The SOC Analyst
Glossary

IT asset management is the practice of tracking, managing, and optimizing an organization's IT assets across their full lifecycle, from procurement through deployment, maintenance, and decommissioning.

IT automation is the use of software to complete repetitive, rule-based IT tasks without a person carrying out each step, from provisioning and patching to credential rotation and security response.

Just-in-time (JIT) access is an on-demand approach to access control that grants an identity permission to a system only when it is needed for a specific task, and only for the minimum time required, revoking it automatically afterward.

Kerberoasting is an Active Directory attack that abuses normal Kerberos ticket requests to steal service account password hashes and crack them offline, requiring only a single low-privilege domain account.

A keylogger is software or hardware that records the keys a user presses and sends that record to an attacker to steal credentials and other typed data.

Kubernetes-as-a-Service is a managed cloud offering that provisions, operates, and maintains the Kubernetes control plane for you, so you deploy and run containerized workloads on a cluster without building or administering the orchestration layer yourself.

NIST SP 800-190 is descriptive risk guidance for container technology, while the CIS Kubernetes Benchmark is a prescriptive, scored hardening checklist for Kubernetes; teams use them together, NIST to scope and CIS to execute.

Kubernetes security is the practice of protecting a Kubernetes cluster and its cloud-native workloads across build, deployment, and runtime, spanning the control plane, nodes, pods, images, identity, and network.

Kubernetes security best practices are the controls a team applies across the control plane, workloads, network, secrets, and runtime to protect a cluster at every layer an attacker can move through.

Docker is a platform for building and running containers on a single host, while Kubernetes is a container orchestration platform that schedules, scales, and heals containers across a cluster; teams use them together, Docker to build and run and Kubernetes to orchestrate at scale.

Kubernetes is a container-native orchestration system that is now the industry standard, while Apache Mesos is a general-purpose cluster manager that was retired to the Apache Attic in 2025.

A Kubernetes admission controller is code in the API server that intercepts requests after authentication and authorization but before persistence, to mutate or validate the object, making it the layer where most cluster security policy is enforced.

Lateral movement is the set of techniques an attacker uses to progressively move through a network after gaining initial access, going from host to host to reach higher privileges and more valuable systems.

A living off the land attack is an intrusion in which the attacker uses native, legitimate tools already installed on the victim's system (LOLBins) to carry out the attack, instead of deploying their own malware.

The Log4j vulnerability (CVE-2021-44228, Log4Shell) is a critical remote code execution flaw in Apache Log4j 2 that runs attacker code from a string in a log message.

Log aggregation is the mechanism for capturing, normalizing, and consolidating logs from many sources into one centralized platform so the data can be correlated and analyzed.

Log analysis is the process of collecting, parsing, and examining log data (the timestamped records that systems, applications, and devices generate) to understand behavior, troubleshoot problems, and detect security threats.

A log file format is the convention that defines how a system writes each event: which fields appear, in what order, what separates them, and how they are encoded.

A log file is a record of events that a system, application, or device writes as those events occur, one entry per event, each stamped with the time it happened.

Logging as a Service (LaaS) is a cloud-hosted platform that collects, parses, stores, searches, and alerts on logs from across your infrastructure and applications, delivered as a managed subscription rather than software you run yourself.

Logging best practices are the standards that make logs useful for security: capturing high-value events including failures, structuring them consistently, retaining them long enough, securing them against tampering, and centralizing them into a SIEM for correlation.

Logging levels are severity labels attached to log events that rank them from the most verbose (TRACE) to the most severe (FATAL), so a configured threshold can write the important events and drop the rest.

Logging is the practice of recording timestamped events as a durable, detailed historical record, while monitoring is the continuous real-time watch on system metrics and state that alerts when a condition degrades.

Log management is the practice of collecting log data from across an environment, moving it to a central store, parsing it into a consistent format, retaining it, and making it searchable.

Log parsing is the process of breaking raw log data into structured fields and mapping it to a common format so a log management system or SIEM can read, index, and store it.

Log retention is the policy and mechanism that determines how long log data is kept, on what storage, and when it is deleted.

Log rotation is the process of controlling log file size by periodically closing the active log, opening a new one under the same name, and compressing, archiving, or deleting the old copies on a schedule.

Log streaming is the continuous, real-time transfer and analysis of log data from multiple sources into a central system, so events are available for detection the moment they occur.

A low-code application platform (LCAP) is software that lets people build working applications mostly by assembling visual components, with an escape hatch for custom code, instead of writing software by hand.

Machine identity management (MIM) is the practice of securing and managing the digital credentials (certificates, keys, and tokens) that machines use to authenticate to each other across their full lifecycle.

Machine learning and AI in identity security learn each account's normal behavior and score new logins, sessions, and access requests against that baseline, flagging credential abuse and account takeover that valid-credential checks miss.

Machine learning is a subset of artificial intelligence in which a system learns patterns from data to detect threats (malware, anomalies, malicious behavior) instead of following hand-written rules.

MLSecOps (Machine Learning Security Operations) is the discipline of building security into every stage of the machine learning lifecycle, from data collection and training through deployment and production monitoring.

Malicious code is any program or script written to act against the owner of the system it runs on, by damaging data, disrupting operations, stealing information, or opening unauthorized access.

Malvertising is the use of online advertisements to distribute malware, injecting malicious code into ads that legitimate ad networks then serve across trusted, high-traffic websites.

Malware is code created to act against the interests of the system's owner, running without consent to serve someone else's goal.

A flagged executable lands in the analyst's queue: invoice_8842.exe, pulled off a finance workstation after the EDR raised a low-confidence alert. She does not run it. First she hashes it and checks the hash against VirusTotal: 3 of 72 engines flag it, all with generic names.

Malware detection is the process of identifying malicious software on an endpoint, in a file, or in network traffic before or during execution, using either known-bad matching or behavioral analysis.

Malware hosting is the practice of storing and delivering malicious files from a legitimate, trusted hosting service such as a code repository, file-sharing app, or content delivery network, instead of from attacker-owned infrastructure.

Malspam, short for malware spam, is unsolicited bulk email sent to deliver malware through a malicious attachment or a link to a site that drops it.

Malware is the umbrella term for all malicious software, while a virus is one specific type of malware that attaches to a host file and replicates when a user runs that file; every virus is malware, but most malware is not a virus.

Managed cloud security is a service model where a third-party provider operates an organization's cloud monitoring, threat detection, and incident response around the clock, combining a technology stack with human analysts and a defined response process.

Managed cloud security is a service model where a third-party provider operates an organization's cloud monitoring, threat detection, and incident response around the clock, combining a technology stack with human analysts and a defined response process.

Managed detection and response (MDR) is a cybersecurity service that combines detection technology with human analysts to monitor, hunt, investigate, and respond to threats on a customer's behalf around the clock.

A managed security service provider (MSSP) is an external company that operates cybersecurity functions, such as 24/7 monitoring, detection, and response, for its customers as an ongoing service.

Managed security services (MSS) is an umbrella term for any cybersecurity function delivered by a third-party provider instead of being run in-house, from a single managed control to a full security operations center.

A managed service provider (MSP) is a company that manages a customer's IT infrastructure and end-user systems under a recurring contract, usually billed per user or per device each month.

Managed SIEM is a service in which an external provider operates and monitors a SIEM platform on your behalf (ingesting logs, tuning detections, watching alerts 24/7, and escalating real incidents), while you keep the risk and the response.

Managed XDR (MXDR) is a security service that delivers extended detection and response as an outsourced, provider-operated capability, combining an XDR platform with analysts who run it around the clock.

A man-in-the-middle (MITM) attack is a cyberattack in which an attacker covertly intercepts communication between two parties and relays it so both sides believe they have a direct, private connection.