The C.L.E.A.R. Glossary

A

Actionability

Alerts whose activity verdict is malicious or policy violation, divided by alerts with a verdict. Beside precision, it separates rules that need exceptions or enrichment from rules that need logic fixes. Detection engineering’s per-rule variant counts fires that needed any action beyond the close. See Measuring triage.

Admiralty Code

A two-character grading scheme for intelligence: a letter for source reliability (A, completely reliable, to E, unreliable, with F for cannot be judged) and a number for information credibility (1, confirmed by other sources, to 5, improbable, with 6 for cannot be judged). A B2 report comes from a usually reliable source and is probably true. Grade before acting, and record the grade with the indicator.

Admission Gate

In ASSURED, the seven organizational checks an AI assistant must pass before any case data reaches it, from an approved provider and data boundaries to least privilege with no outbound channel and a recorded human authorization. If any check is unapproved or unknown, the work follows the non-AI path. Full entry: ASSURED terms.

Adversary Emulation Plan

A step-by-step replay of one threat group’s documented procedures, used to test detections and produce realistic telemetry, such as the Center for Threat-Informed Defense’s APT29 plan. See Telemetry labs.

Adversary-in-the-Middle (AiTM)

A phishing technique in which a kit relays the victim’s real sign-in through an attacker-run proxy, capturing the password and the session cookie the identity provider issues after MFA. The attacker then replays the cookie from their own infrastructure, so MFA is satisfied once, by the victim, and never asked again. Push, SMS and OTP factors do not stop it; phishing-resistant factors (FIDO2 security keys, passkeys) do, because they are bound to the real site’s origin. Triage tells: a sign-in from a hosting ASN minutes after the user’s own, the same session presented from two networks, and a newly registered lookalike domain in the click path. ATT&CK T1557, ATT&CK T1539.

Agentic AI

Describes an AI system that plans and takes multi-step actions through tools (running queries, calling APIs, writing to systems) toward a goal, rather than answering a single prompt. Agentic triage tools enrich, query and draft verdicts on their own. In ASSURED they stay advisory above Level 0 parity, and their tool access is attack surface. See AI Agent and AI-assisted triage.

AI Agent

An AI system, usually built on a large language model, that plans and takes multi-step actions through tools: running queries, reading mailboxes, calling APIs, executing commands. In triage it is both a helper and a subject. As a helper, its tool access makes it attack surface, since text it reads can carry instructions (prompt injection, in the B.A.D. glossary). As a subject, an agent with delegated access is a non-human identity whose actions need the same Subject analysis as any service account. See AI-assisted triage. See Governing automated triage.

AI/ML (Artificial Intelligence / Machine Learning)

Machine learning has long powered anomaly and UEBA detections. Since 2023, large language models (LLMs) and AI agents also summarize alerts, draft queries and propose verdicts. ASSURED’s rule: accountability is never delegated. An assistant drafts and the analyst decides; a machine may close a case only at Level 0 parity, under a governed pattern entry. Verify every specific an LLM supplies, and treat an assistant with tool access as attack surface. See AI-assisted triage. See Governing automated triage.

Alert

An automated notification produced when detection logic decides an event might be malicious, anomalous, or in violation of policy. The detection engine’s hypothesis, not a verdict; the analyst makes the call.

Alert De-duplication

Consolidating identical or related alerts into one queue item so the same activity is not triaged twice. ASSURED goes further: alerts that share an entity and time window, a campaign indicator or a vendor incident ID form one case, and the case is the unit of work. See Case.

Alert Fatigue

The loss of attention that sets in when analysts face more alerts than they can judge carefully: checks get skipped and real intrusions get waved through as noise. The fixes are upstream (tuning, grouping alerts into cases, a governed Level 0 path), not exhortation. A rising close rate on one rule with ever-shorter close notes is an early sign.

Alert Parsing

Parsing applied to an alert: breaking it into its fields (user, host, process, command line, time) before judging it. See Parsing.

Alert Validation

The Alert-phase step that asks whether the detection’s reasons are supported by the evidence around it, before the analyst commits investigation time. Outcomes: likely true positive (proceed), benign true positive (document the authorized context), false positive (route to tuning), or cannot tell yet (proceed with the gap recorded).

Alerting and Detection Strategy (ADS)

Palantir’s documentation framework for a single detection (2017, MIT-licensed), in nine sections: Goal, Categorization, Strategy Abstract, Technical Context, Blind Spots and Assumptions, False Positives, Validation, Priority and Response. Alert reads it as the detection logic. An ADS describes one rule; a pattern entry is a governed close decision with discriminators, an owner and a second approver. See Standards mapping.

Analysis of Competing Hypotheses (ACH)

A structured analytic technique from Richards Heuer’s Psychology of Intelligence Analysis (CIA, 1999): list every reasonable hypothesis, score each piece of evidence against all of them, and favor the hypothesis with the least evidence against it rather than the most evidence for it. ASSURED’s hypothesis ledger is a lightweight form of it. See Cognitive traps.

Analyst Burnout

Exhaustion from sustained alert volume, night shifts and high-stakes calls. In triage it shows up as shortened investigations, skipped documentation, and attrition that takes institutional memory with it. Treat it as an operational risk, measured through queue load and shift patterns and fixed with tuning and staffing, not as a personal failing.

Anchor Exemplar

A written example of work at a known score, annotated against the grading grid, used to calibrate graders before they score. See Anchor exemplars.

Anchoring

A cognitive trap: over-weighting the first piece of information (the alert name, the vendor severity, the first hypothesis) and adjusting too little as evidence arrives. It bites in Alert and carries everywhere. Counter: write down the leading alternative explanation before testing the first. At a shift change or an escalation it takes the form of handoff anchoring: the receiver inherits the sender’s story as a finding. See Cognitive traps.

Anomaly

An observation that deviates from an established baseline. Anomalies are statistical, not inherently malicious; an analyst still has to decide whether the deviation matters.

Anomaly-Based Detection

One of the four detection families ASSURED teaches: the engine learns a baseline and alerts on deviations from it. It can catch activity no signature describes, at the price of firing on legitimate change. Ask what baseline the engine used and how long it had to learn. See Anomaly-based detection.

App Password

A legacy per-application password for clients that cannot do modern authentication or MFA. On Microsoft Entra ID a password reset does not revoke it, so the sweep lists and removes app passwords explicitly. See Identity-persistence sweep.

Application-Layer Protocol

A protocol at the top of the network stack that applications speak directly: HTTP, DNS, SMTP, SMB. Triage cares because adversaries tunnel command-and-control and exfiltration through these common protocols to blend with legitimate traffic, which is why destination and payload matter more than port alone.

Application Programming Interface (API)

An interface a service exposes for programmatic access, typically authenticated with keys, tokens, or certificates instead of an interactive login. In cloud and SaaS triage the API audit log is often the only record of what a stolen credential actually did, since an attacker holding a valid key or token never touches a login page and sidesteps login-centric controls such as MFA.

Artifacts

Traces that activity leaves on a system: prefetch and Amcache entries, registry keys, shell and browser history, log records, files in temporary folders. Uncover uses them to reconstruct what ran when live telemetry did not capture it. Many are overwritten quickly, so collect the volatile ones first (see Order of Volatility).

Asset

Something the organization owns, depends on, or is accountable for: data, a system, an identity, a credential, or a service. An asset’s criticality is what turns a generic alert into a prioritized one.

Asset Criticality

The level of importance or sensitivity of an asset, which determines the level of protection it requires. In ASSURED, asset criticality is one of the four RATM dimensions; with business impact it sets the impact axis (impact is the higher of the two). Score the highest-value asset in confirmed reach, not just the entry point. See the priority matrix.

Assumed-Role Session

In AWS, the temporary STS credentials issued when a principal assumes a role. Using one session to assume another role is role chaining, which caps the session at one hour. Trace the chain back through CloudTrail to the original principal. See Non-human identities and cloud roles.

ASSURED Methodology

A structured approach to security event triage in seven phases (Alert, Subject, Scope, Uncover, Risk, Escalation decision, Documentation), grouped into three stages: Orient (A, S, S), Investigate (U, R) and Resolve (E, D). It pairs the phases with the fast path’s depth ladder (Level 0, 1, 2), so routine cases close quickly and risky ones get the full arc; with the RATM for scoring risk; and with pre-committed escalation criteria and the escalation tripwire. The unit of work is the case, not the alert. Full entry: ASSURED terms.

ATT&CK Procedure

The specific way a particular adversary or tool implemented a technique in the wild, as recorded in ATT&CK’s procedure examples: the actual command line, the exact registry key. Procedures are the most specific layer of TTPs, the easiest for a defender to match, and the easiest for an attacker to change.

ATT&CK Tactic

An adversary goal in an ATT&CK matrix, the “why” behind a technique: Initial Access, Execution, Persistence, Stealth, Exfiltration, Impact and the rest. Enterprise ATT&CK v19 has 15 tactics, with IDs in the form TA0001. Tactics are an unordered set; a real intrusion may skip or revisit them.

ATT&CK Technique

How an adversary achieves a tactic’s goal, such as T1059 Command and Scripting Interpreter. Many techniques have sub-techniques that name a specific variant, written T####.### (T1059.001 is PowerShell). A technique can serve more than one tactic. Mapping an alert to a technique names the behavior; it does not score it.

Attack Chain

The sequence of steps an attacker takes from initial access to their objective. Lockheed Martin’s Cyber Kill Chain models it as seven ordered phases. MITRE ATT&CK’s tactics are an unordered set of adversary goals that a real intrusion may skip or revisit, and the Unified Kill Chain merges the two views. Either lens lets defenders intervene at any link, not only the first.

Attack Patterns

Recurring ways adversaries reach a goal, described independently of any one tool. MITRE’s CAPEC catalogs them for application attacks, and ATT&CK techniques play the same role for intrusions. Naming the pattern behind an alert tells the analyst which follow-on activity to look for.

Attack Vector

The entry point an attacker uses to reach a target: a phishing email, an exposed RDP port, a third-party vendor with trusted access, a misconfigured cloud bucket. Each vector implies a different control to harden.

Attorney-Client Privilege and Work Product

Two legal protections for investigation material: privilege covers confidential communications with counsel for legal advice, and work product covers materials prepared at counsel’s direction in anticipation of litigation. Facts are never privileged, and marking a document “privileged” does not create the protection; broad distribution can waive it. Record facts in full, keep legal conclusions out of the record, and follow counsel’s instructions once counsel directs the investigation. See Writing for discovery.

Attribute-Based Access Control (ABAC)

Access decisions computed from attributes of the user, the resource and the context (department, data classification, device compliance, location) rather than from role membership alone. Conditional Access policies are the form analysts meet most. To explain a grant or a denial, pull the attribute values as they were at the event time.

Authentication

Proving who you are to a system: a password, a hardware token, a biometric, a certificate. Distinct from authorization, which is what that identity is then allowed to do.

Authorization

Deciding what an authenticated identity may do: which resources, which actions, under which conditions. Distinct from authentication, which proves who the identity is. In Subject analysis authorization is its own dimension: a correctly authenticated user doing something their role should not allow is an authorization finding. See Four Dimensions.

Automation

Technology that performs security tasks with little human intervention: enrichment, correlation, routing, containment actions and, under governance, closes. In ASSURED, accountability is never delegated; execution may be, at Level 0 parity, when the pattern entry carries a machine-close flag, code evaluates the discriminators and the eligibility gate, humans sample the closes, reversal and miss rates are tracked, and a kill switch and a named owner exist. See the fast path.

Automation Bias

The tendency to accept a machine’s output (an AI assistant’s summary, a SOAR enrichment, a vendor severity) without checking it, and to miss what it left out. The more fluent the output, the stronger the pull. In ASSURED the analyst verifies an assistant’s specifics against raw telemetry before they reach the record. See Cognitive traps.

Autonomous System Number (ASN)

A globally unique number identifying a network routed under a single operator, such as an ISP, cloud provider, or hosting company. During enrichment the ASN behind an IP address tells the analyst who operates it, which is how a connection resolves to a residential ISP, a corporate egress, or a hosting range with a reputation for abuse.

Availability Bias

Judging how likely an explanation is by how easily an example comes to mind, such as last week’s incident or a recent headline. It bites in Subject and Risk. Counter: check the base rate in your own data before scoring.

Awareness (GDPR)

The moment a GDPR controller becomes aware of a personal-data breach, which starts the 72-hour clock to notify the supervisory authority (Art. 33). The EDPB treats awareness as a reasonable degree of certainty that a security incident has compromised personal data (Guidelines 9/2022), not final confirmation. A short investigation to establish that is allowed, but the clock does not wait for the case to close, so record the awareness timestamp in the case.

B

Base-Rate Neglect

A cognitive trap: judging how likely an explanation is from how well the evidence fits it, while ignoring how common it is to begin with. A detection that is 99% accurate on behavior that is benign 999 times in 1,000 still produces mostly false alarms. It bites in Risk. Counter: ask how often this alert, on this population, has turned out malicious before. See Cognitive traps.

Base64 Encoding

A binary-to-text encoding using 64 printable characters, common in legitimate data transfer and in attacker payloads. It hides nothing from an analyst who decodes it. Tells: PowerShell’s -EncodedCommand carries Base64 of UTF-16LE text (decoded, every other byte is a null), and long Base64 blobs in command lines, scripts or DNS labels are worth decoding before judging.

Baselining

Measuring what normal looks like for a user, host, service or rule over time: logon hours, destinations, data volumes, process trees, alert rates. Anomaly detection and Subject’s behavior dimension are only as good as the baseline, and a baseline built while an attacker was present treats the attacker as normal.

Behavior Analytics

Analysis of user and system behavior patterns to find deviations that may indicate a threat. Usually delivered as UEBA; see User and Entity Behavior Analytics (UEBA).

Behavioral Drift

Gradual change in what normal looks like for a user or system: a new role, a new project, or an attacker moving slowly. Baselines that retrain continuously absorb drift, malicious drift included, so a slow change may never alert. When activity looks normal only recently, compare it against an older baseline window.

Benign-Confirmed

In ASSURED, the activity-axis verdict for activity where nothing harmful or policy-relevant happened, and the evidence shows it. With authorized, the only activity verdict that can close at Level 0. Full entry: ASSURED terms.

Benign Positive

Microsoft Sentinel’s classification for an alert that fired correctly on activity that turned out to be expected. Defender XDR’s equivalent is Informational, expected activity. Both map to ASSURED’s true positive, authorized (benign true positive). See Benign True Positive.

Benign True Positive

An alert that fired on exactly the activity its detection logic describes, where that activity turns out to be authorized or expected in the local context: a red-team exercise, an admin’s sanctioned use of a dual-use tool, a scanner doing its job. In the verdict record it is a true positive on the detection axis and authorized on the activity axis. The detection worked; the context clears it. Distinct from a false positive, where the logic matched something it should not have, so never record it as one. The close does not tune the rule, which is healthy. It feeds context instead: a pattern-entry proposal, or a scoped, expiring exception keyed to the tool version, extension or plugin ID and destination set, with an owner and re-fire triggers. Platform labels differ: Microsoft Sentinel calls this verdict Benign Positive, and Defender XDR calls it Informational, expected activity. Full entry: ASSURED terms.

BITSAdmin

A command-line tool for Background Intelligent Transfer Service (BITS) jobs, deprecated in favor of PowerShell’s BITS cmdlets but still present on Windows. Defenders watch it because attackers use BITS jobs to download payloads and persist (ATT&CK T1197). Tell: bitsadmin /transfer jobs pulling from external URLs, or a job set to run a program when its transfer completes.

Blast Radius

The set of systems, identities, and data an incident can plausibly reach from its current foothold: everything the compromised entity can touch, authenticate to, or influence. Scope draws boundaries around it, lateral movement grows it, and containment exists to stop it growing.

Blind Scoring

Scoring work without knowing whose it is or when in the course it was written, so expectations do not move the score. See Blind scoring with two raters.

Border Gateway Protocol (BGP)

The routing protocol that exchanges reachability information between the autonomous systems that make up the internet. Security-relevant because BGP hijacks and route leaks can silently redirect traffic through attacker-controlled networks, so a connection’s destination is not always where the packets actually went.

Break-glass Account

An emergency-access account kept outside normal sign-in controls (often excluded from MFA or Conditional Access, with its credentials sealed) for use when the normal admin path is broken. Because it bypasses controls, every sign-in should alert, and one that no declared emergency explains is treated as a privileged-identity compromise until shown otherwise. Not the escalation tripwire, which was formerly called the break-glass rule.

Break-glass rule (former name)

The former name of the escalation tripwire: a confirmed escalation criterion makes the case P1 and escalates it immediately, from any phase. Renamed so that “break-glass” keeps its industry meaning, the emergency-access accounts used when the normal admin path is broken. See Escalation Tripwire and Escalation criteria. Full entry: ASSURED terms.

Bring Your Own Device (BYOD)

Letting staff use personally owned devices for work. A BYOD device usually has no EDR and little logging, so evidence comes from the identity provider, MAM and the apps rather than the device. Treat a sign-in from an unmanaged device as a visibility gap, not as clean.

Bug Bounty

A vulnerability disclosure program that pays researchers for valid reports, run directly or through a platform. A report is an intake channel: verify the flaw, then look for anyone else who exploited it. See Vulnerability Disclosure Program (VDP).

Business Associate (HIPAA)

A person or vendor that creates, receives, maintains or transmits protected health information on a covered entity’s behalf, under a business associate agreement (BAA). After discovering a breach of unsecured PHI, a business associate notifies the covered entity without unreasonable delay and no later than 60 days after discovery (45 CFR 164.410); the covered entity then owns notice to individuals and regulators. When the SOC works for a vendor, the BAA decides who is told first.

Business Continuity

An organization’s capacity to keep critical operations running during and after a disruptive incident such as a ransomware outbreak or a destructive attack. In triage, a credible threat to business continuity is part of what raises an alert’s risk rating and escalation urgency.

Business Email Compromise (BEC)

Phishing’s no-payload variant: an email impersonating an executive, vendor, or counterparty that asks the recipient to move money or change payment details. With no attachment to detonate and no link to rewrite, gateway verdicts stay quiet; the evidence lives in lookalike domains, display-name and reply-to mismatches, and hijacked threads sent from a compromised counterparty’s real mailbox. Consistently among the costliest crime types by reported losses in the FBI IC3 Internet Crime Reports (about $3 billion in the 2025 report).

C

California Consumer Privacy Act (CCPA)

California’s consumer privacy law (Cal. Civ. Code §1798.100 et seq.), as amended by the CPRA and enforced by the California Privacy Protection Agency and the Attorney General. It governs how for-profit businesses that do business in California and meet its thresholds handle California residents’ personal information, wherever the business is located. It gives consumers a private right of action for breaches of certain unencrypted, unredacted personal information caused by a failure to maintain reasonable security (§1798.150). Breach notification sits in a separate statute, Civ. Code §1798.82, which applies to any business operating in California regardless of CCPA thresholds. Since 1 January 2026 (SB 446), notice to affected residents is due within 30 calendar days of discovery or notification of the breach. Delay is allowed only for law-enforcement needs or as necessary to determine scope and restore system integrity. When more than 500 residents are notified, a sample notice goes to the Attorney General within 15 calendar days of notifying them. A business holding data it does not own must notify the owner immediately on discovery (§1798.82(b)).

Call-Back Verification

Confirming a caller or an instruction by calling a number you looked up from a trusted source, never the number supplied in the contact. See Talking to people during triage.

Capstone

In the ASSURED teaching kit, an unguided full-arc case scored blind against a fixed grid, with a late inject. See The capstone.

Cardholder Data Environment (CDE)

The system components, people and processes that store, process or transmit cardholder data or sensitive authentication data, plus system components with unrestricted connectivity to them (PCI DSS). Connected-to and security-impacting systems are in PCI scope but are not part of the CDE. An alert touching the CDE sets the regulatory flag in Scope.

Case

In ASSURED, the unit of work: one or more alerts grouped because they share an entity and time window, a campaign indicator or a vendor incident ID. The riskiest member sets the case’s depth level, and a grouped case never closes at Level 0 if any member fails eligibility. The activity verdict, priority and Escalation decision are recorded once per case; each member alert keeps its own detection-axis verdict. See Correlated cases. Full entry: ASSURED terms.

CERT-In Directions

India’s 2022 directions requiring listed cyber incidents to be reported to CERT-In within 6 hours of noticing them, among other duties such as log retention. See Notification clocks.

certutil.exe

A Windows command-line tool for certificate management that attackers abuse as a downloader and decoder (ATT&CK T1105, ATT&CK T1140). Tells: certutil -urlcache -split -f <url> fetching a file, and certutil -decode turning a Base64 blob into an executable. Most EDRs alert on these command lines, so an attacker who knows that moves to another binary; a quiet certutil says little.

Chain of Custody

The documented, unbroken record of who collected a piece of evidence, when, how, and every hand it passed through since, with hashes that show it was not altered. Triage starts the chain the moment it exports a log, captures memory or saves an email: record the source, the time, the tool and the hash in the case. Evidence without a chain is harder to use in legal, HR or regulatory proceedings. See Preserve before you contain.

Closure Check

In ASSURED, the five conditions a documented close must meet: no criterion confirmed or open as a suspicion; the cell allows it; no persistence or credential access in the evidence examined; the case’s own alternatives checked clean; every gap named, with reopen triggers. Full entry: ASSURED terms.

Cloud Security Posture Management (CSPM)

Tools that continuously compare cloud configuration against policy and benchmarks: public storage buckets, over-broad roles, disabled logging. A CSPM finding describes exposure, not activity; pair it with control-plane audit logs to learn whether anyone used the misconfiguration.

Cognitive Trap

A predictable reasoning error that pushes an analyst toward the wrong verdict while feeling like good judgment: anchoring, confirmation bias, availability bias, automation bias, deference, premature closure, sunk cost. ASSURED counters them with structure (pre-committed escalation criteria, a hypothesis ledger, peer validation) rather than willpower. See Cognitive traps.

Command Line

In SOC analysis, the argument string a process was launched with. Often the load-bearing forensic field on an EDR alert because it reveals what the process was actually told to do.

Command Line Analysis

Reading a process’s command line for what it was told to do: the binary, its flags, encoded or obfuscated arguments, and the paths and URLs it names. See Command Line, and command-line parsing for the method.

Common Event Format (CEF)

A log format that originated at ArcSight (now OpenText ESM): a syslog-style line with a pipe-delimited header (vendor, product, version, signature ID, name, severity) and key-value extensions. Many network and security appliances still emit it. Severity and field use vary by vendor, so read the device’s mapping before trusting a normalized field.

Common Vulnerabilities and Exposures (CVE)

The public catalog of disclosed vulnerabilities, each with an identifier such as CVE-2021-44228, run by MITRE under CISA sponsorship with many numbering authorities. A CVE ID names a bug; it does not say how dangerous it is. Severity comes from CVSS, and urgency from known exploitation (CISA KEV) and exploit probability (EPSS). See the priority matrix.

Common Vulnerability Scoring System (CVSS)

FIRST’s standard for scoring a vulnerability’s technical severity from 0 to 10; version 4.0 (2023) is current, and 3.1 scores are still common. Severity is not risk: CVSS knows nothing about your exposure or whether the bug is being exploited. Check CISA KEV and EPSS for urgency, and the asset’s criticality for impact.

Communication Record

In ASSURED, section 9 of the handoff packet and the matching part of a closure record: who was told what, by whom, on which channel and when, including contacts deliberately not made. See Talking to people during triage.

Compliance

Adherence to the laws, standards and frameworks an organization is bound by. See Regulatory Compliance and Regulatory Requirements for what it changes in triage.

Computer Security Incident Response Team (CSIRT)

The team that owns incident response once an incident is declared; also called a CIRT or IRT, and at national level often a CERT. In ASSURED it is the IR that escalation hands to: triage owns the case until the CSIRT accepts the handoff packet.

Confabulation

NIST’s term for what is commonly called AI hallucination: confidently stated output that is false or unsupported by the input. See Hallucination.

Confidence Rubric

In ASSURED, the single scale for analytic confidence, used by Subject’s entity verdicts, Uncover’s evidence chain, Risk’s record and the handoff packet. High: direct evidence from a source trusted for that kind of claim, corroborated independently, with plausible alternatives tested and ruled out. Medium: single-source evidence or strong inference, with nothing contradicting it. Low: circumstantial or incomplete evidence, with material gaps open. Label each claim, not the case, and round down when between levels. Confidence sits beside likelihood and never replaces it. See the confidence rubric. Full entry: ASSURED terms.

Configuration Management Database (CMDB)

A database of an organization’s systems and services (configuration items) and the relationships between them; during triage an analyst queries it to learn what an alerting system actually is: its owner, business role, criticality, and dependencies. A stale CMDB is a common reason a scoping question takes hours instead of minutes.

Confirmation Bias

Searching for, and weighting, evidence that supports the hypothesis already held, while explaining away what contradicts it. It bites hardest in Uncover, where the analyst chooses every query. Counter: for each hypothesis, name the observation that would refute it and run that query too.

Confirmed

In ASSURED, supported at High confidence on the confidence rubric. A confirmed escalation criterion fires the escalation tripwire and makes the case P1 from any phase. Below High the claim is a suspicion, and suspicion refines Scope instead of escalating. Full entry: ASSURED terms.

Confirmed Reach

In ASSURED, the footprint rule for impact: asset criticality is scored on the most valuable asset the activity has confirmed reach to, not just the entry point. Full entry: ASSURED terms.

Contained by Control

In ASSURED, the path for malicious activity a control blocked or quarantined, with no execution or follow-on evidence: the case is recorded at P3 or P4 and becomes a pattern-entry candidate, not a page to IR. Any sign of execution or follow-on activity takes the case off this path, and if a criterion is then confirmed, the escalation tripwire applies. Full entry: ASSURED terms.

Containers

A lightweight workload isolation unit that shares the host operating system’s kernel instead of running its own, making its isolation boundary weaker than a virtual machine’s. For triage, containers mean ephemeral evidence: a compromised container can be torn down and rescheduled before anyone looks at it, so telemetry shipped off the container is often all that remains.

Containment

The incident-response phase between detection and eradication: isolate the affected hosts, revoke the compromised credentials, block the C2 destinations, freeze the situation so it stops getting worse while the investigation continues. In triage, preservation comes first: capture the volatile evidence and the artifacts a containment action would destroy, then take only the reversible actions the protocol pre-authorizes. Non-reversible actions, such as a credential reset or an OAuth grant revocation, need IR or owner approval unless the protocol lists them as pre-authorized for that scenario.

Containment Authorization Matrix

In a managed-service arrangement, the per-customer list of which pre-authorized actions the provider may take, on which asset classes, with which preservation step, and who approves anything non-reversible. See What the customer must supply.

Continuous Access Evaluation (CAE)

A Microsoft Entra ID capability, based on the OpenID Continuous Access Evaluation Profile, that lets supporting services reject an access token within minutes of a critical event such as session revocation, account disable or password reset, instead of honoring it until it expires. It decides how fast containment takes effect: an app without CAE support keeps accepting a stolen access token until it expires, a random 60 to 90 minutes by default on Microsoft Entra ID.

Controller and Processor (GDPR)

The two GDPR roles for an organization handling personal data. The controller decides the purposes and means of processing and owns the Art. 33 notification to the supervisory authority; the processor acts on the controller’s instructions and notifies the controller without undue delay after becoming aware of a breach (Art. 33(2) of the GDPR). Which role your organization holds for the affected data decides whose 72-hour clock is running. See General Data Protection Regulation (GDPR).

Credential

Whatever the system accepts as proof of identity: a password, an API key, an OAuth token, a Kerberos ticket, an NTLM hash. Credentials are the highest-value loot in most intrusions; their theft is usually the pivot point.

Credential-Exposed

In ASSURED, the status of any user who reached the credential step of a phishing kit. They stay credential-exposed until the password is reset, sessions are revoked and MFA methods are reviewed; stopping at the MFA prompt rules out session theft, not credential theft. See Identity-persistence sweep. Full entry: ASSURED terms.

Critical Infrastructure

Systems and services whose disruption would endanger public safety, economic stability, or national security: power, water, healthcare, financial services, telecommunications, and similar sectors. The United States designates 16 critical infrastructure sectors. PPD-21 (2013) set the list; NSM-22 (April 2024) rescinded and replaced PPD-21, kept the 16 sectors, and names CISA as national coordinator. Federal policy here is under review, so check for later revisions. Organizations in these sectors face heightened nation-state targeting and sector-specific incident-reporting obligations.

Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)

A 2022 US law that will require covered critical-infrastructure entities to report covered cyber incidents to CISA within 72 hours of reasonably believing one occurred, and ransom payments within 24 hours of making them. The duties take effect only when CISA’s final rule does, so check its current status before relying on the clocks.

Cyber Resilience Act (CRA)

EU Regulation 2024/2847 on products with digital elements. Since 11 September 2026, manufacturers report actively exploited vulnerabilities and severe incidents affecting their products through ENISA’s Single Reporting Platform: an early warning within 24 hours and a notification within 72 hours. See Notification clocks.

D

Data Loss Prevention (DLP)

Controls that inspect data in motion, at rest or in use, and alert on or block sensitive content leaving approved channels: email, web uploads, removable media, cloud sync. A DLP alert names a policy match, not intent; triage asks what the data was, where it went, and whether the destination was sanctioned.

Data Protection Officer (DPO)

The role GDPR (Art. 37-39) requires of some controllers and processors to advise on and monitor data-protection compliance and to act as the contact point for supervisory authorities. In triage, the DPO or privacy lead decides whether a personal-data breach is notifiable; the SOC supplies the facts and the awareness timestamp.

Data Retention

How long logs, telemetry, and other records are kept before they roll off or are purged. Retention windows bound every investigation: if the intrusion began before the oldest retained log, the earliest attacker activity cannot be reconstructed from logs and may be recoverable only through host or disk forensics, if at all.

De-escalation

In ASSURED, the explicit path back down: a priority moves down only with a named reason in the case and the same stakeholder notification an upgrade would get. A confirmed criterion is downgraded only by the receiving owner, after receipt. Full entry: ASSURED terms.

Deception Technology

Decoys planted where no legitimate user should go: honeypot hosts, honeytoken credentials, canary files, fake cloud keys. Any interaction is suspicious by design, which makes deception alerts among the highest-fidelity a SOC receives. Check first whether an authorized scanner or admin tool touched the decoy.

Deep Packet Inspection (DPI)

Inspecting the full contents of network packets, payload included, rather than only headers and flow metadata. This is what lets a network sensor see the actual request, file, or command inside the traffic, though pervasive encryption steadily shrinks what it can read.

Deepfake

Synthetic audio, video or images generated to impersonate a real person. In triage it defeats “I recognized the voice” or “I saw them on the call” as identity proof for help-desk resets and payment approvals; verify through a separate, known channel instead. See AI-assisted triage.

Defense in Depth

Layering multiple overlapping controls at the network, endpoint, identity, and monitoring levels so that a single control failing does not mean compromise; also called security in depth. For triage it means one layer’s alert can usually be corroborated or refuted with telemetry from another layer.

Deference

A cognitive trap (authority bias, social proof): accepting a verdict because of who gave it (a senior analyst, a vendor severity, the previous shift) rather than what the evidence shows. It bites in verdicts and documentation. Counter: the record states the evidence for a verdict, never only its source.

Depth Ladder

In ASSURED, the per-case choice of how much process a case gets: Level 0 (pattern close, about five minutes), Level 1 (standard triage, about 15 to 45 minutes) or Level 2 (the full arc of seven phases). Depth is chosen at intake and only ratchets up within a case; depth and urgency are separate decisions, so a confirmed criterion escalates from any level. See the fast path. Full entry: ASSURED terms.

Deskilling

The slow loss of analysis skill in analysts who only verify AI drafts, which also weakens the kill switch, since it assumes a team that can work the queue unassisted. ASSURED counters it with an unassisted rotation and a quarterly unassisted QA sample. See The deskilling policy.

Detection-as-Code

Keeping detection rules, exceptions and parsers in version control, with peer review and automated tests before deployment: the benign sample must stop firing and the malicious sample must still fire. See How a request becomes a change.

Detection Engineering

The discipline of building, testing, tuning, and retiring detection logic as an engineered product: version-controlled rules, measured false-positive rates, coverage mapped against ATT&CK. The portable rule formats analysts meet in alerts are Sigma (log detections) and YARA (file and memory patterns), both in the C.A.T. glossary. Triage feeds it every time a close records why an alert was right or wrong; a SOC without that feedback loop is running detections nobody maintains.

Detection Logic

The rule, model, or heuristic that decides whether a given input fires an alert. The logic that produced the alert matters as much as the alert it produced; two engines can name the same alert for very different reasons.

Detection Mechanism

The kind of detection logic that produced an alert. ASSURED teaches four families (signature, anomaly, rule-based, behavioral), and real detections often combine more than one. Machine-learning classifiers sit beside them as a sibling: a trained model scores the input and, like anomaly detection, rarely explains itself. Naming the mechanism tells the analyst what the engine could and could not see, which sets how far to trust the alert.

Detection Strategy (ATT&CK)

Since ATT&CK v18 (October 2025), the per-technique detection object (DET ID), made of platform-specific analytics (AN IDs) built on data components. It replaced the older data-source mapping.

DFARS 252.204-7012

The US Department of Defense contract clause for safeguarding covered defense information. Cyber incidents affecting it are reported to DoD through DIBNet within 72 hours of discovery, and images of the affected systems are preserved for at least 90 days. See Notification clocks.

Diamond Model

An intrusion-analysis model (Caltagirone, Pendergast and Betz, 2013) that describes every event by four connected features: adversary, capability, infrastructure and victim. Pivoting from one vertex to the others (from a C2 IP to the malware that uses it, then to other victims) is how analysts grow an indicator into a picture of the activity.

Digital Forensics

Forensics applied to computers, networks, cloud services and mobile devices; in a SOC the two terms name the same discipline. See Forensics.

Digital Operational Resilience Act (DORA)

The EU regulation (2022/2554), applying since January 2025, on ICT risk at financial entities and their critical ICT providers. Major ICT-related incidents go to the competent authority in stages: an initial notification within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it, an intermediate report within 72 hours, and a final report within one month. The regulation’s classification criteria, not the SOC’s severity label, decide what is major.

Digital Signatures

Cryptographic proof that signed data came from the holder of a private key and was not altered since. On a binary (Authenticode, Apple Developer ID) the signature says who built it, not whether what it does is benign: signing certificates get stolen and abused, and a signed host such as an IDE runs unsigned third-party code. Check the signer, the certificate’s validity at signing time, and revocation.

Disaster Recovery

The capability to restore systems and data after a destructive incident, most often tested by ransomware. Attackers deliberately disable it first, so alerts showing backup deletion, shadow copy removal, or tampering with recovery tooling warrant immediate escalation.

Discovery (HIPAA)

Under the HIPAA Breach Notification Rule, a breach counts as discovered on the first day it is known to the covered entity, or would have been known with reasonable diligence, by any workforce member or agent other than the person who committed it (45 CFR 164.404(a)(2)). Discovery starts the 60-day outer limit for notifying individuals, so the triage record’s first-knowledge timestamp matters.

Discriminator

In ASSURED, a named, checkable fact that separates a documented benign pattern from its malicious lookalike. A Level 0 close requires every discriminator in the pattern entry to check out against its source system; one failure moves the case to Level 1. See the fast path. Full entry: ASSURED terms.

DLL Search Order Hijacking

A DLL-hijacking technique that places a malicious DLL where an application looks for libraries before the legitimate location, so a trusted, signed binary loads attacker code. Attackers use it for persistence, privilege escalation, and to hide execution inside a trusted process. Current ATT&CK groups it with side-loading, phantom-DLL hijacking, DLL redirection, and DLL substitution under ATT&CK T1574.001 “DLL” (mapped in v19 to Stealth and Execution). Side-loading is the sibling variant: the attacker plants a legitimate application next to the malicious DLL and runs it. Detected by watching for DLLs, especially unsigned ones loaded by signed binaries, that load from application or user-writable directories instead of their expected system paths.

Documented Close

In ASSURED, a first-class verdict, not the absence of an escalation, held to the same evidence standard. It passes the closure check, names its open uncertainty and writes its reopen conditions. Most triaged cases end here. Full entry: ASSURED terms.

Domain

Either a DNS name like example.com that identifies internet infrastructure, or a Windows Active Directory domain, the identity and authentication boundary attackers aim to own; context makes the sense clear. As an indicator, a DNS domain’s age, registrar, and reputation are among the first pivots in triage.

Domain Admin

One of the three most privileged built-in groups in Windows Active Directory, alongside Enterprise Admins and the domain’s built-in Administrators group: full administrative control over every domain-joined host, every domain user, and the directory itself. Treat a Domain Admin compromise as a forest compromise, not a domain compromise. The forest, not the domain, is the security boundary, and an admin in a child domain can reach the forest root (for example, by forging SID-History for Enterprise Admins, ATT&CK T1134.005). Scope every Tier-0 identity (DCSync rights, AD CS admins, Entra Connect sync accounts), not only Domain Admins.

Domain-based Message Authentication, Reporting, and Conformance (DMARC)

An email authentication policy protocol built on SPF and DKIM: the domain owner publishes in DNS how receivers should treat mail that fails alignment (monitor, quarantine, or reject) and where to send reports. Alignment is the point: DMARC checks that the domain in the visible From: header matches the domain SPF or DKIM authenticated. Now specified in RFC 9989 (2026), which replaced RFC 7489. During phishing triage, a DMARC failure on mail claiming to come from a trusted domain is strong spoofing evidence.

Domain Controller

A server that hosts the Active Directory database (NTDS.dit, including every account’s password hashes) and runs the Kerberos KDC for its domain. It is Tier 0: an attacker with DC-level access, or replication rights used via DCSync, owns the domain. Any unexpected interactive logon, new service or replication request involving a DC warrants escalation.

Domain Depth

The number of subdomain levels beneath the registered domain in a fully qualified domain name; a.b.example.com has a depth of two below example.com. Depth is a triage feature: DNS tunneling and machine-generated phishing infrastructure tend to produce long subdomain chains, while most legitimate names stay shallow.

Domain Name System (DNS)

The distributed system that resolves human-readable names to IP addresses. For an analyst it is one of the richest telemetry sources available: nearly every connection begins with a query, so DNS logs surface C2 lookups, tunneling, DGA noise, and newly registered domains that other data misses.

Domain Name System Exfiltration

Moving data out by encoding it into DNS queries, usually as subdomain labels sent to a domain whose authoritative server the attacker runs. It works wherever DNS reaches the internet. Tells: long, high-entropy labels, many unique subdomains of one domain, unusual record types such as TXT, and query volume far above the host’s baseline. See Domain Depth and Entropy Scoring.

Domain Trusts

Authentication relationships between Active Directory domains that let identities in one domain access resources in another. Attackers enumerate and abuse trusts to extend a compromise across domain and forest boundaries, which makes the trust map a lateral-movement map.

DomainKeys Identified Mail (DKIM)

An email authentication method in which the sending infrastructure signs selected message headers and a hash of the body with a private key, and receivers verify the signature against a public key published in the signing domain’s DNS. A valid signature shows the signing domain took responsibility for the message and that the signed content arrived unaltered; it says nothing about whether the content is safe.

Dwell Time

The interval between initial compromise and detection, measured per incident and tracked as a program metric. The reason retention windows matter (“did this start before the alert?”) is that dwell time is routinely longer than anyone’s comfort. Mandiant’s M-Trends 2026 puts the global median at 14 days (up from 11), but espionage and North Korean IT-worker intrusions had a median of 122 days. The median hides a long tail, and that tail is what retention windows must cover.

Dynamic Link Library (DLL)

A Windows shared library whose code is loaded into a process’s address space at runtime. Module-load telemetry matters in triage because attackers run code inside trusted processes by supplying their own DLLs through injection, sideloading, or search-order hijacking.

E

E Rule

In ASSURED, the Escalation decision’s one rule: escalate if a criterion is confirmed or the matrix places the case at P1 or P2. At P3, keep working to the named re-score trigger, then close or escalate. Close at P4. Record the cell either way. See The E rule. Full entry: ASSURED terms.

Electron Framework

A framework for building desktop applications from web technologies; Slack, VS Code, and Cursor are Electron apps. It matters in triage because Electron apps legitimately spawn helper processes with long vendor-standard command lines and sometimes disabled sandboxes. That looks like post-exploitation tooling, but it is normal. The real tell is lineage: a helper, or a helper’s child, whose lineage does not trace back to its own app’s main process. Extension hosts legitimately launch children of their own (language servers, agent runtimes, git), so judge each child by its identity, signature and path.

Eligibility Gate

In ASSURED, the three checks a case’s subject must pass before a Level 0 close, each proven from its source system: not a crown-jewel asset; not a privileged identity, and not automation with deploy, signing, secrets or repository-write capability; no regulated data in reach. Unknown fails the gate. A failed item moves the case up the ladder, and a crown-jewel subject or privileged identity goes straight to Level 2. See the fast path. Full entry: ASSURED terms.

Endpoint

A device that runs an operating system and applications and connects to the network: workstation, laptop, server, virtual machine, phone, tablet. Endpoints are where execution-based tradecraft (malware, scripts, hands-on-keyboard commands) shows up, which is why EDR exists. Identity, SaaS and cloud-control-plane attacks, and attacks on network appliances that cannot run EDR, may never touch one, so endpoint silence is not proof of absence.

Endpoint Detection and Response (EDR)

Agents that record process, file, registry, network and module-load activity on endpoints, detect suspicious behavior, and let responders isolate hosts or kill processes remotely. EDR telemetry is the backbone of endpoint triage. Know its blind spots: unmanaged and BYOD devices, appliances that cannot run an agent, and identity or SaaS activity that never touches a host. A missing or silent agent is a finding.

Enrichment

Adding context to a raw alert or indicator before or during triage: reputation and registration data (RDAP, formerly WHOIS) for an IP or domain, owner and criticality for an asset, role and department for a user, a sandbox verdict for a file. Automated enrichment is what SOAR pipelines do best; the analyst’s judgment starts where the enrichment stops answering the question.

Entity

Any discrete actor or object that evidence can attach to during an investigation: a user account, a host, a process, an IP address, a domain, a file. Triage decomposes an alert into its entities and asks what each one was doing; the same idea gives UEBA its E.

Entropy Scoring

Measuring how random a string or file looks (Shannon entropy). High entropy suggests encryption, compression or machine-generated names: DGA domains, packed binaries, encrypted payloads. It is a prompt, not a verdict: CDN hostnames, cloud object IDs and Base64 also score high.

Ephemeral Computing

Infrastructure that exists only as long as its task: containers, serverless functions, and autoscaled instances created and destroyed on demand. It matters in triage because the evidence dies with the workload; unless telemetry was shipped off the resource while it lived, there is nothing left to examine by the time the alert is read.

Eradication

The incident-response phase that removes the attacker’s presence: malware, persistence, backdoor accounts, rogue OAuth grants, compromised credentials. It belongs to IR, after containment. Triage’s contribution is the record: every persistence mechanism and identity found in Uncover goes into the handoff packet so eradication does not miss one.

Escalation Acceptance

Escalations the receiver marks as warranted, divided by escalations with a filled receipt. A quality measure judged by the receiver, read beside missed incidents, because a desk can raise acceptance simply by escalating less. See Measuring triage.

Escalation Criteria

In ASSURED, the four canonical categories checked at every phase: confirmed malicious activity not fully contained by a control; high impact on business-critical systems; lateral movement or exfiltration; an ongoing or widespread campaign. Each counts only when confirmed. Full entry: ASSURED terms.

Escalation Decision

In ASSURED, the E phase: close or escalate, and who needs to know? It makes and records the decision Risk recommended, by the E rule, and leads with the documented close as a first-class outcome. Early exits (a Level 0 close, an escalation-tripwire escalation) are early Escalation decisions. Full entry: ASSURED terms.

Escalation Matrix

A pre-agreed table mapping triage outcomes to who gets engaged, how, and how fast. In ASSURED the triage matrix gives a priority (P1 to P4) and a recommended move, and the Escalation decision applies one rule: escalate if a criterion is confirmed or the case sits at P1 or P2; at P3, keep working to the named re-score trigger, then close or escalate; close at P4. It is keyed on pre-committed criteria and priority (how fast someone must act), not severity alone. A confirmed criterion escalates from any phase under the escalation tripwire. See Escalation criteria. Full entry: ASSURED terms.

Escalation Tripwire

ASSURED’s rule that a confirmed escalation criterion escalates immediately, from any phase, and makes the case P1 whatever its matrix cell. Confirmed means supported at High confidence on the shared confidence rubric; suspicion refines Scope and re-runs the loop instead. Always written with “escalation”, because Tripwire is also a file-integrity product. Formerly called the break-glass rule. See Escalation criteria. Full entry: ASSURED terms.

Evasion

Techniques attackers use to avoid detection or hinder defenders: obfuscation, masquerading, log clearing, sandbox checks. ATT&CK v19 split the former Defense Evasion tactic into Stealth (TA0005) and Defense Impairment (TA0112). Evasion found in Uncover raises likelihood, since legitimate software rarely needs to hide.

Event

An observable occurrence in a system or network (NIST): a process ran, a user logged in, a file changed, a packet was sent. Events are neutral. Detection logic turns a small fraction of them into alerts, and triage turns a smaller fraction into incidents.

Event Context

The surrounding facts that give a security event meaning: who the user is, what the host is for, what happened immediately before and after, and whether the activity is normal for that identity at that time and place. Context is what lets an analyst turn an isolated observation into a verdict.

Event Correlation

Linking events from different sources through shared entities and time to see one chain of activity: a phishing click, a sign-in from a new ASN, a new mailbox rule. It depends on normalized fields and synchronized clocks. In ASSURED, Uncover correlates evidence into one timeline per case. See Correlation and the timeline.

Event ID

The number that identifies what kind of event a Windows log record describes, such as 4624 for a successful logon or 4688 for a process creation. The same number can mean different things in different log channels or providers, so read it with its source. See Windows Event Logs; Sysmon, in the C.A.T. glossary, adds richer process, network and image-load events.

Event Time vs Ingest Time

When the source recorded an event versus when the SIEM received it: in ECS, @timestamp versus event.ingested; in Splunk, _time versus _indextime; in Microsoft Sentinel, TimeGenerated versus ingestion_time(). A batch of late-arriving events can look like a burst in ingest time. See Case D.

Event Triage

The front end of incident response, from an alert firing to the documented decision to close it or escalate it. It answers four questions: is this real, is it malicious, how serious is it, and what should happen next. It ends in a documented close or a handoff to IR. ASSURED is a structured way to do triage.

Evidence Preservation

Capturing evidence before it changes or disappears: volatile state (memory, connections, running processes), the artifacts a containment action would destroy, and log exports with their hashes. In ASSURED, preservation comes before pre-authorized containment: preserve, then contain. See Order of Volatility and Chain of Custody. See Preserve before you contain.

Exception (Detection)

A narrow carve-out in which the rule still runs and only a defined, context-keyed tuple is excluded from alerting. A governed exception is scoped, owned, approved by a second person, expiring, stored as code and monitored for hits. Distinct from suppression, which hides the alert, and tuning, which changes the logic. See Exception and suppression governance.

Exception Register

The single list of active detection exceptions and suppressions, each with its owner and expiry, with a count of those past due. See Exception and suppression governance.

Exfiltration

The unauthorized transfer of data out of the environment (ATT&CK TA0010): over the C2 channel, to cloud storage or a file-sharing service, by email, or through DNS. Triage signals are volume and destination: outbound bytes far above the host’s baseline, a first-seen upload destination, and staging (archives appearing in temporary folders) shortly before the transfer. Confirmed exfiltration is an escalation criterion, and when the data is regulated it can start notification clocks.

Expected-Change Record

In ASSURED, the privileged counterpart of a pattern entry: a record, linked to its change ticket, of the checks a recurring privileged change needs. It speeds the Level 2 pass; it never closes a case at Level 0. Full entry: ASSURED terms.

Exploit

A technique or piece of code that turns a vulnerability into actual capability: remote code execution, privilege escalation, authentication bypass. A vulnerability with no known exploit is unweaponized, not safe: average time-to-exploit has fallen to days, and private exploits stay invisible until used. Known exploitation (CISA KEV) and exploit probability (EPSS) are stronger urgency signals than whether a public proof-of-concept exists.

Exploit Prediction Scoring System (EPSS)

FIRST’s model that estimates the probability a published CVE will be exploited in the wild in the next 30 days. An urgency input, not a risk score: it knows nothing about your assets, exposure or controls. Check CISA KEV first, then EPSS. See the priority matrix.

Extended Detection and Response (XDR)

A platform category that correlates detections across endpoint, identity, email, cloud and network telemetry into incidents with shared response actions, usually within one vendor’s stack. For triage, the XDR incident is a grouping, not a verdict: check which member alerts it pulled in, and which sources it cannot see.

Extortion Payment Notice

A reporting duty triggered by paying a ransom or extortion demand, separate from incident notification: NYDFS within 24 hours, Australia within 72 hours, and CIRCIA within 24 hours once its final rule takes effect. See Ransom and extortion payments.

F

False-Benign Rate

Of the cases in an alert class whose settled activity verdict is malicious or policy violation, the share an assistant recommended, or an automation executed, as a benign close. The denominator is the malicious cases, not all cases. Report it per class with its n, never pooled. See Governing automated triage.

False Negative

Malicious activity that produced no alert: the detection logic missed it, or no logic covers it. Invisible by definition at triage time, false negatives surface later through hunting, incident investigation, or an external notification, and each one found is a detection-engineering work item. The other half of the confusion matrix from the false positive, and the more expensive half.

False Positive

A detection-axis verdict: the alert’s logic matched something it should not have, because the behavior the rule claims did not occur. ASSURED records two kinds: false positive (logic), a logic flaw or an over-broad pattern, and false positive (data), a parsing error, a missing field or bad telemetry. The fix is detection-side: tune, refine, or repair the data feed. Distinct from a benign true positive, where the behavior really happened but was authorized; that is never a false positive. Platform labels differ: Microsoft Sentinel’s False Positive and Defender XDR’s False positive mean this, while their Benign Positive and Informational, expected activity mean a benign true positive.

False-Positive-as-Finding

In ASSURED, the doctrine that every false positive is a defect report against the detection, not just a closed ticket: the close records whether the logic or the data failed and routes a tuning request to detection engineering. A benign true positive is not a false positive and does not tune the rule. See What a benign close teaches. Full entry: ASSURED terms.

Federated Identity Credential

In Microsoft Entra ID, a standing trust on an app registration or managed identity that lets tokens from an external issuer sign in as the app. Adding one is a persistence move worth an alert. See Non-human identities and cloud roles.

Federation

Linking identity across independent systems or organizations so that a trusted identity provider authenticates users on behalf of services it does not operate, typically via SAML or OIDC. Matters in triage because every relying service delegates authentication to the identity provider: a compromise there, such as a stolen signing key used to forge assertions (Golden SAML), can mint access to any federated service.

Feedback Loop

Routing what triage learns to the people who can act on it: false positives to detection engineering as tuning requests, benign true positives to the pattern library, coverage gaps to telemetry owners, handoff rework to the SOC lead. A SOC without one closes the same noise forever.

FIDO2

The FIDO Alliance and W3C standards (WebAuthn plus CTAP) behind security keys and passkeys, used either as a passwordless sign-in or as a second factor. Credentials are public-key pairs bound to the site’s origin, so a phishing proxy on a lookalike domain cannot replay them; that makes FIDO2 the main phishing-resistant MFA option. Passkeys can be device-bound or synced through a platform account.

File Integrity Monitoring (FIM)

Watching critical files and configuration for changes by comparing hashes or attributes against a known state; PCI DSS requires it. Triage asks whether a change matches a change ticket or deployment. An unexplained change to a system binary, a web root or authentication configuration is a persistence or tampering signal.

Firewall

A control that allows or blocks traffic by rule, at the network edge, between segments, or on the host. Its logs are evidence: allowed connections show what got through, denied ones show what was tried. A block means one attempt was stopped, not that the host is clean.

FIRST CSIRT Services Framework

FIRST’s catalog of the services and functions an incident response team can offer (version 2.1, November 2019). The functions closest to triage are 5.2.1 Correlation, 5.2.2 Qualification (deciding whether an event needs handling) and 6.2.1 Incident triage (prioritization and categorization). See Standards mapping.

Five-Field Record

In ASSURED, Level 0’s entire documentation: Alert, Pattern, Checks, Verdict, Closure. A case that cannot be honestly captured in five fields does not belong at Level 0. Full entry: ASSURED terms.

Forensics

The application of scientific methods to collect, preserve, and analyze digital evidence so that findings hold up to scrutiny: disk and memory images, log exports, mobile extractions, each with a documented chain of custody. In triage the forensic move is preservation: capture volatile evidence, and hash what you export, before containment changes the system.

Forward Watch

A time-boxed, owned watch on an entity for named events, set by Scope or Risk, with an expiry. Its end, or a named event during it, is a re-score trigger.

Four Boundary Types

In ASSURED, Scope’s frame for where the investigation’s lines sit: regulatory, time, entity and infrastructure. Scope is provisional; Risk can push it wider. Full entry: ASSURED terms.

Four Dimensions

In ASSURED’s Subject phase, the four lenses applied to every entity: authentication (how it proved its identity), authorization (what it was allowed to do), behavior (whether the activity fits its baseline) and relationships (what it connects to and can reach). An entity verdict needs all four. See four dimensions. Full entry: ASSURED terms.

FTC Safeguards Rule

The GLBA rule for non-bank financial institutions. A notification event involving the information of 500 or more consumers goes to the FTC within 30 days of discovery. See Notification clocks.

G

General Data Protection Regulation (GDPR)

EU/EEA regulation on processing personal data. It applies where an Article 3 nexus exists (an EU/EEA establishment, offering goods or services to people in the EU, or monitoring their behavior). A personal-data breach must be reported to the supervisory authority within 72 hours of the controller becoming aware of it (Art. 33). Awareness means a reasonable degree of certainty that a security incident has compromised personal data (EDPB Guidelines 9/2022), not final confirmation, so the awareness timestamp belongs in the case record.

Generative AI

AI that produces new content (text, code, images, audio, video) rather than only classifying or scoring it. Large language models are the generative AI in SOC assistants; the same capability writes fluent phishing lures and deepfake voices. In triage its output is a draft to verify, never evidence. See Large Language Model (LLM) and AI-assisted triage.

Geolocation

The process of determining the physical location of a device or IP address. IP geolocation is a database estimate, not a fact: mobile, VPN, residential-proxy and cloud egress addresses routinely map to the wrong city or country. Treat impossible-travel alerts as a prompt to check the ASN and device, not as proof.

Golden Set

A held-out set of your own closed cases with settled verdicts, used to evaluate an AI assistant or automation before and after every change. It covers each alert class with the hard cases: confirmed malicious cases, benign true positives that look malicious, false positives, past misses, injection-laced samples and cases whose right answer is undetermined. See Governing automated triage.

Grader Calibration

Bringing raters to the same reading of a grid before they score: each scores the same anchor exemplars, then they compare and settle the items where they split. See Grader calibration.

H

Hallucination

An AI model’s output that is fluent and specific but not supported by its input or by fact: an invented log field, a nonexistent CVE, a query that was never run, a confident wrong timestamp. NIST calls it confabulation. In triage, every specific an assistant supplies (hostnames, IDs, counts, times) is verified against raw telemetry before it enters the record.

Handback

A receiving owner returning an escalated case to the sending tier with a named reason: the evidence chain is missing, the criteria or the cell are not supported, or the problem is detection tuning. Recorded on the packet’s receipt and counted by reason. See Case D.

Handoff Anchoring

Inheriting the previous analyst’s story as if it were a finding, at a shift change or an escalation. The counter is to re-derive the leading hypothesis from the evidence before accepting it. See Anchoring and Handoff anchoring.

Handoff Packet

In ASSURED, the structured deliverable an escalation produces: case metadata and a receipt, then nine sections (case summary, timeline, entities, evidence chain, risk verdict, containment actions taken, artifacts, open questions, communication record). It lets the receiver start where triage stopped and doubles as the documentation record; a close produces a closure record instead. See The handoff packet. Full entry: ASSURED terms.

Handoff Rework

Escalations whose receipt names rework (the receiver had to re-collect or re-derive something the packet should have carried), divided by escalations with a filled receipt. See Measuring triage.

Hash

A fixed-size value computed from data by a hash function. Cryptographic hashes (SHA-256) identify an exact file. Fuzzy and structural hashes (ssdeep, TLSH, imphash) find near-identical variants, which matters because one changed byte defeats an exact-hash IoC. MD5 and SHA-1 are broken for collisions, so pivot on SHA-256 where you can.

Health Insurance Portability and Accountability Act (HIPAA)

U.S. legislation that sets standards for protecting sensitive patient health information, including specific security and privacy requirements. It applies to covered entities (health plans, clearinghouses, most providers) and their business associates; health data held by others is usually governed by other laws, such as the FTC Health Breach Notification Rule and state health-privacy statutes. Its Breach Notification Rule requires notice to individuals without unreasonable delay and no later than 60 days after discovery, notice to prominent media when a breach affects more than 500 residents of a state, and documentation kept for six years. Proposed Security Rule changes are proposals, not law, until a final rule is published.

High-Impact Clock

In ASSURED, the override that keeps a High-impact case whose likelihood is genuinely Low at P3 but re-scores it within hours, 4 by default, with named upgrade triggers. Low because the evidence is missing is unknown, not Low: that case reads High/Medium, P2. Full entry: ASSURED terms.

HTML Application (HTA)

Script content delivered as an HTML Application (.hta file), which Windows executes through mshta.exe with the local user’s full privileges rather than inside the browser sandbox. A recurring phishing and living-off-the-land vector (ATT&CK T1218.005, Mshta), which is why mshta.exe spawning from a browser or email client, or running a remote URL or inline script, draws analyst attention.

Hypertext Transfer Protocol (HTTP)

The request-response protocol that carries most web traffic between clients and servers. Triage-relevant because attacker traffic blends into it: C2 beacons, payload downloads, and exfiltration ride HTTP precisely because it is allowed almost everywhere, and its URIs, headers, and user-agent strings are core investigation fields.

Hypothesis Ledger

In ASSURED, the working list kept beside the Uncover timeline: one line per hypothesis, with the evidence for it, the evidence against it, and its status. Open it with at least two hypotheses, one of them the most plausible benign explanation; a ledger with one line is a conclusion, not a test. Rejected hypotheses travel in the handoff packet so IR does not re-test them. See Correlation and the timeline. Full entry: ASSURED terms.

I

Identity-Persistence Sweep

In ASSURED, the read-only checklist run on any identity an attacker held or may have held: sessions and refresh tokens, MFA methods, registered devices, OAuth grants, mailbox rules and forwarding, delegated access, federation trust and new service principals. Finding an anchor is triage; removing it is containment. See Identity-persistence sweep.

Identity Provider (IdP)

The service that authenticates users and issues the tokens or assertions other applications trust: Microsoft Entra ID, Okta, Google Workspace, Ping. Its sign-in and audit logs are first-class evidence in identity, SaaS and cloud cases, and an IdP compromise reaches every federated app. See Federation and Single Sign-On (SSO).

Identity Threat Detection and Response (ITDR)

Tools and practices that detect and respond to attacks on the identity layer itself: directory and identity-provider misconfiguration, credential and token abuse, suspicious privilege grants, federation tampering. ITDR alerts often fire with no endpoint evidence at all, which is why identity logs are a first-class source in Subject analysis.

Impact

(1) In ASSURED, the first axis of the triage matrix: if this activity is real, how bad would it be? Scored as the higher of asset criticality and business impact, against the most valuable asset in confirmed reach. (2) In ATT&CK, the Impact tactic (TA0040): destruction, encryption, or manipulation of systems and data. Full entry: ASSURED terms.

Impossible Travel

An identity alert that fires when one account signs in from two places too far apart to travel between in the elapsed time. It rests on IP geolocation, which is an estimate, so VPNs, mobile carriers, cloud egress and residential proxies produce most of these alerts. Check the ASN, the device and the session before treating it as proof. A session presented from a hosting ASN minutes after the user’s own sign-in is the pattern that matters (see Adversary-in-the-Middle).

Inbox Rule

A mailbox rule that moves, deletes, marks read or forwards messages. Attackers add rules that hide replies and security notices (ATT&CK T1564.008, Email Hiding Rules) or forward mail outside (T1114.003, Email Forwarding Rule). See Identity-persistence sweep.

Incident

An occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system, or that violates (or imminently threatens to violate) law, security policies, security procedures, or acceptable-use policies (NIST SP 800-61r3). In ASSURED an event becomes an incident when it is declared (in the three-tier model, usually by Tier 2 or the IR lead after escalation), not when the alert fires; escalation hands IR a case. Not every incident has an external adversary: a misdirected file of customer data qualifies.

Incident Command

A leadership model for running a major incident, adapted from emergency management’s Incident Command System: one incident commander, defined roles (operations, communications, scribe) and a single source of decisions. Triage meets it at the handoff: on a P1, the warm handoff goes to whoever holds command.

Incident Declaration

The formal call that a case is an incident, which mobilizes incident response and its command structure. In ASSURED it is not the analyst’s escalation: escalation hands IR a case with its packet, and whether that case becomes a declared incident is the call of the role the protocol names (Tier 2 or the IR lead). Notification clocks are tracked separately, since many start at awareness, before any declaration. See Triage vs. incident response.

Incident Response

The organized approach to handling a security incident once it is declared. The classic lifecycle (NIST SP 800-61r2, withdrawn in 2025, and SANS PICERL) runs preparation; detection and analysis (identification); containment, eradication and recovery; post-incident activity (lessons learned). NIST SP 800-61r3 (April 2025) now maps incident response onto the CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover). Triage is the front edge of that lifecycle; ASSURED ends where IR takes ownership.

Indicator of Attack (IoA)

A behavioral sign that an attack is underway, whatever tools carry it: an Office process spawning a script interpreter that reaches out to the internet, or credential access followed by remote logons. Unlike an IoC, it describes what the adversary is doing rather than an artifact left behind, so it survives a recompiled payload.

Indicators of Compromise (IoC)

Atomic, replayable artifacts that, when observed, suggest an intrusion has occurred or is in progress: file hashes, IPs, domains, registry keys, certificate fingerprints, and similar discrete observables. Behavioral patterns (process trees, sequence of actions) are not IoCs; they live one layer up as TTPs.

Indirect Prompt Injection

An attack that plants instructions in content an AI system will read later (an email, a document, a log field, a web page), so the content steers the model instead of the user (OWASP LLM01:2025; MITRE ATLAS AML.T0051.001). In a SOC the attacker controls much of what an assistant reads, so an assistant with tools or outbound channels can be turned against the case. See Prompt Injection in the B.A.D. glossary and AI-assisted triage.

Information Sharing and Analysis Centers (ISACs)

Sector-based organizations (FS-ISAC, Health-ISAC and others) through which members share threat intelligence, indicators and incident experience under agreed handling rules. For triage they are a source of early, sector-specific indicators; respect the TLP marking on what they share.

Infrastructure

The systems, networks, and services that computing runs on. In triage the word points two directions: the organization’s infrastructure is what alerts fire on, and attacker infrastructure is the set of C2 servers, domains, and staging hosts an adversary operates, which pivoting on indicators is meant to map.

Inject

A late artifact handed to participants during an exercise, after they have committed to a decision, to test whether they update it. See The capstone.

Insider-Risk Route

In ASSURED, the path for cases whose subject is an employee or contractor: the IR lead, the insider-program lead (or HR) and legal on one bridge, with visibility restricted. Analysts record observable technical activity; HR-held context reaches the case only through this route, never as analyst-collected notes. Full entry: ASSURED terms.

Insider Threat Matrix

A public framework maintained by Forscie at insiderthreatmatrix.org that catalogs insider activity across five areas (motive, means, preparation, infringement, anti-forensics), with linked detections and preventions. Useful as a shared vocabulary for describing insider risk and threat.

Intake Channel

The route by which a case enters triage: a detection, a user report, an external notification, a bug-bounty or disclosure report, a hunt finding, a provider escalation or an internal referral. For any channel other than a detection, the Alert question becomes “what was reported, by whom, and what can we verify independently?” See Intake beyond detections.

Integrated Development Environment (IDE)

Software that developers use to write, run, and debug code, such as VS Code, Cursor, or IntelliJ. IDEs matter in triage because their normal operation (spawning helpers, executing scripts, running plugin hosts with sandboxes disabled, making encrypted outbound calls) looks like post-exploitation on developer workstations. AI coding agents built into IDEs now also run shell commands on the developer’s behalf. Malicious extensions are a real supply-chain vector, and a valid signature on the IDE says nothing about the extensions, MCP servers and package scripts running inside it, so inventory those before clearing an IDE alert.

Intelligence

Information collected and analyzed to answer a decision-maker’s question; in a SOC, usually threat intelligence. See Threat Intelligence for its levels and how to grade sources.

Inter-Process Communication (IPC)

Operating system mechanisms that let running processes exchange data, such as named pipes, shared memory, and local sockets. Triage-relevant because malware abuses these channels for command-and-control, privilege escalation, and coordination between implant components; named-pipe telemetry in particular is a staple of EDR detections for C2 frameworks such as Cobalt Strike, whose SMB beacons talk over named pipes.

Inter-Rater Agreement

How often independent raters give the same score, usually reported with Cohen’s kappa, which corrects for agreement by chance. ASSURED’s teaching kit treats kappa below 0.60 as unusable and aims for 0.80 or higher. See The agreement target.

Internet of Things (IoT)

Network-connected devices such as cameras, badge readers, printers, sensors and building controls. Most cannot run EDR, ship few logs and are rarely patched, so triage depends on network telemetry (NDR, firewall, DHCP and NAC records). An IoT device reaching the internet or internal servers it never talks to is a strong signal.

Internet Protocol (IP) Address

The numeric address a device uses to send and receive network traffic, and one of the most common pivot points in triage: reputation lookups, geolocation, registration data (RDAP, formerly WHOIS), and log correlation all key on it. Treat it as a weak proxy for identity, since NAT, VPNs, proxies, and shared cloud egress can put many actors behind one address.

Intrusion Detection System (IDS)

A sensor that inspects network traffic against signatures and anomaly rules and alerts on matches (Suricata, Snort; Zeek records the traffic it sees). Its alerts describe traffic, not outcome: an exploit signature firing does not mean the exploit worked. Check the target’s response and the host’s telemetry before rating it.

Intrusion Prevention System (IPS)

An inline IDS that blocks the traffic it matches. A blocked exploit with no execution or follow-on evidence is contained by control: recorded at P3 or P4 and proposed as a pattern-entry candidate, not paged to IR. Confirm the block covered every path, since the same source may have tried another.

Invalidation Trigger

In ASSURED, an event that forces immediate re-review of a pattern entry, with its closes moving to Level 1 meanwhile: the linked rule changed, the asset group was re-tagged, abuse of the pattern was observed, or an AI-matched entry’s model, prompt or tool changed. Full entry: ASSURED terms.

Investigation Loop

In ASSURED, the deliberate cycle Scope, Uncover, Risk: Risk findings send the analyst back for more evidence, a new entity re-enters Subject briefly, and Scope redraws the boundary, until the residual risk is understood or a confirmed criterion hands the case to IR. Full entry: ASSURED terms.

ISO/IEC 27001 A.5.25

The ISO/IEC 27001:2022 Annex A control “Assessment and decision on information security events”: the organization assesses events and decides whether to categorize them as incidents. It is the control auditors test triage against, usually by sampling closes and escalations for the decision, the evidence behind it and who made it. See Standards mapping.

ISO/IEC 27035

The international standard for information security incident management. Part 1 (ISO/IEC 27035-1:2023) sets out five phases: Plan and prepare, Detect and report, Assess and decide, Respond, and Learn lessons. Triage is Assess and decide: every close and every escalation is a decision under it. A paid standard; check quoted wording against a licensed copy. See Standards mapping.

Isolation Forests

A machine-learning algorithm that flags anomalies by how few random splits it takes to isolate a data point: rare points isolate quickly. Common inside UEBA and anomaly engines. Like any anomaly score, it says the point is unusual, not that it is malicious.

J

JA3

A method (Salesforce, 2017) for fingerprinting TLS clients by hashing fields of the ClientHello (an MD5 of the version, ciphers, extensions, curves and point formats). Degraded against modern browsers: Chrome 110 (early 2023) began randomizing TLS extension order, which splits one client into many JA3 hashes. (JA3 already ignores GREASE values.) The salesforce/ja3 repository was archived in 2025; prefer JA4 for new detections.

JA3S

The server-side counterpart to JA3: a fingerprint of the TLS ServerHello. Superseded by JA4S.

JA4

The 2023 successor to JA3 from FoxIO (FoxIO-LLC/ja4). A TLS-client fingerprint that sorts ciphers and extensions before hashing, so it stays consistent across connections from the same client build despite randomization. It handles TLS 1.3 and marks the transport with a leading “t” (TLS over TCP), “q” (QUIC) or “d” (DTLS). Part of the JA4+ suite, which adds separate fingerprints such as JA4H (HTTP client) and JA4S (TLS server). JA4 itself is BSD-3-Clause open source; the other JA4+ methods use the FoxIO License (free for internal use, licensed for commercial products), so check before embedding them in a product.

K

Kerberos

Active Directory’s default authentication protocol (TCP/UDP 88). The KDC on each domain controller issues a ticket-granting ticket (TGT) at logon, then service tickets for specific resources. Ticket theft (pass-the-ticket), offline cracking (Kerberoasting) and forgery (golden and silver tickets) all target this flow. Key events: 4768 (TGT), 4769 (service ticket).

Kill Switch

(1) In automation governance, the control that stops a machine from closing or acting and routes the queue back to analysts. ASSURED expects it at three scopes (per pattern entry, per automation or agent, global), held by a named owner and pulled in a test every quarter. See Governing automated triage. (2) In malware, a condition that makes the code stop, such as the domain that halted WannaCry’s spread.

Known Exploited Vulnerabilities (KEV) Catalog

CISA’s list of vulnerabilities with reliable evidence of exploitation in the wild, each with a remediation due date for US federal agencies. A CVE on KEV is being exploited somewhere now, which makes it a stronger urgency signal than a high CVSS score. Check KEV first, then EPSS.

Kubernetes

The dominant container orchestration platform and an attack surface in its own right: exposed API servers, over-permissioned service account tokens, and container escapes can turn one compromised workload into a path across the cluster. Analysts meet it through Kubernetes audit logs and runtime telemetry, where short-lived pods complicate reconstructing what was running when an alert fired.

L

Large Language Model (LLM)

A model trained on very large text corpora to predict and generate language: the engine behind chat assistants, SOC copilots and AI agents. It produces fluent text whether or not the content is correct (hallucination), and it can treat anything it reads, including attacker-controlled text in an email or log, as instructions (prompt injection, in the B.A.D. glossary). Useful for drafting; the analyst verifies and decides. See AI-assisted triage.

Late P1

In ASSURED, a P1 declared well after its first criterion was confirmed. The clock that matters runs from the first confirmed criterion to the page, and later confirmations do not restart it. Full entry: ASSURED terms.

Least Privilege

Granting each identity, human or not, only the access its task requires, for only as long as it needs it. Triage cares because it bounds blast radius: Scope reads what a compromised identity can reach, and standing excess privilege makes every alert on that identity riskier.

Legacy Systems

Systems still in production past vendor support, or unable to take modern controls: old Windows builds, unsupported appliances, industrial controllers. They often cannot run EDR or forward rich logs, so triage relies on network evidence and records missing telemetry as a gap. Old, reliable exploits still work on them.

Legal Hold

A directive, usually from legal counsel, to preserve information relevant to actual or reasonably anticipated litigation or investigation, suspending normal deletion and retention rules. A hold can attach to the logs, mailboxes and devices in a case; once one exists, nothing in its scope may be wiped, reimaged or allowed to roll off without counsel’s sign-off.

Lessons Learned

The post-incident step, in the NIST and SANS lifecycles alike, that turns a case into changes to detections, playbooks, controls and training. Triage records feed it, so a well-written closure record or handoff packet is what makes the lesson findable later. See Post-Mortem.

Level 0

In ASSURED, the pattern-close rung of the depth ladder: a case that matches a current, approved pattern entry, passes the eligibility gate and checks out on every discriminator closes in about five minutes with a five-field record. The close is an early Escalation decision. A failed discriminator moves the case to Level 1. See the fast path. Full entry: ASSURED terms.

Level 0 Audit Sample

In ASSURED, the weekly re-check of Level 0 closes: a second analyst re-verifies a random sample against raw telemetry, at least one close per pattern entry. A confirmed false close suspends the entry. Full entry: ASSURED terms.

Level 0 Parity

In ASSURED, the boundary for machine execution: a machine may close a case only where a human could close it at Level 0, under the same governed pattern entry, and only when every condition holds: the entry carries the machine-close flag; discriminators are evaluated by code; the eligibility gate is enforced; humans QA-sample the closes; reversal and miss rates are tracked; a kill switch and a named owner exist. Above it, AI assistants are advisory. See Governing automated triage. Full entry: ASSURED terms.

Level 0 Reversal Rate

Level 0 closes overturned on re-verification, divided by closes re-verified, per pattern entry. One confirmed false close reaches the default reversal threshold and suspends the entry. See Measuring triage.

Level 1

In ASSURED, standard triage: the compressed pass, about 15 to 45 minutes, for a case with no matching pattern entry (or one failed discriminator) and a bounded blast radius. Every phase runs; several collapse into single moves. Full entry: ASSURED terms.

Level 2

In ASSURED, the full arc of seven phases, about 25 to 80 minutes for a senior analyst. Any one trigger suffices: a crown-jewel subject, a privileged identity, or regulated data plausibly accessed by the activity under review; a second subject; a novel detection or a correlated chain; anything Level 1 could not resolve. Regulated data merely in reach is a Scope flag. Full entry: ASSURED terms.

Level Mix

The share of cases closed at Level 0, Level 1 and Level 2, with machine closes as their own line. A shift in the mix is a capacity and pattern-library signal. See Measuring triage.

Likelihood

In ASSURED, the second axis of the triage matrix: how probable it is, given the evidence, that the activity is malicious or unauthorized (High, Medium or Low). It is an estimative judgment, informed by the evidence and never raised above what the evidence supports; threat actor intent and exploitation & scope inform it. Analytic confidence in that estimate is a separate line, scored on the shared confidence rubric and recorded beside it. Unknown is not Low: when the deciding evidence could not be examined, likelihood reads Medium at minimum, confidence reads Low, and the gap is recorded as an open question. (Classical risk management uses likelihood for the probability that a threat exploits a vulnerability; ASSURED applies it to the activity under review.) Full entry: ASSURED terms.

Live Response

An EDR remote shell on an endpoint, Microsoft Defender for Endpoint’s name for the feature, used to collect forensic data such as memory, files and process lists. It still works on a network-isolated host, which stays connected to the EDR service. See Preserve before you contain.

Living Off the Land (LOTL)

Attackers using tools already on the system (PowerShell, WMI, certutil, rundll32, remote-management agents) instead of their own malware, so there is little to block and the activity blends with administration. Triage turns on context, not on the binary’s legitimacy: the parent process, the arguments, the user and the timing. See System Binary.

Log

A timestamped record of an event emitted by a system, application, or security control. Logs are the raw evidence of triage: the alert points at a moment in time, and the surrounding log entries are how the analyst reconstructs what actually happened.

Log Parsing

Parsing applied to log records: extracting fields from raw log lines so they can be searched and correlated. See Parsing and Normalization.

M

Machine-Close Flag

In ASSURED, a per-entry, per-version switch on a pattern entry, off by default, that permits a machine close once every Level 0 parity condition holds. Turning it on needs a second person’s approval, and any change to the entry turns it off again. Full entry: ASSURED terms.

Managed Detection and Response (MDR)

An outsourced service that monitors an organization’s telemetry, triages alerts and often takes first response actions on its behalf. The provider triages; accountability for the outcome stays with the customer, so the escalation path, pre-authorized actions and evidence-sharing terms belong in the contract.

Managed Identity

In Azure, an Entra service principal whose credentials the platform manages for an Azure resource, so no secret is stored. Its sign-ins go to the AADManagedIdentitySignInLogs table. See Non-human identities and cloud roles.

Managed Security Service Provider (MSSP)

An outsourced provider that monitors and triages security events for many customers. The provider owns the triage; the customer keeps accountability for the asset, the business context and the decisions only an owner can make. See Managed Detection and Response (MDR) and Running ASSURED as an MSSP or MDR.

Mandatory Access Control (MAC)

An access policy where permissions are centrally controlled and enforced based on classifications. Not to be confused with a MAC address (the hardware address of a network interface).

Mark of the Web (MOTW)

The Zone.Identifier alternate data stream Windows attaches to files that arrive from the internet or by email. Office blocks macros in files that carry it and SmartScreen warns on them, which is why attackers deliver payloads inside containers (ISO, VHD, some archive formats) or through extraction tools that do not pass the mark on (ATT&CK T1553.005). A downloaded payload with no MOTW is worth asking why.

Material AI Use

In ASSURED, the record line that names the assistant and version used and which sections began as AI drafts, or “none”, so a later reader can weight the provenance of what they read. Full entry: ASSURED terms.

Materiality (SEC)

The test that triggers a US public company’s cybersecurity disclosure: whether there is a substantial likelihood that a reasonable investor would consider the incident important. The company must make that determination without unreasonable delay after discovery, and Form 8-K Item 1.05 is due within four business days of determining that an incident is material. Triage does not decide materiality; it supplies the facts and timestamps the people who do decide will rely on.

MD5

A 128-bit hash function that is cryptographically broken: collisions can be manufactured cheaply (RFC 6151). Still common as an IoC identifier, but pivot on SHA-256 where possible.

Mean Time To Acknowledge (MTTA)

A triage flow metric: acknowledged minus detected, reported as the median and the 90th percentile per priority band rather than as a mean. Acknowledged means the first recorded analyst action on the case; opening or claiming a ticket does not count. See Measuring triage.

Mean Time To Detect (MTTD)

Detection time minus the time of first malicious activity. An incident metric, not a triage one: only IR’s compromise timeline establishes the time of first activity, and for a benign close it does not exist. FIRST’s Security Incident Timing Metrics define it. See Measuring triage.

Mean Time To Respond/Resolve (MTTR)

A widely quoted speed metric whose R is ambiguous: respond, resolve, remediate or recover, depending on who reports it. Properly it is an incident metric: FIRST’s Security Incident Timing Metrics measure time to respond, contain and remediate from the time of first malicious activity, which only IR’s compromise timeline establishes. Never report it without its formula. Triage’s own clocks (time to acknowledge, time to verdict, time to decision) start at detection, and a mean hides the long-tail cases, so report medians and the 90th percentile and pair speed with quality measures such as the reopen rate and handoff rework. See Measuring triage.

Memory Capture

Imaging a running system’s RAM, also called memory acquisition, before a reboot, reimage or process termination destroys it. Memory holds what disk does not: injected code, decrypted payloads, live connections, keys. On a production server it can destabilize the system, so it needs the owner’s approval. See Order of Volatility and Preserve before you contain.

Merged into Case

In ASSURED, a status on a member alert grouped into a case, not a disposition. The member keeps its own detection-axis verdict; the case carries the activity verdict. Full entry: ASSURED terms.

Metadata

Data about data: file timestamps, owner, size, hash; an email’s headers; a process’s parent, command line, and signing certificate. In triage, metadata is often more diagnostic than the content itself.

Missed Incident

A confirmed incident with at least one related alert or case that triage had closed as benign. Each one is reviewed, not averaged, and the past misses join the golden set. See Measuring triage.

Mitigation

Action that reduces a risk without eliminating it: a compensating control, a workaround, a temporary block. Distinct from remediation, which fixes the underlying issue.

MITRE ATT&CK

MITRE’s public knowledge base of adversary tactics, techniques and procedures observed in real intrusions, with Enterprise, Mobile and ICS matrices. Enterprise v19 (April 2026) split Defense Evasion into Stealth and Defense Impairment. Triage uses it as a shared vocabulary: map what the evidence shows to technique IDs, record the version, and remember that a mapping names behavior without scoring it. See the ATT&CK Tactic, Technique and Procedure entries.

Mobile Application Management (MAM)

Protection applied to corporate apps and their data rather than to the whole device (app PINs, copy and save restrictions, selective wipe), the usual control on personally owned phones. A MAM-only device has no device telemetry, so evidence comes from the identity provider and the apps.

Model Context Protocol (MCP)

An open protocol for connecting AI assistants and agents to tools and data sources through MCP servers. Each server describes its tools to the model and runs as code the host trusts, so a tampered tool description or an over-scoped token becomes the assistant’s problem. Inventory MCP servers like extensions; a signed host does not vouch for them. See AI-assisted triage.

mshta.exe

The Windows host for HTML Applications. See HTML Application (HTA) for how attackers abuse it (ATT&CK T1218.005).

Multi-Factor Authentication (MFA)

Security system requiring two or more verification methods to grant access, combining something you know, have, or are. Not all MFA is equal. OTP codes, SMS and push approvals can be relayed by adversary-in-the-middle phishing proxies, worn down by push bombing (MFA fatigue), or bypassed by SIM swap and help-desk resets. A stolen session token skips MFA entirely. Phishing-resistant factors (FIDO2 security keys, passkeys, certificate-based auth) bind the login to the real site’s origin and defeat AiTM. In triage, “MFA was satisfied” is evidence about the factor, not about the person.

N

N-Day Vulnerability

A vulnerability that is publicly known and has a fix, but is not yet patched on a given system. Attackers often weaponize n-days within days of disclosure, sometimes by reverse-engineering the patch itself, which is why the gap between patch release and patch deployment is attack surface.

Network and Information Security Directive (NIS2)

The EU directive (2022/2555) on cybersecurity for essential and important entities in sectors such as energy, transport, health, digital infrastructure and managed services, applied through each member state’s national law. For a significant incident it sets an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month. Which entities are in scope, and to whom they report, depends on the member state.

Network Detection and Response (NDR)

Sensors that analyze network traffic and flow metadata to detect threats, often against learned baselines, and support response such as blocking or isolating. NDR sees devices that cannot run EDR (appliances, IoT, unmanaged hosts) and lateral traffic inside the perimeter, but encryption limits how much of the payload it can inspect.

Network Segmentation

Dividing a network into zones with controlled paths between them. It limits blast radius and shapes Scope: what a compromised host can reach depends on the segmentation rules as they were at the time, not as the diagram says. Traffic crossing a boundary it should not is a lateral-movement signal.

Network Traffic

The data moving between hosts on a network, observed as connections, flows, and packets. In triage, traffic metadata (who talked to whom, when, how much, and over which port and protocol) is often the fastest way to confirm or rule out command and control, exfiltration, or lateral movement.

NIST Cybersecurity Framework 2.0 (CSF 2.0)

NIST’s outcome framework (CSWP 29, 26 February 2024), organized as six Functions (Govern, Identify, Protect, Detect, Respond, Recover), each split into Categories and Subcategories. It states what an organization should achieve, not how. Triage performs two of its outcomes most directly: DE.AE, Adverse Event Analysis, and RS.MA, Incident Management. See Standards mapping.

NIST SP 800-61r3

NIST’s incident response guidance, revision 3 (April 2025), written as the CSF 2.0 Community Profile for incident response. It replaced revision 2, which NIST withdrew on 3 April 2025, so r2’s four-phase lifecycle is history rather than the current model. r3 says what an incident response program should achieve and leaves the choice of life-cycle model to the organization. See Standards mapping.

Non-Human Identity (NHI)

An identity used by software rather than a person: service accounts, cloud roles and workload identities, API keys, OAuth applications, CI/CD tokens, AI agents. Non-human identities often outnumber people, hold standing privilege, skip MFA, and behave predictably, so one doing something interactive or new is a strong Subject signal. They are subjects in their own right. See Non-human identities and cloud roles.

Normalization

Converting logs and events from different sources into a common field schema, such as OCSF, ECS, Splunk CIM, Microsoft Sentinel ASIM or Google SecOps UDM, so a username, IP, or timestamp means the same thing regardless of which tool recorded it. SIEM correlation rules and cross-source queries depend on it; fields that were never normalized are where searches silently miss.

Notification Incident (US Banking Rule)

Under the US federal banking regulators’ computer-security incident notification rule, an incident that has materially disrupted or degraded, or is reasonably likely to, a banking organization’s operations. It starts a 36-hour notice to the primary federal regulator. See Notification clocks.

Number Matching

An MFA push variant in which the user types a number shown on the sign-in screen into the authenticator app, so a blind or fatigued approval cannot complete the sign-in. A countermeasure to MFA fatigue.

NYDFS Part 500 (23 NYCRR 500)

The New York Department of Financial Services cybersecurity regulation for its licensed entities. Section 500.17 sets a 72-hour notice of a cybersecurity incident, a 24-hour notice of an extortion payment and a written explanation of that payment within 30 days. See Notification clocks.

O

OAuth Consent Grant (Illicit Consent)

A user’s or admin’s approval that lets a third-party application act on their data with the permissions (scopes) it requested, such as Mail.Read and offline_access. Attackers abuse it by luring users into consenting to a malicious app (consent phishing), which gives API access that survives a password reset and MFA. Triage: check the publisher’s verification, the scopes, and the consent event in the audit log. Revoking the grant is a non-reversible step that needs IR or owner approval unless the protocol pre-authorizes it. ATT&CK T1528.

Obfuscation

Making code, commands or data hard to read or detect: encoding, string splitting, variable expansion, packing. Attackers use it to slip past detection; vendors use it legitimately to protect code. Deobfuscate before judging: decode, expand and unpack, then read what the command or script actually does.

Office for Civil Rights (OCR)

The US Department of Health and Human Services office that enforces the HIPAA Privacy, Security and Breach Notification Rules. Breaches affecting 500 or more individuals are reported to it within 60 days of discovery; smaller ones are logged and reported within 60 days after the end of the calendar year.

Open Question

In ASSURED, a gap the analyst could not close, recorded explicitly: what is unknown, why, and what would resolve it. Open questions keep unknowns from passing as negatives (see Unknown Is Not Low), and they form section 8 of the handoff packet, where IR picks up. For a claim of malicious activity, the open question is whatever kept it below High confidence. Full entry: ASSURED terms.

OpenC2

An OASIS standard language for machine-to-machine commands to cyber-defense tools (block this address, isolate this host), meant to let orchestration platforms drive devices from different vendors through one vocabulary. Adoption is still limited.

Order of Volatility

The principle (RFC 3227) of collecting evidence from the most to the least short-lived: CPU state and memory, network connections and running processes, temporary files, disk, then remote logs and backups. A reboot or an EDR isolation can destroy the top of the list, which is why preservation comes before containment. See Preserve before you contain.

Organizationally Unique Identifier (OUI)

The first 24 bits of a MAC address, assigned by the IEEE to a specific organization, typically a hardware vendor. Looking up the OUI turns an unknown MAC into a vendor name when hunting rogue or unmanaged devices, but modern endpoints randomize their MAC addresses. A randomized MAC sets the locally administered bit, so a second hex digit of 2, 6, A or E (for example x2:xx:…) means no vendor lookup will work, and the address is not a stable device identity.

Orphaned Credentials

Accounts, keys or tokens that outlived their owner or purpose: a leaver’s account never disabled, a key for a retired app, an OAuth grant nobody remembers. Attackers prize them because nobody notices their use. Activity from an account whose owner has left, or from a credential with no owner in the inventory, deserves a Subject review.

Out-of-Band Communication

A channel for coordinating a response that does not depend on the systems the attacker may control: a separate identity provider, a phone bridge, a pager. ATT&CK mitigation M1060. See Talking to people during triage.

Out-of-Band Verification

Confirming that a notifier, caller or instruction is genuine through a contact channel you found yourself (a published number, the contract contact), never one supplied in the notice. See Call-Back Verification and External notifications.

Override Rules

In ASSURED, the only three ways a matrix cell is modified, applied in order: the escalation tripwire raises the case to P1; the high-impact clock tightens a High/Low P3; de-escalation is explicit, with a named reason. Full entry: ASSURED terms.

P

Packet Capture Files (PCAP)

Full copies of network traffic, payload included, read with tools such as Wireshark or Zeek. The highest-fidelity network evidence and the rarest: most environments keep only flow metadata, and encryption hides most payloads. Where a sensor can capture, preserve the PCAP for the case window before it rolls off.

Parsing

Breaking a raw alert, log line, or command string into its component fields so each can be examined on its own: the user, the host, the action, the time. In triage, parsing the alert is the first move; the details that decide a verdict live in the fields, not in the alert name. Alert parsing and log parsing are the same move applied to different inputs.

Passkey

A FIDO2 credential that replaces a password: a public-key pair bound to the site’s origin, unlocked on the device with a biometric or PIN. Synced passkeys live in a platform account or password manager and follow the user across devices; device-bound passkeys stay on one security key or device. Both resist phishing proxies, but a synced passkey is only as safe as the account that syncs it.

Password

A shared secret used to authenticate. A correct password proves only that someone had it: passwords are phished, reused, sprayed and sold from infostealer logs. A password reset alone does not evict an attacker who holds a session or refresh token. See Token.

Pattern Entry

In ASSURED, one record in the pattern library: the benign behavior, its discriminators, known mimicry and blind spots, eligibility constraints, an owner and an approver, a review date, a validation test and the close history. Every Level 0 close cites the entry and the version it matched. Full entry: ASSURED terms.

Pattern Library

In ASSURED, the SOC’s written catalog of known-benign alert patterns, each entry with named discriminators, an owner, a version and a review date, approved by a second person. It is governed like code: version history, invalidation triggers (a rule change, observed abuse), an optional machine-close flag, and a reversal threshold that suspends the entry automatically. A five-minute Level 0 close is earned by a current entry, not granted by the timer. See the fast path. Full entry: ASSURED terms.

Payment Card Industry Data Security Standard (PCI DSS)

The PCI Security Standards Council’s data security standard for any entity that stores, processes, or transmits payment card account data (cardholder data and/or sensitive authentication data), debit as well as credit. Current version as of 2026: v4.0.1; its future-dated requirements became mandatory on 31 March 2025. It is enforced by contract through the card brands and acquirers rather than by statute. A suspected CDE compromise can trigger card-brand notification and a PCI Forensic Investigator (PFI) engagement.

PEAK

Splunk SURGe’s threat hunting framework (2023), Prepare, Execute, and Act with Knowledge, covering hypothesis-driven, baseline and model-assisted hunts. A hunt finding reaches triage with its hypothesis already formed: enter it in the hypothesis ledger. See Hunt findings.

Peer Validation

Having a second analyst review a triage verdict or escalation decision before it is finalized. A standard SOC quality control, because a fresh set of eyes catches assumptions and confirmation bias the original analyst can no longer see.

Penetration Testing

An authorized, scoped attempt to find and exploit weaknesses, usually time-boxed and goal-driven. Its activity fires real alerts. Verify each against the engagement record (scope, hosts, operators, window) before recording a benign true positive, because a real intruder can hide inside a test window.

Permissible Actions Protocol (PAP)

A companion marking to TLP that says what a recipient may do with shared intelligence, not who may see it. PAP:RED: passive, non-detectable use only (search your own logs; no lookups the adversary could observe). PAP:AMBER: passive cross-checks, such as queries to third-party services like VirusTotal. PAP:GREEN: active actions such as blocking or probing the infrastructure. PAP:CLEAR: no restrictions. Read it before you look up or block an indicator from a partner report. See Traffic Light Protocol (TLP).

Personal Access Token (PAT)

A long-lived bearer token issued to a user or bot account in a source-control or SaaS platform, often broadly scoped and rarely rotated. A password reset does not revoke it. See Non-human identities and cloud roles.

Personal Data (GDPR)

Under GDPR Art. 4(1), any information relating to an identified or identifiable natural person, directly or indirectly: names, identification numbers, location data, online identifiers such as IP addresses and cookie IDs, and factors specific to a person’s identity. Broader than most US PII definitions, so most identity and network logs about people contain it.

Personally Identifiable Information (PII)

Information that identifies a person, or can be linked to one directly or in combination with other data: names, account IDs, email and IP addresses, device identifiers, location. Legal definitions vary (NIST’s covers anything ‘linked or linkable’ to an individual; GDPR’s ‘personal data’ is broader than most US ‘PII’ definitions), so tag generously and let privacy decide.

Phase

In ASSURED, one of the seven steps (Alert, Subject, Scope, Uncover, Risk, Escalation decision, Documentation), each with one question to answer and one deliverable for the next. A thinking order, not a waiting queue: a confirmed criterion escalates from any phase. Full entry: ASSURED terms.

Phishing Simulation

An authorized phishing campaign run by the awareness team to measure and train reporting. A user’s report of one is a correct report of authorized activity, so it closes as a true positive, authorized (benign true positive), not as a false positive. Check the simulation schedule before working a reported phish.

Playbook

A predefined, repeatable procedure for handling a specific alert or incident type: the steps, the decision points, the exit criteria. Playbooks encode the SOC’s institutional memory so the response does not depend on who is on shift; SOAR platforms automate their mechanical steps. The fast path’s pattern library is a playbook collection with discriminators attached.

Policy Violation

In ASSURED, the activity-axis verdict for activity that broke policy without evidence of malicious intent. It cannot close at Level 0. Full entry: ASSURED terms.

Port

A 16-bit number from 0 to 65535 carried in TCP and UDP headers that tells a host which service or process the traffic belongs to: 443 for HTTPS, 22 for SSH, 3389 for RDP. In triage, ports are a cheap tell; a standard service on a nonstandard port, or traffic to a port that should not be listening, is worth a second look.

Post-Mortem

The structured retrospective an organization runs after a closed incident: timeline, decisions, what worked, what failed, what the team learned. A good post-mortem points back at detection, process, or training gaps. A blameless one names the system, not the person.

PowerShell

Microsoft’s shell and scripting language: Windows PowerShell 5.1 on .NET Framework, cross-platform PowerShell 7 on .NET. The most abused interpreter on Windows (ATT&CK T1059.001). Triage tells: -EncodedCommand or -enc (Base64 of UTF-16LE text), -NoProfile, -WindowStyle Hidden, IEX with a download cradle, and an Office or browser parent. Script Block Logging (Event ID 4104) records de-obfuscated script content.

Pre-authorized Actions

In ASSURED, the short written list of containment actions triage may take without waiting for IR, agreed in advance with IR and the business owners: typically isolate a host, disable an account, revoke sessions, and disable a consented application’s sign-in. Every action on the list is reversible. Preserve before you contain, and get IR or owner approval for non-reversible steps such as a credential reset or a grant revocation unless the protocol lists them for that scenario. See Containment authority. Full entry: ASSURED terms.

Precision (Detection)

Detection-axis true positives divided by alerts with a detection verdict, per rule and rule version. Benign true positives count as correct: a rule that fires accurately on authorized activity is precise and needs context, not a logic change. See Per-rule numbers.

Premature Closure

Settling on a verdict before the evidence supports it, often because the first plausible explanation fits, and then not looking further (tunnel vision). It bites in Uncover and Risk. Counter: name what would change the verdict, and check it before closing.

Preserve Before You Contain

In ASSURED, the ordering rule for containment: capture the volatile evidence and the artifacts a containment action would destroy, then take the pre-authorized action. Pre-authorized actions are reversible; non-reversible ones need IR or owner approval unless the protocol lists them. See Preserve before you contain. Full entry: ASSURED terms.

Pretexting

Social engineering built on an invented scenario rather than a malicious payload: the caller claiming to be IT support, the “CEO” emailing about an urgent confidential deal, the vendor with new bank details. The pretext gives the target a plausible reason to comply. The delivery mechanism behind business email compromise and most voice phishing.

Primary Refresh Token (PRT)

A long-lived token Microsoft Entra ID issues to a registered device at sign-in, used to get access tokens for apps without prompting again. A stolen PRT, or a session cookie derived from one, lets an attacker sign in as the user and can satisfy device-based Conditional Access. Revoking sessions, not only resetting the password, is what invalidates it.

Priority Band (P1-P4)

In ASSURED, the urgency the triage matrix assigns a case, which sets its clocks. P1: page immediately, no-acknowledgment fallback at 15 minutes, escalate with a warm handoff. P2: acknowledge within 15 minutes, escalate within 4 hours. P3: queue, keep working and re-score within 24 hours on a named trigger (within hours for a High-impact, Low-likelihood cell), then close or escalate. P4: documented close within the queue SLA. The clocks are defaults for adopters to tune. A confirmed criterion makes any case P1. See the priority matrix. Full entry: ASSURED terms.

Privileged Access Management (PAM)

Tools that vault privileged credentials, broker or record privileged sessions, and grant elevation just in time. PAM records are triage evidence: who checked out which credential, when, and what the session did. Privileged activity that bypassed PAM where policy says it must not is itself a signal.

Privileged Identity

In ASSURED, a member of a privileged role or group in the identity provider, or automation holding deploy, signing, secrets or repository-write rights. A privileged identity always fails the Level 0 eligibility gate and routes to Level 2. Full entry: ASSURED terms.

Process

A running instance of a program, with a process ID, a parent process, a command line, and the user context it executes under. Process ancestry, meaning which process spawned which, is often the fastest triage signal for whether an execution is routine or suspicious.

Process Access Mask (GrantedAccess)

The access rights a process requests when it opens a handle to another process, recorded in the GrantedAccess field of Sysmon event 10. Masks that include memory read on LSASS, such as 0x1010, are a classic credential-dumping signal. See Telemetry labs.

Process Relationships

How processes on a host connect: parent and child, the user each runs as, the handles and pipes they share. Most endpoint verdicts turn on lineage, such as an Office application spawning a shell. See Process relationships.

Protected Health Information (PHI)

Individually identifiable health information protected under HIPAA: a person’s health status, the care they received, or payment for that care, linked to their identity. Alerts touching systems that hold PHI raise the escalation stakes, because exposure carries regulatory breach-notification duties.

Protocol

The agreed set of rules two systems use to communicate: HTTP, DNS, SMB, RDP. In triage the protocol tells you what a connection is capable of doing, and a mismatch between the protocol and the port it runs on is a classic tell for tunneling or evasion.

Purge (Email Remediation)

Removing a delivered message from every mailbox that received it, often called search and purge. A soft delete is recoverable and a hard delete is not. It is a containment action: export a copy of the message and its headers for the case first. See Preserve before you contain.

Purple Team

Red and blue working together in the open: the red team runs a technique, the defenders check whether it was detected and how it looked in the alert, and both iterate until it is caught. The output is detections and triage notes, not a report card.

Pyramid of Pain

David Bianco’s model (2013) ranking indicators by how much it costs an attacker when defenders detect them: hash values (trivial to change), IP addresses, domain names, network and host artifacts, tools, and TTPs at the top (hardest to change). Detections built on behavior outlast detections built on hashes.

Q

Quarantine

Isolating a file, message or host so it can no longer do harm while it is examined: an EDR moving a file into a protected store, an email gateway holding a message, a network isolation that cuts a host off from everything except the security tools. A control that quarantined malicious activity, with no execution or follow-on evidence, puts the case on the contained-by-control path: recorded at P3 or P4 and proposed as a pattern-entry candidate, not paged to IR. Host isolation can destroy volatile evidence, so preserve first.

R

Ratchet

In ASSURED, the depth ladder’s one-way rule: any surprise moves a case up a level, and it never slides back down mid-case. Full entry: ASSURED terms.

Re-score Trigger

In ASSURED, the named event or time at which a P3 or undetermined case is scored again: a log delivery, the end of a forward watch, an owner’s answer, or a fixed time within 24 hours (within hours on the High/Low cell). A P3 without a named trigger is a parked case. Full entry: ASSURED terms.

Re-skinning

Changing a public exercise case’s surface (names, hosts, times, tools) while keeping its decision invariants, so an assessed cohort cannot answer from the published key. See The capstone.

Recommended Move

In ASSURED, Risk’s output beside the cell: escalate, keep working to a named re-score trigger, or close. Risk recommends; the Escalation decision decides. Full entry: ASSURED terms.

Red Team

A team that emulates a real adversary against the organization, with permission, to test detection and response end to end. Its activity should fire real alerts; when it does, the close is a benign true positive, verified against the engagement record, not a false positive.

regsvr32.exe

A Windows utility that registers and unregisters DLLs and COM objects, abused to run remote scriptlets through a signed binary. Tell: regsvr32 /s /n /u /i:<url> scrobj.dll, the “Squiblydoo” pattern (ATT&CK T1218.010).

Regulation S-P (SEC)

The SEC’s privacy rule for brokers, dealers, investment companies and advisers, as amended in 2024: customer notice within 30 days of becoming aware of unauthorized access to sensitive customer information, and a 72-hour notice from service providers. Every covered institution has had to comply since 3 June 2026. See Notification clocks.

Regulatory Compliance

Adherence to laws, regulations, and standards governing data protection, privacy, and security requirements for specific industries or data types. In triage, compliance obligations are why Scope checks the regulatory boundary early: they decide which notification clocks and preservation duties attach.

Regulatory Flags Block

In ASSURED, the template block on the event report and handoff packet that records, when regulated data is plausibly involved, the regime, the data class, the candidate clock start in UTC, the owner engaged and the owner’s decision. Triage flags; privacy and legal decide. See The regulatory flags block.

Regulatory Requirements

The legal and contractual obligations that attach to specific data types, industries and companies, such as GDPR, HIPAA, PCI DSS (a card-industry standard enforced by contract rather than statute), state breach laws such as California’s 30-day clock, the SEC disclosure rule for public companies, and EU regimes such as NIS2 and DORA, including breach-notification deadlines. They matter in triage because an incident touching regulated data starts a clock the response has to honor.

Relationship Mapping

Charting how an entity connects to others (users to hosts, hosts to services, accounts to groups, apps to grants) to see what a compromise could reach. In ASSURED it is the relationships dimension of Subject analysis. See Four Dimensions.

Reliability Assessment

Evaluating how far to trust a source and a piece of information before acting on it. For intelligence, grade the source’s reliability and the information’s credibility separately (the Admiralty code is one common scheme). For telemetry, ask whether the source records the field you need, at the fidelity you need, for the window you need.

Remediation

The fix that removes the underlying cause: patching the vulnerability, rebuilding the host, rotating every exposed credential, closing the misconfiguration. Distinct from mitigation, which only reduces the risk until remediation lands.

Reopen Rate

Cases closed in a month and reopened on new evidence within 30 days, divided by the cases closed that month. A rising rate points at closes made before the deciding evidence was in. See Measuring triage.

Reopen Trigger

The condition written into a closed case’s record that reopens it. Required for any close whose activity verdict is undetermined, and for benign and authorized closes as reopen conditions.

Request for Comments (RFC)

The numbered document series in which internet protocols and standards are defined. The one every analyst ends up citing is RFC 1918, which reserves the private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that tell you at a glance whether an IP is internal or external. Also not public: 100.64.0.0/10 (carrier-grade NAT, RFC 6598), 169.254.0.0/16 (link-local, RFC 3927; 169.254.169.254 is the cloud instance-metadata service, a credential-theft target), and IPv6 fc00::/7 (RFC 4193).

Residual Risk

The risk that remains once controls and actions are accounted for. In ASSURED the Scope, Uncover and Risk loop runs until the residual risk is understood well enough to justify a resolution; what is still unknown is recorded as open questions, and a close records its reopen conditions.

Retrieval-Augmented Generation (RAG)

A design where an AI system searches a document store or index for relevant content and feeds what it finds to the model alongside the question, so answers draw on that content. In a SOC, retrieval must be permission-aware (the assistant must not surface what the analyst could not open), and every retrieved document is a path for indirect prompt injection. See AI-assisted triage.

Reversal Threshold

In ASSURED, the number of confirmed false closes that suspends a pattern entry automatically until its owner re-reviews it. One, by default. Full entry: ASSURED terms.

Risk

In ASSURED, the combination of impact (how bad it would be if real) and likelihood (how probable it is that the activity is malicious or unauthorized), read off the triage matrix rather than multiplied. The matrix cell gives a priority (P1 to P4) and a recommended move; analytic confidence is recorded beside the cell, not folded into it. Risk recommends; the Escalation decision makes the close-or-escalate call.

Risk-Based Alert Triage Matrix (RATM)

ASSURED’s own risk-scoring model, not an industry standard. Four dimensions (asset criticality, threat actor intent, exploitation & scope, business impact) are each scored High, Medium or Low, then reduced to the two axes of the triage matrix. Impact is the higher of asset criticality and business impact. Likelihood is an estimate of how probable it is that the activity is malicious or unauthorized: intent and exploitation & scope inform it, and nothing raises it above what the evidence supports. Confidence is recorded beside the cell. The cell gives a P1 to P4 priority and a recommended move. Adapt the rubric anchors to your environment; keep the reduction rules. Unrelated to Splunk’s Risk-Based Alerting despite the similar name. See the priority matrix. Full entry: ASSURED terms.

Risk-Based Alerting (RBA)

Splunk’s model in which detections add risk to an entity instead of alerting one by one, and an aggregating detection raises a finding when the entity’s total crosses a threshold. It decides what reaches the queue. It is unrelated to ASSURED’s RATM, which rates one case’s impact and likelihood to set its priority once the case is in the queue. See Standards mapping.

Role-Based Access Control (RBAC)

Access granted to roles, which users inherit by membership. Triage asks which role granted the action, whether the user should hold it, and whether the membership itself is new: a recent addition to a privileged group is one of the strongest identity signals.

Root Cause Analysis

Root cause analysis (RCA): the process of identifying the underlying cause of a security incident or problem, the condition that, once fixed, prevents a recurrence, rather than the symptom that fired the alert.

Routes to Escalation

In ASSURED, the three ways a case escalates, named in the handoff: a confirmed criterion (the escalation tripwire, P1); the matrix (a P1 or P2 cell with no criterion confirmed); or an operational route such as capacity. Full entry: ASSURED terms.

Rubber-Stamping

Signing an AI draft or a recommendation without the verification the signature claims, also called approval fatigue. Its signals are in the case tool’s timestamps: approvals faster than the checks can run, near-zero edits, identical close notes, agreement rates that jump after a model change. See Automation Bias and Rubber-stamp signals.

Rule-Based Detection

One of the four detection families ASSURED teaches: explicit logic over events (thresholds, sequences, field conditions), written as SIEM correlation rules or Sigma. Rules are transparent, so the analyst can read exactly why one fired, and brittle, so small variations slip past. See Rule-based detection.

Runbook

Step-by-step operational instructions for one concrete task: rotate this credential, isolate this host, pull this log. Narrower than a playbook. A playbook decides what to do; a runbook specifies exactly how to do one of its steps.

rundll32.exe

A Windows utility that runs an exported function from a DLL, abused to execute attacker code through a signed binary (ATT&CK T1218.011). Tells: a DLL loaded from a user-writable path such as a Temp or Downloads folder, an export called by ordinal, or a javascript: invocation on the command line.

S

Sandboxing

Detonating an unknown file or URL inside an isolated environment to observe what it does. Mature malware checks for sandbox-typical signals (small disk, brief uptime, no mouse activity, suspicious driver names) and stays dormant until it sees a real host.

SANS DAIR (Dynamic Approach to Incident Response)

The incident response model taught in SANS SEC504 since at least 2024 and published by Joshua Wright in September 2026 as a free CC BY 4.0 book. Built on the OODA loop, it runs through waypoints (Prepare, Detect, Verify and Triage, a Response Actions loop, Debrief), each with a checklist. ASSURED fits inside its Verify and Triage waypoint as the per-case procedure. See Standards mapping.

Sarbanes-Oxley Act (SOX)

A 2002 United States federal law that mandates accurate financial reporting and internal controls at publicly traded companies. It matters to security because its Section 404 internal-control audits pull IT general controls into scope, driving access control, change management, and audit logging requirements on systems that feed financial statements and raising the criticality of those assets during triage.

Schema Normalization

Another name for normalization: mapping events from different log sources into one common field schema. See Normalization.

Scope

In ASSURED, the third phase: deciding where the investigation’s lines are before Uncover pulls evidence, across four boundary types. Regulatory: which notification clocks and preservation duties attach. Time: the window to examine, which may start well before the alert. Entity: which subjects are in. Infrastructure: what the SOC can actually see. Scope is provisional: Risk can push the investigation back to Scope to widen it, and suspicion of an escalation criterion refines Scope rather than escalating. Outside ASSURED, the word also means the agreed boundaries of an incident-response engagement.

Scope Creep

An investigation growing past its boundaries without anyone deciding it should. In ASSURED, widening Scope is a deliberate move, made when Risk sends the case back with a reason and recorded in the case. Growth without that record is creep, and it stalls the close-or-escalate decision.

SEC Cybersecurity Disclosure Rule

The US Securities and Exchange Commission’s 2023 rule requiring public companies to disclose material cybersecurity incidents on Form 8-K Item 1.05 within four business days of determining materiality (a US Attorney General national-security or public-safety determination can delay it), and to describe their cybersecurity risk management annually. See Materiality (SEC).

Second Subject

In ASSURED, a second independent actor, or any additional account or host the activity moved into. It moves a case to Level 2; confirmed, it is also the lateral-movement criterion. Full entry: ASSURED terms.

Secure Email Gateways (SEG)

The filter in front of mailboxes that scans links, attachments and sender authentication, and quarantines or rewrites messages. A clean gateway verdict is not a verdict on the message: lures with no payload (BEC, QR codes, device-code requests) pass through, so read the headers and the click logs.

Secure Hash Algorithm (SHA)

A family of cryptographic hash functions. SHA-1 is broken for collisions (first public collision in 2017) and NIST is retiring it by 2030. SHA-256 (SHA-2 family) is the standard IoC hash, and SHA-3 is a separate alternative family.

Secure Shell (SSH)

Encrypted remote login and command execution, standard on Linux, network devices and cloud instances (TCP 22), and a common lateral-movement path with stolen keys. Tells: a new source host or key for an account, logins from hosts that never administer the target, and new entries in authorized_keys.

Secure Sockets Layer (SSL)

TLS’s deprecated predecessor. Every SSL version is insecure and disabled in modern clients, but the name survives in product terms such as SSL inspection and SSL VPN, which today mean TLS. See Transport Layer Security (TLS).

Security Control

A safeguard that prevents, detects or corrects a security problem: MFA, a firewall rule, an EDR policy, a review step. Controls appear in triage twice: as evidence (their logs) and as context (a control that blocked the activity puts the case on the contained-by-control path).

Security Incident Timing Metrics (SITM)

FIRST’s reference for incident timelines (version 1.0, May 2023): eleven timeline records and four key metrics (time to detect, respond, contain and remediate), each measured from the time of first activity. These are incident clocks; triage’s own clocks start at detection. See Measuring triage.

Security Information and Event Management (SIEM)

The platform that collects, normalizes and searches log data from many sources and runs correlation rules over it. Most alerts reach triage through it, and most Uncover queries run in it. It sees only its intake: a source never onboarded, or rolled off retention, is a gap, not a clean result.

Security Operations

The people, processes and technology that monitor, detect, investigate and respond to threats day to day, usually organized as a SOC. ASSURED covers the triage slice, from an alert firing to a documented close or escalation.

Security Operations Center (SOC)

The team, and often the room, that monitors an organization’s telemetry, triages alerts, and starts the response. Tiered SOCs split triage (Tier 1) from investigation and response (Tiers 2 and 3); smaller teams fold them together. ASSURED is written for the analyst making the close-or-escalate decision, whatever the tier is called.

Security Orchestration, Automation, and Response (SOAR)

Platforms that codify SOC workflows into playbooks: enrich an alert, query telemetry, look up an indicator, open a case, page on-call. SOAR makes the repetitive parts of triage repeatable.

Sender Policy Framework (SPF)

A DNS-published list of servers authorized to send mail for a domain, checked against the envelope sender (MAIL FROM / Return-Path) and the HELO name, not the visible From: header (RFC 7208). An SPF pass proves only that the envelope domain authorized the sending server; an attacker’s own lookalike domain passes easily. Spoofing of the visible From: is caught by DMARC alignment, not by SPF alone.

Sensitive Data

Information whose exposure would cause harm: regulated data (personal data, PHI, cardholder data), credentials and keys, intellectual property, confidential business records. Regulated data plausibly accessed by the activity sets Scope’s regulatory flags and is a Level 2 trigger; data merely in reach is a Scope flag.

Separation of Duties

Splitting sensitive tasks so no one person can complete them alone: one person requests a payment and another approves it, one analyst writes a pattern entry and another approves it. An action that bypassed the second person (a self-approved change, a single-person payment change) is a finding in itself.

Server

A host whose role is to provide services to other systems rather than to a person at a keyboard. The distinction drives triage: web browsing and office documents are routine on a workstation but anomalous on a server; an interactive server login warrants checking who made it, since only administrators should have a reason to; and a compromised server typically exposes data or downstream users at scale.

Server Message Block (SMB)

A network protocol for file shares, printer access, and remote administration, native to Windows but also implemented by Samba and NAS appliances, running on TCP port 445 (legacy port 139 over NetBIOS). A staple of lateral movement: administrative shares, PsExec-style remote execution, and exploits such as EternalBlue, used by the WannaCry worm, all travel over SMB.

Service Account

An account used by an application or service rather than a person, usually with a long-lived password or key and standing permissions. Its behavior is predictable by design, so an interactive logon, a new source host, or a new kind of action from a service account is a high-confidence anomaly. Service accounts with SPNs are the targets of Kerberoasting. See Non-Human Identity (NHI).

Service Principal

In Microsoft Entra ID, the tenant-local identity of an application. It signs in with a client secret, a certificate or a federated credential and holds delegated or application permissions; disabling it blocks the app’s sign-in. See Non-human identities and cloud roles.

Shadow AI

AI tools used for work without the organization’s approval or oversight: a personal chatbot account, an unvetted browser extension, a coding assistant on an unmanaged plan. In triage it shows up as uploads of case data or source code to AI services, and the question becomes what was pasted and under which retention terms. See AI-assisted triage.

Shadow Mode

Running an AI assistant on the live queue with its output recorded but hidden from the working analyst, so its verdicts can be compared with the settled ones without anchoring the person it is checked against. It comes before any write access. See Governing automated triage.

Shift Handover

The written record and the live conversation that transfer open cases, running clocks, pending callbacks and containment in effect at a shift change. Ownership moves at the receipt: until the incoming analyst fills it in, the outgoing analyst still owns every open case. See Shift handover.

Signature-Based Detection

One of the four detection families ASSURED teaches: matching activity against known-bad patterns such as hashes, byte sequences, YARA rules or network signatures. Precise and cheap, but blind to anything new or modified. See Signature-based detection.

Single Sign-On (SSO)

Authenticating once to an identity provider and reaching many applications without re-entering credentials. The triage consequence: one stolen IdP session or token opens every connected app, so scope an SSO compromise across the IdP’s app catalog, not one system.

SOC-CMM

The SOC Capability Maturity Model, a self-assessment of a security operations center across five domains (business, people, process, technology, services); version 2.4 appeared in late 2025. It asks whether a SOC has a defined triage process, not what that process should be. See the adoption maturity model.

Source Identity

In AWS, the sts:SourceIdentity value set when a role is assumed. CloudTrail carries it across every hop of a role chain, so it names the original human or workload. See Non-human identities and cloud roles.

Stage

In ASSURED, a group of phases. There are three: Orient (Alert, Subject, Scope), Investigate (Uncover, Risk) and Resolve (Escalation decision, Documentation). Stages organize the phases; they are not extra steps. Preparation, in the NIST and SANS sense, happens before triage starts and is not an ASSURED stage. Full entry: ASSURED terms.

Stakeholder-Specific Vulnerability Categorization (SSVC)

A decision tree, from Carnegie Mellon’s SEI and adopted by CISA, that prioritizes a vulnerability through questions such as whether it is being exploited, whether it is exposed, whether exploitation is automatable, and what it would yield. It ends in an action rather than a number (four in CISA’s version, from Track to Act).

Standard Contractual Clauses (SCC)

Contract terms approved by the European Commission that let personal data move from the EU/EEA to a country without an adequacy decision. They matter in triage when a case ships logs or evidence containing EU personal data to a team, vendor or tool in another country: the transfer needs a legal basis, so check with privacy first.

Structured Threat Information Expression (STIX)

OASIS’s JSON language for threat intelligence (STIX 2.1): indicators, attack patterns, threat actors and their relationships, usually exchanged over TAXII. Respect the sharing marking (TLP 2.0) on what you receive.

Subject

(1) In ASSURED, the second phase: identify every entity that authenticated or acted in the alert (people, service accounts, machines, cloud roles, workloads) and assess each across four dimensions: authentication, authorization, behavior, relationships. (2) In Windows Security events, the “Subject” block names the account that requested or reported the action (in a 4624 logon it is usually SYSTEM or the machine account), as distinct from the Target or New Logon account. Reading the wrong block is a common misattribution.

Sunk Cost

Continuing an investigation line, or resisting an escalation, because of the time already spent on it. It bites in Risk and the Escalation decision. Counter: decide on the evidence in hand now; time invested is not evidence.

Supply Chain

The network of organizations, people, activities, and resources involved in creating and delivering products, presenting multiple attack vectors for compromising systems or software during development and distribution.

Suppression

A deliberate rule that stops a detection from alerting on a defined pattern, host set, or time window: the pressure valve for known noise. Suppression trades visibility for signal, so every suppression carries a documented reason, an owner and an expiry, and gets revisited. One that clears a benign true positive is keyed narrowly (tool version, extension or plugin ID, destination set) with re-fire triggers, never on signer and install path alone, because a signed host such as an IDE runs third-party code. An unsuppressed noisy rule burns analysts; an unreviewed suppression hides an intrusion.

Suspicion

In ASSURED, an escalation criterion supported below High confidence. Suspicion refines Scope and re-runs the investigation loop; it does not fire the escalation tripwire, though the case can still escalate from a P1 or P2 cell by the E rule. Full entry: ASSURED terms.

Syslog

A standard protocol for message logging in network devices and systems (RFC 5424; legacy BSD format RFC 3164). Classic syslog over UDP 514 drops messages silently, can be spoofed, and RFC 3164 timestamps lack year and timezone, so normalize time before correlating.

System Binary

An executable that ships with the operating system or other trusted, usually signed, software: cmd.exe, powershell.exe, certutil.exe, rundll32.exe. Central to triage because living-off-the-land attacks abuse these trusted binaries, so the question is rarely whether the binary is legitimate but whether its parent, arguments, and timing are.

T

Tactics, Techniques, and Procedures (TTP)

The behavioral patterns of a threat actor, in increasing specificity: tactics (goals), techniques (methods), and procedures (concrete implementations). Used to characterize and attribute adversary behavior across campaigns. See the ATT&CK Tactic, Technique and Procedure entries.

TaHiTI

Targeted Hunting integrating Threat Intelligence, a threat hunting methodology published by the Dutch financial sector in 2018, in three phases: initiate, hunt and finalize. Like PEAK, it searches without an alert; triage starts from one. See Standards mapping.

Telemetry

The event streams that endpoints, network sensors, identity providers, SaaS apps and cloud control planes emit about what happened on them. Triage can only see what was collected: when telemetry is missing for a host or time window, record it as a gap (unknown is not Low), not as clean.

Threat

Any circumstance or event with the potential to harm the organization’s operations, assets, or people (NIST, from CNSSI 4009). The actor behind it is the threat actor; the weakness it uses is a vulnerability. Classical risk models multiply threat, vulnerability, and impact. ASSURED’s RATM does not multiply. It scores threat actor intent and exploitation & scope as their own dimensions and lets them inform likelihood, which never rises above what the evidence supports. Risk is then read from the impact-by-likelihood matrix.

Threat Actor

The person or group behind malicious activity: a criminal crew, a state-sponsored group, a hacktivist, an insider. Vendors name the same actor differently (see Threat Actor Naming Conventions). Triage rarely needs attribution to decide; it matters when it changes the likely next move or the reporting duties.

Threat Actor Naming Conventions

Vendors name the same actor differently, so two reports may describe one group. Microsoft uses weather families by origin or motive (Typhoon for China, Blizzard for Russia, Sandstorm for Iran, Sleet for North Korea, Tempest for financially motivated groups) and Storm-#### for clusters still in development. CrowdStrike uses animals by origin (Panda, Bear, Kitten, Chollima) and Spider for eCrime. Google Threat Intelligence Group (which absorbed Mandiant Intelligence) has used two-word cryptonyms since 2026 (APT29 is ICE RELIC, APT28 is LAKE RELIC), while the older Mandiant APT and FIN numbers and UNC cluster labels remain in ATT&CK and in past reporting. Check a published crosswalk or ATT&CK’s group aliases before treating two names as two actors.

Threat Hunting

Proactive analysis that starts from a hypothesis (“if an attacker were here, what would I expect to see?”) and searches telemetry for evidence. Distinct from alert triage, which reacts to detections; hunting goes looking for what the detections missed.

Threat Intelligence

Evidence-based knowledge about existing or emerging threats, including context, mechanisms, indicators, implications, and actionable advice (after Gartner’s widely cited definition). It is consumed at strategic, operational, and tactical levels. Before acting on it, weigh the source’s reliability, the information’s credibility (the Admiralty code is one common scheme), and its age.

Ticket

The case record that tracks an alert or incident through investigation: who owns it, what was found, what verdict was reached, and when it was closed. In a SOC the ticket is both the unit of work in the queue and the documentation trail that escalation, metrics, and future investigations depend on.

Time To Live (TTL)

In IP, a hop counter that each router decrements so stray packets are discarded instead of looping forever; in DNS, the number of seconds a resolver may cache a record before re-querying. The DNS sense usually matters most in triage: very short TTLs let attacker infrastructure rotate addresses quickly, as in fast-flux hosting, though CDNs and load balancers use short TTLs legitimately as well.

Timeline

The chronological record of a case: each row with a UTC timestamp, a source and a confidence label, mixing adversary actions with analyst actions. In ASSURED, Uncover builds one timeline per case and the handoff packet carries it. See Correlation and the timeline.

Tip-Off Check

In ASSURED, the question asked before any visible containment action: does this action tell the adversary what the SOC knows, and does that matter more than the harm in progress? When harm is not in progress, IR times visible actions. See The tip-off check.

Token

A piece of data a system accepts as proof of an authenticated session or a granted permission. Several senses: hardware or OTP token (an authentication factor); session cookie; OAuth access and refresh tokens; Entra Primary Refresh Token; Windows access token (the security context of a process). Triage-critical: a stolen session or refresh token replays without the password or MFA (AiTM phishing, infostealers), so containment means revoking sessions and refresh tokens, not only resetting the password.

Token Passthrough

An MCP server forwarding a client’s token to a downstream API. The MCP specification forbids it, partly because the downstream logs then record the wrong identity. See Non-human identities and cloud roles.

Traffic Light Protocol (TLP)

FIRST’s labels for how far shared information may travel. TLP 2.0 (2022) uses TLP:RED (named recipients only), TLP:AMBER (the recipient’s organization and its clients, on a need-to-know basis; TLP:AMBER+STRICT limits it to the organization), TLP:GREEN (the recipient’s community) and TLP:CLEAR (no limit). Respect the marking on what you receive, including in tickets and AI tools.

Transport Layer Security (TLS)

The protocol that encrypts most network traffic (TLS 1.3 current; 1.0 and 1.1 deprecated). Even without decryption, triage can still see the SNI hostname, certificate issuer and age, and the JA4 fingerprint. Encrypted Client Hello (ECH) is starting to hide SNI too.

Triage Matrix

In ASSURED, the three-by-three grid of impact by likelihood. Each cell gives a priority band and a recommended move; confidence is recorded beside the cell and does not move it. Three override rules can change the cell, and the record names the one that fired. See the priority matrix. Full entry: ASSURED terms.

True Negative

Benign activity that correctly produced no alert. The silent majority of everything a detection evaluates, and the reason a small false-positive rate still buries a queue once multiplied by volume. Completes the confusion matrix alongside true positive, false positive, and false negative.

True Positive

A detection-axis verdict: the alert fired on exactly the behavior its logic describes. On the activity axis it is then either malicious (the case the SOC exists to handle) or authorized, a benign true positive. In everyday SOC usage and many close codes, “true positive” alone means the malicious case, so say which one you mean. The counterpart of a false positive, where the logic matched something it should not have.

Trust Policy

In AWS, the resource-based policy on a role that names who may assume it and under which conditions. A role that trusts a whole account trusts every principal in it allowed to assume roles. See Non-human identities and cloud roles.

Trusted Automated Exchange of Intelligence Information (TAXII)

The OASIS protocol for exchanging STIX threat intelligence over HTTPS, through collections a client can poll or push to. STIX is the language; TAXII is the transport.

Tuning

Adjusting detection logic against observed results: tightening a threshold, adding an exclusion, enriching a rule with context so it stops firing on the environment’s normal. Tuning is the routine output of false positive closes (the false-positive-as-finding doctrine: every false positive is a defect report against the detection, not just a closed ticket) and the difference between an alert queue that improves and one that only grows. A benign true positive does not tune the rule; it earns a pattern entry or a scoped, expiring exception.

Tuning Request

In ASSURED, the single artifact triage sends detection engineering after a verdict: one rule per request, evidence cited by ID, the proposed change and its risk, and a benign and a malicious test sample. See The tuning request.

Two-Axis Verdict

In ASSURED, the rule that every verdict answers two questions. Detection axis: true positive, false positive (logic) or false positive (data). Activity axis: malicious, policy violation, authorized (benign true positive), benign-confirmed or undetermined. See Verdict. Full entry: ASSURED terms.

U

UK GDPR

The GDPR as retained in UK law, enforced by the Information Commissioner’s Office (ICO). Article 33 keeps the 72-hour notice to the authority after the controller becomes aware of a personal data breach. See Notification clocks.

Unauthorized Access

Access to a system, account or data without permission, whether by an outsider with stolen credentials or an insider exceeding their role. It sits at the core of most incident and breach definitions, so triage records exactly what was accessed and how that was established.

Undetermined

In ASSURED, the activity-axis verdict when the deciding evidence is missing. A legitimate verdict, not a benign close: score the gap (Medium likelihood at minimum, Low confidence), name the re-score trigger, and at the trigger apply the E rule. A close on it names the gaps and writes a reopen trigger. Full entry: ASSURED terms.

Unified Endpoint Management (UEM)

Managing laptops, desktops, phones and tablets from one console (Microsoft Intune, Jamf, Workspace ONE), the successor to MDM and EMM. Its inventory answers who owns a device, whether it is managed and compliant, and what is installed. A device absent from UEM is unmanaged until shown otherwise.

Unified Kill Chain

Paul Pols’ model (2017) that merges the Cyber Kill Chain with ATT&CK into 18 phases, grouped as In (initial foothold), Through (network propagation) and Out (action on objectives). It describes intrusions that cycle through phases rather than running them once.

Uniform Resource Locator (URL)

The address of a resource, made up of a scheme (such as http, https, or ftp), a host, and usually a path and query string. In triage the host carries reputation and lookalike-domain signals, while the path and query parameters often reveal the phishing kit, payload, or staging location.

Uninvestigated Share

Alerts closed with no disposition, bulk-closed or aged out, divided by alerts received. The share of the queue nobody looked at, which speed metrics hide. See Measuring triage.

Unknown Is Not Low

In ASSURED, the rule that evidence that could not be examined is not evidence of absence. When the deciding evidence is missing, likelihood reads Medium at minimum, confidence reads Low, and the gap is recorded as an open question. The same rule governs the eligibility gate, where an unknown item fails. See Impact and likelihood. Full entry: ASSURED terms.

User

The identity behind activity on a system: the account that authenticated, launched the process, or received the email. In triage the user field names an account, not necessarily a person; whether the legitimate owner was actually behind the activity is exactly the question stolen credentials raise.

User Account

The identity record a system authenticates and authorizes: a username with credentials, group memberships and attributes. One person usually holds several (workstation, cloud, admin, SaaS), and an account can be used by someone other than its owner. Subject analysis treats the account and the person as separate questions.

User and Entity Behavior Analytics (UEBA)

Security analytics that build behavioral baselines for users and entities (hosts, service accounts, applications) and score deviations from them: unusual logon times, first-seen hosts, data volumes far above normal. Its alerts are anomalies, not verdicts, and they are only as good as the baseline, which can absorb an attacker who has been present long enough (behavioral drift).

User-Reported Phishing

A message a recipient flagged through the report button or the help desk. Reports of one campaign are grouped into one case, verified tenant-wide by message trace and click logs rather than by the one copy reported, and closed with feedback to the reporter. Anyone who reached the credential step is credential-exposed. See User-reported phishing.

V

Variable Expansion

The shell’s replacement of a variable reference, such as %TEMP% or $HOME, with its actual value when a command runs. Attackers lean on expansion to obfuscate command lines, so the analyst has to evaluate what the command becomes after expansion, not the literal string that was logged.

Variable Substitution

Using variables in place of literal values in a script or command line, which attackers use to hide what a command really does. For the analyst it is the same problem as variable expansion: evaluate the command after expansion, not the literal string. See Variable Expansion.

Verdict

In ASSURED, the two-axis judgment recorded for every case. Detection axis, per member alert: true positive, false positive (logic) or false positive (data). Activity axis, once per case: malicious, policy violation, authorized (benign true positive), benign-confirmed or undetermined. “Merged into case” is a status, not a verdict. Platform crosswalk: Microsoft Sentinel’s True Positive, Benign Positive and False Positive, and Defender XDR’s True positive, Informational, expected activity, and False positive, correspond to a malicious true positive, a benign true positive and a false positive. See the five-field record. Full entry: ASSURED terms.

Verdict Agreement

The share of blindly re-triaged cases that reach the same activity verdict, priority band and decision as the original. Report it with Cohen’s kappa, which corrects for agreement by chance. See Inter-Rater Agreement and Measuring triage.

Virtual Desktop Infrastructure (VDI)

Desktop operating systems running as virtual machines on centralized infrastructure, accessed through remote display sessions rather than on the user’s own hardware. Triage is harder because pooled host names and shared egress IPs are recycled across users over time, and non-persistent desktops are wiped at logoff, destroying local forensic artifacts unless telemetry is centralized.

Virtual Private Network (VPN)

An encrypted tunnel from a user or site into a network. VPN logs map an internal address back to a user and session, and VPN appliances are a favorite initial-access target. Commercial and consumer VPN egress also makes geolocation and impossible-travel alerts unreliable.

Vulnerability

A defect in a system that can be turned into adversary capability if paired with an exploit and exposure: an unpatched CVE, a misconfiguration, a default credential, a logic flaw. Vulnerability without exposure or exploitability is latent; with both, it’s a finding.

Vulnerability Disclosure Program (VDP)

The published route by which outside researchers report security flaws, often advertised in a security.txt file (RFC 9116); a bug bounty adds payment. For triage, the report is an intake channel, and its question is not only whether the flaw is real but whether anyone else exploited it before the report. See Bug-bounty and disclosure reports.

Vulnerability Management

Systematic practice of identifying, classifying, prioritizing, remediating, and mitigating security vulnerabilities across an organization’s systems and software. Modern programs prioritize on known exploitation (CISA KEV), exploit likelihood (EPSS) and decision trees (SSVC), not CVSS alone.

W

Warm Handoff

A live, synchronous handoff on a call or bridge in which the receiver confirms ownership, as opposed to a ticket reassignment. In ASSURED every P1 escalation uses one, and triage still owns the case until the receiver fills in the handoff packet’s receipt. See Escalation protocols. Full entry: ASSURED terms.

Wildcard DNS

A DNS record (*.example.com) that answers for every subdomain without a record of its own. Attackers use it to serve unique per-victim or per-campaign subdomains from one domain and to make DNS tunneling cheap. Many unique subdomains of one domain resolving to the same address is a tell.

Windows Event Logs

Logs generated by Windows operating systems recording system, security, and application events. Triage staples: 4624/4625 (logon success/failure, with Logon Type), 4672 (special privileges), 4688 (process creation, if command-line auditing is enabled), 4720 (account created), 4769 (Kerberos service ticket), 7045 (service installed), 1102 (audit log cleared), 4104 (PowerShell script block). Sysmon adds richer process, network and image-load events.

Windows Management Instrumentation Command-line (WMIC)

A tool for managing Windows systems via scripting. Deprecated by Microsoft since Windows 10 21H1 (2021). Windows 11 shipped it as a Feature on Demand, preinstalled in early releases and disabled by default from 24H2 (Microsoft’s own pages differ on 23H2). The August and September 2026 updates then removed it outright, with no Feature on Demand, from Windows 11 24H2, 25H2 and 26H1. It persists on Windows 10, Windows Server, and older or unpatched Windows 11 builds, which is why it remains a favorite LOLBin in active intrusions; wmic.exe running on a fully patched current Windows 11 host is itself anomalous. The modern equivalent is PowerShell’s Get-CimInstance / Invoke-CimMethod against the same WMI namespaces.

Workload Identity Federation

An external workload (a CI job, a Kubernetes pod, another cloud) exchanges its own signed OIDC token for short-lived cloud credentials, accepted only if it matches the role’s trust conditions. No stored secret exists, so the trust conditions are what an attacker targets. See Non-human identities and cloud roles.

Write Once, Read Many (WORM) Storage

Storage that cannot be modified or deleted until a retention period ends: object lock, immutable backups, compliance archives. Logs and evidence kept on WORM storage survive an attacker who gains admin rights and tries to clear them, which is why ransomware operators target backups that are not immutable.

Z

Zero Data Retention (ZDR)

A vendor commitment, usually contractual, that prompts and outputs sent to an AI service are not stored once the response is returned, within limits the terms set (abuse monitoring, legal holds, excluded features). It decides whether case data may go to an AI assistant at all, so read the actual terms. See AI-assisted triage.

Zero-Day Vulnerability

A vulnerability for which no patch is yet available, either because the vendor has not shipped one or because the vendor does not yet know the bug exists. Called “zero-day” because that is the number of days defenders have had to prepare. Exploitation is not a definitional prerequisite; a zero-day can exist before any exploit appears. Usage varies: many sources, including NIST’s “zero-day attack”, use the term for a vulnerability already exploited before a fix exists; say “exploited zero-day” when you mean that. Once a patch exists but has not been applied, the bug is an n-day.

Sources

Definitions here are written for triage and checked against these reference glossaries. Where an entry states a dated, legal or vendor-specific fact (a regulation’s clock, a product’s behavior, a version-specific change), it links its primary source inline.

• NIST CSRC Glossary: the U.S. government’s consolidated security terminology, drawn from NIST publications such as SP 800-61r3.
• MITRE ATT&CK: tactic, technique and procedure names and IDs (Enterprise v19).
• RFC 4949, Internet Security Glossary, Version 2: the IETF’s long-standing security vocabulary.
• CISA NICCS Cybersecurity Glossary: CISA’s workforce and education glossary.