threat detection and incident response capabilities.
Endpoint Security: The processes and technologies used to protect endpoint devices from security threats.
Enrichment: Adding context to a raw alert or indicator before or during triage: reputation and WHOIS for an IP, owner and criticality for an asset, role and department for a user, a sandbox verdict for a file. Automated enrichment is what SOAR pipelines do best; the analyst’s judgment starts where the enrichment stops answering the question.
Entity: Any discrete actor or object that evidence can attach to during an investigation: a user account, a host, a process, an IP address, a domain, a file. Triage decomposes an alert into its entities and asks what each one was doing; the same idea gives UEBA its E.
Entropy Scoring: A method to measure randomness or complexity in data, often used to detect obfuscation or encryption.
Ephemeral Computing: Infrastructure that exists only as long as its task: containers, serverless functions, and autoscaled instances created and destroyed on demand. It matters in triage because the evidence dies with the workload; unless telemetry was shipped off the resource while it lived, there is nothing left to examine by the time the alert is read.
Eradication: The phase of incident response focused on completely removing threat actors and malicious artifacts from affected systems.
Escalation Matrix: A predetermined framework defining when and how to elevate security incidents to higher levels of response based on severity and impact.
Evasion: Techniques used by attackers to avoid detection by security tools.
Event: An observable thing that happened: a process executed, a user logged in, a file changed, a packet was sent. Events are what produce alerts when detection logic decides they’re interesting. Most events are not alerts; most alerts are events.
Event Context: The surrounding facts that give a security event meaning: who the user is, what the host is for, what happened immediately before and after, and whether the activity is normal for that identity at that time and place. Context is what lets an analyst turn an isolated observation into a verdict.
Event Correlation: The process of analyzing multiple events across different sources to identify relationships and determine if they are part of a larger security incident.
Event Triage: The phase that sits between detection and incident response: deciding whether an alert is real, whom it concerns, what its blast radius might be, and whether it crosses an escalation threshold. The ASSURED methodology is a structured way to do triage.
Excessive Permissions: User or process privileges beyond what is necessary for their role, increasing security risk.
Exfiltration: The unauthorized transfer of data from a system or network, often as part of a data breach or espionage operation.
Exploit: A technique or piece of code that turns a vulnerability into actual capability: remote code execution, privilege escalation, authentication bypass. A vulnerability without an exploit is theoretical; a vulnerability with one is operational.

F

False Negative: Malicious activity that produced no alert: the detection logic missed it, or no logic covers it. Invisible by definition at triage time, false negatives surface later through hunting, incident investigation, or an external notification, and each one found is a detection-engineering work item. The other half of the confusion matrix from the false positive, and the more expensive half.
False Positive: A security alert that fires on activity that is, on inspection, benign. The detection logic matched a pattern that looked malicious but was not. Distinct from a benign true positive, which is real adversary-like activity that does not warrant action in the local context.
False-Premise: An incorrect assumption or conclusion about a security event that leads to improper investigation or response.
Federation: Linking identity across independent systems or organizations so that a trusted identity provider authenticates users on behalf of services it does not operate, typically via SAML or OIDC. Matters in triage because every relying service delegates authentication to the identity provider: a compromise there, such as a stolen signing key used to forge assertions (Golden SAML), can mint access to any federated service.
Feedback Loop: A process where information from outcomes is used to improve future detection or response.
FIDO2: An authentication standard enabling passwordless login using biometrics or security keys.
File Integrity Monitoring (FIM): A security control that detects unauthorized changes to files or configurations.
Firewall: A network security system that controls and monitors incoming and outgoing traffic based on predetermined security rules.
Forensics: The application of scientific methods to collect, preserve, and analyze digital evidence for security investigations and incident response.
Fully Qualified Domain Name (FQDN): The complete domain name specifying its exact location in the DNS hierarchy.

G

General Data Protection Regulation (GDPR): European Union regulation establishing requirements for processing and protecting personal data, with specific security and breach notification requirements.
Geolocation: The process of determining the physical location of a device or IP address.

H

Hashes: Cryptographic functions that generate fixed-size values representing digital data, used for file integrity verification and malware identification.
Health Insurance Portability and Accountability Act (HIPAA): U.S. legislation that sets standards for protecting sensitive patient health information, including specific security and privacy requirements.
Heuristic Detection: A detection method that uses rules and patterns to identify potentially malicious behavior based on common characteristics of malware or attacks.
Honeypot: A decoy system designed to lure attackers and study their tactics.
HTA Content: Script content delivered as an HTML Application (.hta file), which Windows executes through mshta.exe with the local user’s full privileges rather than inside the browser sandbox. A recurring phishing and living-off-the-land vector, which is why mshta.exe spawning from a browser or email client draws analyst attention.
Hypertext Transfer Protocol (HTTP): The request-response protocol that carries most web traffic between clients and servers. Triage-relevant because attacker traffic blends into it: C2 beacons, payload downloads, and exfiltration ride HTTP precisely because it is allowed almost everywhere, and its URIs, headers, and user-agent strings are core investigation fields.
Hypertext Transfer Protocol Secure (HTTPS): Secure version of HTTP using encryption to protect data in transit.

I

Impact: The potential effect or damage caused by a security incident.
Incident: A confirmed compromise of confidentiality, integrity, or availability: an alert (or series of alerts) that triage has validated as real adversary activity, warranting an IR response. An event becomes an incident at the verdict, not at the alert.
Incident Command: A structured leadership model used to manage complex security incidents.
Incident Response: The organized approach to addressing and managing the aftermath of a security breach or cyberattack, including preparation, detection, analysis, containment, eradication, and recovery.
Indicators of Compromise (IoC): Atomic, replayable artifacts that, when observed, suggest an intrusion has occurred or is in progress: file hashes, IPs, domains, registry keys, certificate fingerprints, and similar discrete observables. Behavioral patterns (process trees, sequence of actions) are not IoCs; they live one layer up as TTPs.
Information Security: The practices and technologies used to protect information and data from unauthorized access, use, disclosure, disruption, modification, or destruction.
Information Sharing and Analysis Centers (ISACs): Industry groups that share cyber threat information.
Infrastructure: The systems, networks, and services that computing runs on. In triage the word points two directions: the organization’s infrastructure is what alerts fire on, and attacker infrastructure is the set of C2 servers, domains, and staging hosts an adversary operates, which pivoting on indicators is meant to map.
Insider Risk: The potential for harm from individuals with legitimate access arising from mistakes, policy violations, or unsafe habits, not from intent. Distinct from insider threat, which is deliberate.
Insider Threat: A person with authorized access who deliberately misuses it to harm the organization through theft, sabotage, or assisting external attackers. Distinct from insider risk, which also covers unintentional harm from negligence or mistakes.
Insider Threat Matrix: A public framework maintained at insiderthreatmatrix.org that catalogs insider techniques across motive, means, preparation, infringement, and anti-forensics. Useful as a shared vocabulary for describing insider risk and threat.
Integrated Development Environment (IDE): Software developers use to write, run, and debug code, such as VS Code, Cursor, or IntelliJ. IDEs matter in triage because their normal operation, spawning helper processes, executing scripts, running plugin hosts with sandboxes disabled, and making encrypted outbound calls, routinely pattern-matches post-exploitation behavior on developer workstations.
Intelligence: Information gathered and analyzed to understand and predict potential security threats.
Inter-Process Communication: Operating system mechanisms that let running processes exchange data, such as named pipes, shared memory, and local sockets. Triage-relevant because malware abuses these channels for command-and-control, privilege escalation, and coordination between implant components; named-pipe telemetry in particular is a staple of EDR detections for tooling like Cobalt Strike.
Internet of Things (IoT): Network of physical devices embedded with sensors, software, and connectivity, introducing new security challenges due to their often limited security capabilities.
Internet Protocol (IP) Address: The numeric address a device uses to send and receive network traffic, and one of the most common pivot points in triage: reputation lookups, geolocation, WHOIS ownership, and log correlation all key on it. Treat it as a weak proxy for identity, since NAT, VPNs, proxies, and shared cloud egress can put many actors behind one address.
Intrusion Detection System (IDS): Security system that monitors network traffic for suspicious activity and policy violations, generating alerts for potential security incidents.
Intrusion Prevention System (IPS): Security system that not only detects but actively blocks or prevents identified suspicious activity and policy violations.
Isolation Forests: A machine learning algorithm used for anomaly detection by isolating anomalies in data.

J

JA3: A method for fingerprinting TLS client applications by hashing specific fields in the TLS Client Hello packet. Degraded against modern clients: Chrome’s extension-order randomization (2023) and GREASE values fragment a single client into many hashes.
JA3S: The server-side counterpart to JA3, it fingerprints TLS servers by hashing fields in the Server Hello packet.
JA4: The 2023 successor to JA3 from FoxIO. A modernized TLS-client fingerprint that sorts extensions before hashing (defeating randomization), handles TLS 1.3, and covers QUIC natively via a leading “q” or “t” transport marker. Part of the JA4+ suite, which adds separate fingerprints such as JA4H (HTTP client) and JA4S (TLS server).

K

Kerberoasting: Requesting Kerberos service tickets (TGS) for accounts with Service Principal Names (SPNs) and cracking them offline. With the legacy RC4 encryption type the ticket is encrypted using a key equal to the service account’s NTLM hash, so a weak service-account password becomes a crackable ciphertext (AES-only accounts crack far more slowly), and any user who can authenticate to the domain can request the ticket.
Kerberos: A network authentication protocol using tickets to allow secure identity verification.
Kubernetes: The dominant container orchestration platform and an attack surface in its own right: exposed API servers, over-permissioned service account tokens, and container escapes can turn one compromised workload into a path across the cluster. Analysts meet it through Kubernetes audit logs and runtime telemetry, where short-lived pods complicate reconstructing what was running when an alert fired.

L

Lateral Movement: Adversary traversal from the initial-access host to other hosts inside the environment. Each hop expands the blast radius and adds new entities for Subject analysis. Often piggybacks on legitimate authentication, which is what makes it hard to detect.
Least Privilege: The principle of granting users or systems only the necessary permissions and access to perform their tasks.
Legacy Systems: Outdated technology or systems that remain in use, often with security vulnerabilities.
Lessons Learned: Insights gained from past incidents or activities to improve future security posture.
Likelihood: The probability that a threat will exploit a vulnerability.
Liveness Detection: Techniques used to verify that biometric inputs are from a live person, not a spoof.
Living-Off-The-Land (LotL): Attack technique utilizing legitimate, built-in system tools and features to conduct malicious activities while evading detection.
Log: A timestamped record of an event emitted by a system, application, or security control. Logs are the raw evidence of triage: the alert points at a moment in time, and the surrounding log entries are how the analyst reconstructs what actually happened.
Log Parsing: The systematic process of analyzing and extracting relevant information from system, application, and security logs for investigation and threat detection.

M

Malware: Software whose author intends harm: ransomware, trojans, worms, viruses, spyware, wipers, rootkits, RATs. The B.A.D. glossary catalogs the families in detail.
Mandatory Access Control: An access policy where permissions are centrally controlled and enforced based on classifications.
MD5: A widely used hash function that produces a 128-bit hash value, though now considered weak.
Mean Time To Respond/Resolve (MTTR): A metric measuring how quickly incidents are resolved.
Metadata: Data about data: file timestamps, owner, size, hash; an email’s headers; a process’s parent, command line, and signing certificate. In triage, metadata is often more diagnostic than the content itself.
Mitigation: Action that reduces a risk without eliminating it: a compensating control, a workaround, a temporary block. Distinct from remediation, which fixes the underlying issue.
MITRE ATT&CK: A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations, used for threat modeling and security operations.
MITRE Procedures: Specific implementation methods used by threat actors to accomplish techniques within the ATT&CK framework.
MITRE Tactics: Categories representing the tactical goals of adversaries during an attack, such as initial access, execution, persistence.
MITRE Techniques: Specific methods used by adversaries to achieve tactical goals within the ATT&CK framework.
Mshta.exe: A Windows utility for executing Microsoft HTML Applications, sometimes exploited by attackers.
Multi-Cloud Environment: Infrastructure utilizing multiple cloud service providers, introducing complex security challenges in maintaining consistent security controls and visibility.
Multi-Factor Authentication (MFA): Security system requiring two or more verification methods to grant access, combining something you know, have, or are.

N

Network Access Control (NAC): Security solutions that enforce policies on devices trying to access a network.
Network Segmentation: The division of a network into smaller, isolated segments to improve security and reduce the attack surface.
Network Traffic: The data moving between hosts on a network, observed as connections, flows, and packets. In triage, traffic metadata (who talked to whom, when, how much, and over which port and protocol) is often the fastest way to confirm or rule out command and control, exfiltration, or lateral movement.
Normalization: Converting logs and events from different sources into a common field schema so a username, IP, or timestamp means the same thing regardless of which tool recorded it. SIEM correlation rules and cross-source queries depend on it; fields that were never normalized are where searches silently miss.

O

Obfuscation: Techniques used to make code, commands, or data difficult to understand or detect, used both by attackers and legitimately for IP protection.
OpenC2: An open standard for command and control of cyber defense components.
Organizationally Unique Identifier (OUI): The first 24 bits of a MAC address, assigned by the IEEE to a specific organization, typically a hardware vendor. Looking up the OUI turns an unknown MAC into a vendor name when hunting rogue or unmanaged devices, but modern endpoints often randomize their MAC addresses, so a lookup that fails or returns nonsense may indicate privacy randomization rather than a real device identity.
Orphaned Credentials: Access credentials no longer associated with an active user or process, posing a security risk.

P

Packet Capture Files (PCAP): Files used to record network traffic for analysis.
Parsing: Breaking a raw alert, log line, or command string into its component fields so each can be examined on its own: the user, the host, the action, the time. In triage, parsing the alert is the first move; the details that decide a verdict live in the fields, not in the alert name.
Pass-the-Hash: An attack technique that allows an attacker to authenticate to a remote server/service using the underlying NTLM or LM hash of a user’s password instead of the password itself.
Pass-the-Ticket: Kerberos analog of pass-the-hash. The attacker presents a stolen TGT (Ticket Granting Ticket) or TGS (Ticket Granting Service ticket) to authenticate as that identity against any service in the realm, without ever needing the user’s password. Often paired with Mimikatz extraction of LSASS memory. MITRE T1550.003.
Password: A secret word or phrase used to authenticate a user or system.
Patch Management: The process of applying updates and fixes to software and systems to repair vulnerabilities and improve security.
Payment Card Industry Data Security Standard (PCI DSS): Security standards designed to ensure companies that accept, process, store, or transmit credit card information maintain a secure environment.
Peer Validation: Having a second analyst review a triage verdict or escalation decision before it is finalized. A standard SOC quality control, because a fresh set of eyes catches assumptions and confirmation bias the original analyst can no longer see.
Penetration Testing: A simulated attack on a system or network to test its defenses and identify vulnerabilities.
Persistence: Mechanisms an adversary installs so their access survives reboots, password resets, and partial cleanups: Run keys, scheduled tasks, services, WMI subscriptions, browser extensions. Mature operators plant several anchors so removing one is not enough.
Personally Identifiable Information (PII): Data that can uniquely identify an individual.
Phishing: Deceptive messages (usually email; sometimes SMS, voice, or chat) that impersonate a trusted sender to lure the recipient into clicking, opening, or entering credentials. The bait is the email; the line is the impersonation; the catch is initial access.
Playbook: A predefined, repeatable procedure for handling a specific alert or incident type: the steps, the decision points, the exit criteria. Playbooks encode the SOC’s institutional memory so the response does not depend on who is on shift; SOAR platforms automate their mechanical steps. The fast path’s pattern library is a playbook collection with discriminators attached.
Polymorphic Malware: Malicious software that constantly changes its identifiable features to avoid detection by traditional signature-based security tools.
Port: A 16-bit number from 0 to 65535 carried in TCP and UDP headers that tells a host which service or process the traffic belongs to: 443 for HTTPS, 22 for SSH, 3389 for RDP. In triage, ports are a cheap tell; a standard service on a nonstandard port, or traffic to a port that should not be listening, is worth a second look.
Post-Mortem: The structured retrospective an organization runs after a closed incident: timeline, decisions, what worked, what failed, what the team learned. A good post-mortem points back at detection, process, or training gaps. A blameless one names the system, not the person.
PowerShell: A command-line shell and scripting language built on the .NET framework, commonly used for system administration and potentially for malicious purposes.
Pretexting: Social engineering built on an invented scenario rather than a malicious payload: the caller claiming to be IT support, the “CEO” emailing about an urgent confidential deal, the vendor with new bank details. The pretext gives the target a plausible reason to comply. The delivery mechanism behind business email compromise and most voice phishing.
Privilege Escalation: Gaining access at a higher trust level than the actor originally held, by any means: exploiting a bug, abusing a misconfiguration, stealing credentials, impersonating a token, or socially engineering an elevation.
Privileged Access Management (PAM): Technologies that control and monitor access to critical accounts.
Process: A running instance of a program, with a process ID, a parent process, a command line, and the user context it executes under. Process ancestry, meaning which process spawned which, is often the fastest triage signal for whether an execution is routine or suspicious.
Process Relationships: The connections and interactions between different processes running on a system, including parent-child relationships and inter-process communication.
Protected Health Information (PHI): Individually identifiable health information protected under HIPAA: a person’s health status, the care they received, or payment for that care, linked to their identity. Alerts touching systems that hold PHI raise the escalation stakes, because exposure carries regulatory breach-notification duties.
Protocol: The agreed set of rules two systems use to communicate: HTTP, DNS, SMB, RDP. In triage the protocol tells you what a connection is capable of doing, and a mismatch between the protocol and the port it runs on is a classic tell for tunneling or evasion.

R

Ransomware: Malicious software that encrypts a victim’s files and demands payment (usually cryptocurrency) for the decryption key. Modern ransomware operations typically pair encryption with data theft, threatening public release if the ransom is not paid (double extortion).
Regsvr32.exe: A Windows utility used to register and unregister DLLs, sometimes exploited by malware.
Regulatory Compliance: Adherence to laws, regulations, and standards governing data protection, privacy, and security requirements for specific industries or data types.
Regulatory Requirements: The legal and contractual obligations that attach to specific data types and industries, such as GDPR, HIPAA, and PCI DSS (a card-industry standard enforced by contract rather than statute), including breach-notification deadlines. They matter in triage because an incident touching regulated data starts a clock the response has to honor.
Relationship Mapping: The process of identifying and visualizing connections between entities like users, systems, or processes.
Reliability Assessment: Evaluating the trustworthiness and accuracy of security data or alerts.
Request for Comments (RFC): The numbered document series in which internet protocols and standards are defined. The one every analyst ends up citing is RFC 1918, which reserves the private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that tell you at a glance whether an IP is internal or external.
Risk: Impact times likelihood, weighted by the analyst’s confidence in the evidence. Risk is what turns a finding into a prioritized response; it’s the verdict the rest of the team acts on.
Risk Appetite: The amount of risk an organization is willing to accept in pursuit of objectives.
Risk Assessment: Systematic process of evaluating potential risks to system and data security, including likelihood and impact analysis.
Risk-Based Alert Triage Matrix: A tool to prioritize alerts based on risk factors to improve response effectiveness.
Risk Management: The process of mitigating, transferring, or accepting risk to minimize its impact on an organization.
Risk Profile: An assessment of risks associated with assets, users, or processes.
Role-Based Access Control (RBAC): A model that assigns permissions based on user roles.
Root Cause Analysis: The process of identifying the underlying cause of a security incident or problem.
Rule-Based Detection: Security monitoring approach using predefined rules to identify suspicious or malicious activity based on specific conditions or patterns.
Runbook: Step-by-step operational instructions for one concrete task: rotate this credential, isolate this host, pull this log. Narrower than a playbook. A playbook decides what to do; a runbook specifies exactly how to do one of its steps.
Rundll32.exe: A Windows utility that executes functions in DLL files, sometimes used maliciously.

S

Sandboxing: Detonating an unknown file or URL inside an isolated environment to observe what it does. Mature malware checks for sandbox-typical signals (small disk, brief uptime, no mouse activity, suspicious driver names) and stays dormant until it sees a real host.
Sarbanes-Oxley Act (SOX): A 2002 United States federal law that mandates accurate financial reporting and internal controls at publicly traded companies. It matters to security because its Section 404 internal-control audits pull IT general controls into scope, driving access control, change management, and audit logging requirements on systems that feed financial statements and raising the criticality of those assets during triage.
Schema Normalization: Mapping events from different log sources into one common field schema, such as ECS, OCSF, or Splunk CIM, so that a username or source IP carries the same field name in every query. Cross-source correlation in a SIEM depends on it.
Scope: The defined boundaries of a security investigation or incident response, including affected systems, timeframes, and areas of concern.
Scope Creep: Uncontrolled expansion of an incident investigation beyond its initial parameters, potentially consuming excessive resources without proportional benefit.
Secure Email Gateways (SEG): Security solutions that filter and protect email communications from threats.
Secure Hash Algorithm (SHA): A family of cryptographic hash functions used for data integrity.
Secure Shell (SSH): A protocol for secure remote login and command execution.
Secure Sockets Layer (SSL): A deprecated protocol for encrypting internet communications, replaced by TLS.
Security Control: A measure or mechanism used to prevent, detect, or respond to a security threat or incident.
Security In Depth: Layering multiple overlapping controls at the network, endpoint, identity, and monitoring levels so that a single control failing does not mean compromise; more commonly called defense in depth. For triage it means one layer’s alert can usually be corroborated or refuted with telemetry from another layer.
Security Information and Event Management (SIEM): Platform that collects, aggregates, and analyzes security data from multiple sources to provide real-time monitoring, correlation, and incident response capabilities.
Security Operations: The people, processes, and technology responsible for monitoring, detecting, investigating, and responding to security threats within an organization.
Security Orchestration, Automation, and Response (SOAR): Platforms that codify SOC workflows into playbooks: enrich an alert, query telemetry, look up an indicator, open a case, page on-call. SOAR makes the repetitive parts of triage repeatable.
Sender Policy Framework (SPF): An email validation protocol to prevent sender address forgery.
Sensitive Data: Information that is confidential, proprietary, or regulated, such as personal data, financial information, or intellectual property.
Separation of Duties: A control to prevent fraud by dividing responsibilities among multiple people.
Server: A host whose role is to provide services to other systems rather than to a person at a keyboard. The distinction drives triage: web browsing and office documents are routine on a workstation but anomalous on a server, an interactive server login warrants checking who made it since only administrators should have a reason to, and a compromised server typically exposes data or downstream users at scale.
Server Message Block (SMB): A network protocol for file shares, printer access, and remote administration, native to Windows but also implemented by Samba and NAS appliances, running on TCP port 445 (legacy port 139 over NetBIOS). A staple of lateral movement: administrative shares, PsExec-style remote execution, and exploits such as EternalBlue, used by the WannaCry worm, all travel over SMB.
Serverless Functions: Cloud-computing execution model where cloud providers manage infrastructure, presenting unique security monitoring and access control challenges.
Side-Loading: A technique where attackers exploit legitimate applications to load malicious DLLs or code, often bypassing security controls.
Signature-Based Detection: Security method that identifies threats by matching observed activity against a database of known malicious patterns or signatures.
Signature Database: A repository of known threat signatures used by security tools.
Signature Management: The process of updating and maintaining detection signatures in security systems.
Single Sign-On (SSO): An authentication process allowing a user to access multiple systems with one set of credentials.
Social Engineering: Manipulating people into divulging confidential information or performing actions that compromise security.
Structured Threat Information Expression (STIX): A standardized format for sharing cyber threat intelligence.
Subject: An entity, such as a user or system, that is involved in a security incident or event.
Supply Chain: The network of organizations, people, activities, and resources involved in creating and delivering products, presenting multiple attack vectors for compromising systems or software during development and distribution.
Suppression: A deliberate rule that stops a detection from alerting on a defined pattern, host set, or time window: the pressure valve for known noise. Suppression trades visibility for signal, so every suppression carries a documented reason and an owner and gets revisited. An unsuppressed noisy rule burns analysts; an unreviewed suppression hides an intrusion.
Syslog: A standard protocol for message logging in network devices and systems.
System Binary: An executable that ships with the operating system or other trusted, usually signed, software: cmd.exe, powershell.exe, certutil.exe, rundll32.exe. Central to triage because living-off-the-land attacks abuse these trusted binaries, so the question is rarely whether the binary is legitimate but whether its parent, arguments, and timing are.

T

Tactics, Techniques, and Procedures (TTP): The behavioral patterns of a threat actor, in increasing specificity: tactics (goals), techniques (methods), and procedures (concrete implementations). Used to characterize and attribute adversary behavior across campaigns.
TCP Connection: A network communication session established between two hosts using the Transmission Control Protocol.
Telemetry: Collection and transmission of security-relevant data from remote sources for monitoring and analysis.
Temporal Relationships: The timing and sequence correlations between events that help in threat detection and analysis.
Threat: An actor (or capability) with intent and means to cause harm. A vulnerability is what they exploit. Classical risk models multiply threat, vulnerability, and impact; ASSURED’s RATM folds the threat and vulnerability questions into likelihood, so risk stays impact times likelihood.
Threat Actor: Individual or group that conducts malicious activities targeting information systems or networks.
Threat Hunting: Proactive analysis that starts from a hypothesis (“if an attacker were here, what would I expect to see?”) and searches telemetry for evidence. Distinct from alert triage, which reacts to detections; hunting goes looking for what the detections missed.
Threat Intelligence: Evidence-based knowledge about existing or emerging threats, including context, mechanisms, indicators, implications, and actionable advice.
Ticket: The case record that tracks an alert or incident through investigation: who owns it, what was found, what verdict was reached, and when it was closed. In a SOC the ticket is both the unit of work in the queue and the documentation trail that escalation, metrics, and future investigations depend on.
Time To Live (TTL): In IP, a hop counter that each router decrements so stray packets are discarded instead of looping forever; in DNS, the number of seconds a resolver may cache a record before re-querying. The DNS sense usually matters most in triage: very short TTLs let attacker infrastructure rotate addresses quickly, as in fast-flux hosting, though CDNs and load balancers use short TTLs legitimately as well.
Timeline: A chronological record of events, actions, or decisions related to a security incident or event.
Token: A small piece of data or code that is used to authenticate or authorize access to a system or resource.
Transport Layer Security (TLS): A protocol for encrypting internet communications.
Trojan: A type of malware that disguises itself as legitimate software to gain unauthorized access to a system or network.
True Negative: Benign activity that correctly produced no alert. The silent majority of everything a detection evaluates, and the reason a small false-positive rate still buries a queue once multiplied by volume. Completes the confusion matrix alongside true positive, false positive, and false negative.
True Positive: A security alert that fires on activity that is, on inspection, actual adversary behavior. The opposite of a false-positive, and the case the SOC exists to handle.
Tuning: Adjusting detection logic against observed results: tightening a threshold, adding an exclusion, enriching a rule with context so it stops firing on the environment’s normal. Tuning is the routine output of triage closes (the false-positive-as-finding doctrine) and the difference between an alert queue that improves and one that only grows.

U

Unauthorized Access: Access to a system, network, or resource without proper authorization or permission.
Uniform Resource Locator (URL): The address of a resource, made up of a scheme (such as http, https, or ftp), a host, and usually a path and query string. In triage the host carries reputation and lookalike-domain signals, while the path and query parameters often reveal the phishing kit, payload, or staging location.
User: The identity behind activity on a system: the account that authenticated, launched the process, or received the email. In triage the user field names an account, not necessarily a person; whether the legitimate owner was actually behind the activity is exactly the question stolen credentials raise.
User Account: A unique identity or profile used to authenticate and authorize access to a system or resource.
User and Entity Behavior Analytics (UEBA): Security technology that uses advanced analytics to build standard profiles of user and entity behavior, detecting anomalies that might indicate threats.

V

Variable Expansion: The shell’s replacement of a variable reference, such as %TEMP% or $HOME, with its actual value when a command runs. Attackers lean on expansion to obfuscate command lines, so the analyst has to evaluate what the command becomes after expansion, not the literal string that was logged.
Variable Substitution: Programming technique often exploited by attackers to obscure malicious commands by replacing literal values with variables, making detection more difficult.
Virtual Desktop Infrastructure (VDI): Desktop operating systems running as virtual machines on centralized infrastructure, accessed through remote display sessions rather than on the user’s own hardware. Triage is harder because pooled host names and shared egress IPs are recycled across users over time, and non-persistent desktops are wiped at logoff, destroying local forensic artifacts unless telemetry is centralized.
Virtual Private Network (VPN): A secure tunnel that encrypts traffic between a user and a network.
Vulnerability: A defect in a system that can be turned into adversary capability if paired with an exploit and exposure: an unpatched CVE, a misconfiguration, a default credential, a logic flaw. Vulnerability without exposure or exploitability is latent; with both, it’s a finding.
Vulnerability Management: Systematic practice of identifying, classifying, prioritizing, remediating, and mitigating security vulnerabilities across an organization’s systems and software.

W

Wildcard DNS: A DNS configuration that resolves all subdomains under a domain to a specified address.
Windows Event Logs: Logs generated by Windows operating systems recording system, security, and application events.
Windows Management Instrumentation Command-line (WMIC): A tool for managing Windows systems via scripting. Deprecated by Microsoft since Windows 10 21H1 (2021); a Feature on Demand disabled by default in Windows 11 23H2/24H2 and removed entirely starting with 25H2, though it lingers on older and upgraded systems, which is why it remains a favorite LOLBin in active intrusions. The modern equivalent is PowerShell’s Get-CimInstance / Invoke-CimMethod against the same WMI namespaces.

Z

Zero-Day Vulnerability: A vulnerability for which no patch is yet available, either because the vendor has not shipped one or because the vendor does not yet know the bug exists. Called “zero-day” because that is the number of days defenders have had to prepare. Exploitation is not a definitional prerequisite; a zero-day can exist before any exploit appears.

Quiz

C.L.E.A.R. self-check

Three questions on the vocabulary distinctions the lexicon exists to settle.

/* @layer base: Tailwind's preflight hides [hidden] with an !important rule inside @layer base, and layered !important beats unlayered !important — an unlayered override here silently loses. Same layer, higher specificity wins. */ @layer base { .quiz-item__feedback[hidden] { display: block !important; } } .quiz-item__feedback [data-verdict] { display: none !important; } .quiz-item__feedback-label { display: inline-block; padding: 0.2rem 0.6rem; border-radius: 9999px; font-size: 0.75rem; font-weight: 700; letter-spacing: 0.06em; text-transform: uppercase; margin-bottom: 0.6rem; background: rgba(148, 163, 184, 0.18); color: #bfc9d6; }

In the C.L.E.A.R. definition, what is an alert?

Telemetry shows a clear deviation from a user's baseline. What does calling it an anomaly commit the analyst to?

A user presents a valid password and hardware token, then opens a folder their role should never reach. Which control failed?