The SOC Analyst
Glossary

The responder's first decision is whether to pull the plug. A host is compromised, the malware is running, and the instinct is to power it off to stop the spread. Do that and you destroy the case.

Digital risk protection (DRP) is the practice of monitoring and mitigating threats to an organization's digital assets across the open web, social media, the deep web, and the dark web.

A disinformation campaign is a coordinated, deliberate effort to spread false or misleading information to manipulate a target audience's beliefs or behavior.

A distributed denial-of-service (DDoS) attack is an attempt to make a service unavailable by overwhelming it with traffic sent from thousands of compromised machines, usually a botnet, at the same time.

DLP best practices are the practical steps, classify data, write channel-specific policy, tune rules, and cover network, endpoint, and cloud, that make a data loss prevention program actually stop exfiltration.

Domain spoofing is a social engineering technique in which an attacker impersonates a known business or person using a fake email or website domain, so the target trusts a message or site the attacker controls.

DORA SaaS security is how the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554) treats cloud and SaaS applications as ICT third-party risk that the financial entity stays fully responsible for.

A downgrade attack forces a system to fall back to an older, weaker mode it still supports for backward compatibility, then exploits the weakness of that mode.

Dynamic application security testing is a method that evaluates a running application's security from the outside, without access to its source code, by sending crafted requests through its exposed interfaces and analyzing the responses.

EDR and XDR are detection-and-response tools that differ by scope (endpoints versus the whole security stack), while MDR is the same detection and response delivered as a provider-operated managed service, usually running on EDR or XDR underneath.

NGAV is a prevention engine that blocks or allows code at execution, while EDR continuously records endpoint activity to detect, investigate, and contain the threats that prevention misses.

Email security is the practice of protecting email accounts and communications from unauthorized access, data loss, and compromise. It encompasses the policies, tools, and technologies organizations use to defend against malicious threats delivered through email, including phishing, malware, spam, and business email compromise (BEC).

Email spoofing is a technique in which an attacker forges the sender address of an email so the message appears to come from a source the recipient trusts.

An employee cybersecurity awareness training program is a structured, recurring effort to teach the workforce how to recognize and respond to security threats, and to measure whether their behavior actually changes.

Endpoint DLP is software that runs as an agent on a device to discover sensitive data, monitor what users do with it, and stop unauthorized copying, printing, or transfer before it leaves.

Endpoint detection and response (EDR) is a security technology that continuously records activity on endpoints; laptops, servers, and workstations and analyzes it for signs of malicious behavior, and gives analysts the tools to investigate and respond.

What Is Endpoint Management? Endpoint management involves tools, policies, and procedures used by IT and security teams to authenticate, monitor, and manage access to an organization’s devices, whether on-premises or cloud-based. It includes managing security, deploying software, and ensuring compliance across devices like laptops, desktops, and mobile phones.

Endpoint monitoring is the continuous collection and analysis of activity on the devices that connect to a network (computers, mobile devices, and servers) to detect and respond to threats at the point where they execute.

An endpoint protection platform (EPP) is an integrated security solution deployed on endpoints that combines multiple protection technologies (NGAV, EDR, behavioral analysis, threat intelligence, and data and device controls) into a single agent and management console.

Endpoint protection software is the agent-and-console software that secures end-user and server devices by inspecting files, processes, and system activity on each device and feeding that telemetry to a central management console where a security team can monitor, investigate, and respond across the whole fleet.

An endpoint is any device that connects to a network and serves as a point where data enters or leaves it, such as a laptop, server, phone, virtual machine, or internet-connected device.

Endpoint security is the cybersecurity discipline of protecting endpoints (laptops, servers, phones, virtual machines, and IoT) from malicious activity, by preventing what it can, detecting what gets through, and giving defenders the visibility to respond on the device itself.

An enterprise browser is a web browser built for organizational use, with enhanced security, centralized management, and activity visibility integrated into the browser itself.

Microsoft Entra ID is the cloud identity and access management service (formerly Azure Active Directory) that authenticates users and enforces access across cloud apps.

An EPP is the integrated platform on the endpoint that prevents threats, while EDR is one engine inside it that records activity to detect, investigate, and contain what prevention missed.

An error log is a file that records the error conditions software encounters while running, one entry per event, capturing what failed, when, how severe it was, and the context around it.

An ethical hacker is a security professional who, with explicit written authorization, uses an attacker's tools and techniques to find and report weaknesses before a real attacker exploits them.

An event log is a chronological record of events a system generates as it runs, one entry per event, capturing when something happened, its source, severity, an identifier, and a description.

Image container exploitation is the abuse of misconfigured container images and runtimes (root, privileged flags, host mounts, exposed APIs) to run attacker code, escape to the host, and move through the environment.

An exploit kit is automated attack software, hosted on a web server, that profiles a visitor's browser and silently runs an exploit for whatever known vulnerability it finds, then delivers a malware payload.

Vulnerability management finds and remediates known software flaws (CVEs) ranked by severity, while exposure management reduces the whole attack surface and prioritizes by what an attacker can actually reach, with vulnerability management as one input into it.

Extended detection and response (XDR) is a security platform that collects and correlates telemetry from multiple security layers (endpoint, network, cloud, email, and identity) to detect, investigate, and respond to threats across all of them from a single place.

The Extended Internet of Things (XIoT) is an umbrella term for all physical, network-connected devices across an environment, spanning consumer and enterprise IoT, operational technology, industrial control systems, and connected medical devices.

External attack surface management (EASM) is the continuous discovery, inventory, monitoring, and prioritization of an organization's internet-facing assets, performed from the outside in, the way an external attacker sees them.

An external authentication method (EAM) is a Microsoft Entra ID feature that lets a third-party provider satisfy the multi-factor requirement during sign-in, integrated as an authentication method over OpenID Connect while Entra keeps policy evaluation and the access decision.

File integrity monitoring is a security process that watches critical files, directories, and system settings for unauthorized change by comparing their current state against a trusted, cryptographically hashed baseline.

Fileless malware is a class of attack that achieves its goals while writing little or nothing to disk, executing in memory and operating through tools and features already present on the system.

A firewall is a network security control that monitors and filters traffic between networks, typically between a trusted internal network and an untrusted external one, like the internet, and enforces a defined set of rules to allow or block data from passing through.

Firewall as a Service (FWaaS) is a firewall delivered from the cloud as a managed service, applying the same rule-based traffic inspection a traditional firewall does but with one policy that follows every user, branch, and cloud.

Fog ransomware is a ransomware variant first observed in May 2024 that breaks in through compromised VPN credentials, encrypts files with the .FOG or .FLOCKED extension, and steals data for double extortion.

Free antivirus is a reactive, signature-based scanner for known threats on one personal device, while paid antivirus adds proactive detection of unknown threats, human support, central management, and business licensing.

Frontier AI is the most capable class of general-purpose AI models available at any given time, trained at the largest scales of compute, with broad capabilities spanning reasoning, multimodal understanding, code generation, and autonomous tool use.

The General Data Protection Regulation (GDPR) is the world's most comprehensive data privacy and security law. Drafted and enacted by the European Union, it entered into force in 2016 and became fully enforceable on May 25, 2018. The regulation establishes strict requirements for how organizations collect, store, process, and protect the personal data of individuals in the EU, and its reach extends well beyond Europe's borders.

Generative AI is a class of machine learning that produces new content (text, images, audio, video, or code) by learning patterns in existing data and sampling from them.

A golden ticket attack is a post-exploitation technique in which an attacker forges Kerberos ticket-granting tickets using the stolen krbtgt account hash, granting near-unrestricted, durable access across an Active Directory domain.

Google Cloud migration is the process of moving applications, data, and workloads from on-premises infrastructure (or another cloud) into Google Cloud.

Hacktivism is the use of hacking techniques to promote a political, social, or ideological cause, where the goal of the attack is a message rather than money or espionage.

Hashing is the process of running data of any size through a one-way function to produce a fixed-length value (a hash or digest) that acts as a unique, irreversible fingerprint used to verify integrity and identity.

Healthcare cybersecurity is the protection of healthcare systems, patient data, and connected medical devices from cyberattacks, under strict regulation and direct patient-safety stakes.

The HIPAA Security Rule is the U.S. federal standard requiring covered entities and business associates to protect the confidentiality, integrity, and availability of electronic protected health information.