Skip to main content

Terms and definitions from Course 6, course 6 glossary

 

A

Advanced persistent threat (APT): An instance when a threat actor maintains unauthorized access to a system for an extended period of time 

Analysis: The investigation and validation of alerts 

Anomaly-based analysis: A detection method that identifies abnormal behavior 

Array: A data type that stores data in a comma-separated ordered list

B

Broken chain of custody: Inconsistencies in the collection and logging of evidence in the chain of custody

Business continuity plan (BCP): A document that outlines the procedures to sustain business operations during and after a significant disruption

C

Chain of custody: The process of documenting evidence possession and control during an incident lifecycle

Command and control (C2): The techniques used by malicious actors to maintain communications with compromised systems

Command-line interface (CLI): A text-based user interface that uses commands to interact with the computer

Common Event Format (CEF): A log format that uses key-value pairs to structure data and identify fields and their corresponding values 

Computer security incident response teams (CSIRT): A specialized group of security professionals that are trained in incident management and response 

Configuration file: A file used to configure the settings of an application

Containment: The act of limiting and preventing additional damage caused by an incident

Crowdsourcing: The practice of gathering information using public collaboration

D

Data exfiltration: Unauthorized transmission of data from a system

Data packet: A basic unit of information that travels from one device to another within a network

Detection: The prompt discovery of security events

Documentation: Any form of recorded content that is used for a specific purpose 

E

Endpoint: Any device connected on a network

Endpoint detection and response (EDR): An application that monitors an endpoint for malicious activity

Eradication: The complete removal of the incident elements from all affected systems

Event: An observable occurrence on a network, system, or device

F

False negative: A state where the presence of a threat is not detected 


False positive: An alert that incorrectly detects the presence of a threat

Final report: Documentation that provides a comprehensive review of an incident

Honeypot: A system or resource created as a decoy vulnerable to attacks with the purpose of attracting potential intruders

Host-based intrusion detection system (HIDS): An application that monitors the activity of the host on which it’s installed

I

Incident: An occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies

Incident handler’s journal: A form of documentation used in incident response

Incident response plan: A document that outlines the procedures to take in each step of incident response

Indicators of attack (IoA): The series of observed events that indicate a real-time incident

Indicators of compromise (IoC): Observable evidence that suggests signs of a potential security incident 

Internet Protocol (IP): A set of standards used for routing and addressing data packets as they travel between devices on a network

Intrusion detection system (IDS): An application that monitors system activity and alerts on possible intrusions

Intrusion prevention system (IPS): An application that monitors system activity for intrusive activity and takes action to stop the activity

K

Key-value pair: A set of data that represents two linked items: a key, and its corresponding value

L

Lessons learned meeting: A meeting that includes all involved parties after a major incident

Log analysis: The process of examining logs to identify events of interest 

Log management: The process of collecting, storing, analyzing, and disposing of log data

Logging: The recording of events occurring on computer systems and networks

M

Media Access Control (MAC) Address: A unique alphanumeric identifier that is assigned to each physical device on a network

N

National Institute of Standards and Technology (NIST) Incident Response Lifecycle: A framework for incident response consisting of four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-incident activity

Network-based intrusion detection system (NIDS): An application that collects and monitors network traffic and network data

Network data: The data that’s transmitted between devices on a network 

Network Interface Card (NIC): Hardware that connects computers to a network

Network protocol analyzer (packet sniffer): A tool designed to capture and analyze data traffic within a network

Network traffic: The amount of data that moves across a network 

O

Object: A data type that stores data in a comma-separated list of key-value pairs

Open-source intelligence (OSINT): The collection and analysis of information from publicly available sources to generate usable intelligence

P

Packet capture (p-cap): A file containing data packets intercepted from an interface or network

Packet sniffing: The practice of capturing and inspecting data packets across a network

Playbook: A manual that provides details about any operational action

Post-incident activity: The process of reviewing an incident to identify areas for improvement during incident handling

R

Recovery: The process of returning affected systems back to normal operations

Resilience: The ability to prepare for, respond to, and recover from disruptions

Root user (or superuser): A user with elevated privileges to modify the system

S

Search Processing Language (SPL): Splunk’s query language

Security information and event management (SIEM): An application that collects and analyzes log data to monitor critical activities in an organization 

Security operations center (SOC): An organizational unit dedicated to monitoring networks, systems, and devices for security threats or attacks

Security orchestration, automation, and response (SOAR): A collection of applications, tools, and workflows that uses automation to respond to security events

Signature: A pattern that is associated with malicious activity

Signature analysis: A detection method used to find events interest

Standards: References that inform how to set policies

Sudo: A command that temporarily grants elevated permissions to specific users

Suricata: An open-source intrusion detection system and intrusion prevention system

T

tcpdump: A command-line network protocol analyzer

Telemetry: The collection and transmission of data for analysis

Threat hunting: The proactive search for threats on a network

Threat intelligence: Evidence-based threat information that provides context about existing or emerging threats

Triage: The prioritizing of incidents according to their level of importance or urgency

True negative: A state where there is no detection of malicious activity

True positive An alert that correctly detects the presence of an attack

V

VirusTotal: A service that allows anyone to analyze suspicious files, domains, URLs, and IP addresses for malicious content

W

Wildcard: A special character that can be substituted with any other character

Wireshark: An open-source network protocol analyzer

Y

YARA-L: A computer language used to create rules for searching through ingested log data

Zero-day: An exploit that was previously unknown