The SOC Analyst
Glossary

Access control is the process of deciding whether a subject is allowed to perform an action on a resource, and enforcing that decision.

An access directory is a centralized database or service that stores and manages information about users, devices, resources, and the permissions that govern who can access what within a network. It serves as the authoritative source for authentication and authorization decisions across an organization's IT environment.

An access log is a file that records every request made to a resource, one line per request, capturing who asked, what they asked for, when, and how the server responded.

Active Directory auditing is the practice of configuring, collecting, and analyzing the Windows security events that domain controllers and domain-joined hosts generate when accounts authenticate, objects change, and privileges are used.

AD FS is a Windows Server role that provides federated single sign-on, converting a successful Active Directory login into a signed SAML/WS-Fed/OAuth token that external applications trust.

Active Directory security is the set of controls, monitoring, and architecture choices that protect the AD directory service from credential theft, privilege escalation, and takeover of the accounts that govern a Windows domain.

Adaptive authentication evaluates the risk of each login in real time using signals like device, location, behavior, and threat intelligence, then allows, steps up, or denies access based on the score.

Advanced endpoint protection (AEP) is a modern endpoint security approach that combines prevention, detection, and response in one platform, using machine learning, behavioral analysis, and threat intelligence to stop threats that signature-based antivirus cannot.

In early 2020, a routine software update went out to customers of SolarWinds Orion. It was signed, it looked legitimate, and it carried a backdoor. Up to 18,000 organizations installed it.

Adversarial AI and machine learning is the practice of attacking ML systems by manipulating their inputs, training data, or interfaces so the model behaves the way the attacker wants instead of as designed.

Adware is software that displays, injects, or redirects to unwanted advertisements and tracks browsing to target them for revenue, usually arriving bundled with free software.

Agentic AI is a class of AI system that pursues a goal by planning steps, calling tools to act on each step, observing the result, and adjusting, all with limited human direction.

AI and cloud security is the intersection of using AI to detect and respond to threats across cloud environments and securing the AI systems, models, and data that now run in those environments.

AI anomaly detection is the use of machine learning to learn a baseline of normal behavior, then flag activity that deviates far enough from that baseline for a human to investigate.

AI detection and response (AIDR) is a security capability that monitors, detects threats against, and responds to risks in an organization's use of AI: its models, prompts, autonomous agents, and data pipelines.

AI-native cybersecurity is a security platform architected so that AI and machine learning sit at the center of how it ingests data, detects threats, triages alerts, and drives response from the design stage, rather than added to a rules-based product after the fact.

AI-native XDR is extended detection and response built so that machine learning sits at the center of detection, correlation, and response from the design stage, rather than added to an existing rules engine later.

An AI PC is a personal computer with a dedicated neural processing unit (NPU) alongside the CPU and GPU, built to run AI models locally instead of sending the work to a cloud service.

AI-powered behavioral analysis uses machine learning to build a baseline of normal behavior for a user, host, process, or network segment, then flags the activity that deviates from that baseline.

AI SIEM is a SIEM that applies machine learning and generative AI across its detection, triage, and response stages instead of relying on static correlation rules and manual analyst review alone.

AI social engineering is the use of generative AI, voice cloning, and deepfake video to make manipulation attacks more convincing, personalized, and scalable than a human operator could manage alone.

Amazon Web Services is a comprehensive cloud computing platform provided by Amazon that delivers on-demand IT resources over the internet. Instead of owning physical servers or data centers, businesses can rent computing power, storage, and other services on a pay-as-you-go basis.

API security is the practice of protecting application programming interfaces from attacks that abuse their endpoints, authentication, or business logic to steal data or perform unauthorized actions.

API security testing is the practice of evaluating an application programming interface to find vulnerabilities an attacker could exploit, focusing on the authentication, authorization, input handling, and exposed business logic of each endpoint.

An application log is the record a piece of software writes about its own runtime behavior, including the requests it served, the errors it hit, and the decisions its code made.

Application monitoring is the practice of instrumenting a running application to track its availability, performance, errors, and behavior using metrics, logs, and traces.

Application resiliency is an application's ability to keep functioning, or to recover within a defined window, when a failure or attack disrupts it.

Application risk scoring combines vulnerability severity, exploitability, exposure, and business impact into a single prioritized score that ranks what to fix first.

Application security is the practice of protecting software from threats throughout its lifecycle by finding and remediating vulnerabilities in code, dependencies, configuration, and runtime behavior.

Application security best practices are the lifecycle-wide set of practices, from threat modeling and secure coding to dependency hygiene, least privilege, and patching, that find and fix software flaws before attackers exploit them.

Application security orchestration and correlation (ASOC) is a tool category that orchestrates a program's AppSec scanners and correlates their findings into a single deduplicated, prioritized result set.

Application security posture management (ASPM) aggregates and correlates findings from an organization's application security tools, deduplicates and prioritizes them by risk, and tracks application security posture continuously across the software development lifecycle.

ASPM use cases are the concrete jobs teams point Application Security Posture Management at: consolidating and prioritizing findings, application inventory, compliance evidence, policy gates, acquisition risk, and program metrics.

Application security testing is the practice of evaluating software to find vulnerabilities an attacker could exploit, by analyzing its source code, dependencies, configuration, and runtime behavior across the development lifecycle.

Application vulnerability scanning is the automated process of inspecting an application, its source, running endpoints, dependencies, and images, for known security flaws and producing a ranked list of findings.

Application whitelisting is a security control that allows only explicitly approved applications, scripts, and executables to run on a system and blocks everything else by default.

ARP spoofing is a layer 2 attack that sends forged ARP replies to map an attacker's MAC address to another host's IP, rerouting that host's traffic through the attacker.

ASOC orchestrates and correlates application security scanner findings, while ASPM manages an application's security posture across the entire software development life cycle, with ASOC as one capability inside it.

ASPM best practices are the operating discipline that makes application security posture management reduce risk: consolidate scanner output, dedupe and correlate, prioritize by exploitability, integrate into CI/CD and ticketing, set SLAs and gates, assign ownership, and measure posture.

An attack surface is the set of all points where an attacker can try to enter a system, affect it, or extract data from it.

Attack surface management is the continuous discovery, inventory, classification, and prioritization of every asset that exposes an organization to attack, run from the attacker's perspective.

Attack surface reduction is the practice of minimizing the number of points where an attacker can attempt to enter or extract data from a system.

An attack vector is the method or path an adversary uses to gain unauthorized access to a system, network, or account.

Attribute-based access control is an access control model that grants or denies a request by evaluating attributes of the subject, resource, action, and environment against a policy at request time.

An audit log is a chronological record of the security-relevant actions performed on a system, capturing who took the action, what they did, when, and where.

Automated intelligence is the use of software to run the repeatable parts of the cyber threat intelligence lifecycle (collection, processing, enrichment, correlation, scoring, dissemination) without a human in the loop.

AWS cloud security is the set of controls a customer configures to protect the workloads, data, and identities they run in Amazon Web Services, and best practices are the subset that reduce the most risk for the least effort.

AWS CloudTrail records the API activity in an AWS account (who did what), while Amazon CloudWatch monitors how resources and applications behave in real time.

AWS infrastructure observability is the practice of collecting and analyzing the telemetry AWS emits, the API calls, network flows, configuration state, and metrics, so security teams can detect threats and reconstruct incidents.

An AWS migration is the process of moving applications, data, and infrastructure from an on-premises data center or another cloud into Amazon Web Services.