Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.

Security Operations – Cybersecurity Glossary

Security operations detect, investigate, and respond to threats in real time. This category defines SIEM, SOAR, EDR, XDR, MDR, threat hunting, detection engineering, security monitoring, indicators of compromise, and the metrics and tooling that run a modern SOC. Explore the terms below to understand how defenders find and stop attacks.

325 Security Operations terms · All categories →

A

Advanced Threat Protection

Adversary Emulation

Alert Fatigue

AMP for Endpoints

Anomaly Detection

Anomaly-Based Detection

Ansible

Ansible Playbook

Application Monitoring

Atomic Red Team

Atomic Test

Attack Surface Management

Audit Logging

Audit Trail

Automation Workflow

B

Baselining

Behavior-Based Detection

Behavioral Analytics

Behavioral Threat Intelligence

Blue Team

BlueRed Team Integration

Botnet Detection

Breach and Attack Simulation (BAS)

Breach Detection System

C

CC

CCOA

Change Detection

Cisco Certified Cybersecurity Associate

Cisco Secure Endpoint

Cisco SecureX

Cisco ThousandEyes

CND

CompTIA Security+

CompTIA Security+

Continuous Security Validation

Correlation Policy

Covert Security Testing

Cyber Deception Technology

Cyber Range

Cyber Threat Hunting

Cyber Threat Intelligence (CTI)

Cyber Threat Intelligence CTI Lifecycle

CySA+

D

Dark Web Intelligence

Detection as Code

Detection Engineering

Detection Engineering Maturity

Device Trajectory

Diamond Model of Intrusion Analysis

Digital Risk Protection

Dwell Time

Dynamic Malware Analysis

E

Endpoint Detection And Response (EDR)

Endpoint Detection and Response EDR Implementation

Endpoint Protection Platform (EPP)

Endpoint Security

Endpoint Security Control

Event Correlation

Extended Detection and Response (XDR)

External Attack Surface Management (EASM)

External Syslog Server

F

False Negative

False Positive

File Trajectory

Fleet Management

Full Packet Capture

G

Gold Image

H

Heatmap

Heuristic Detection

High-Fidelity Alert

Honeypot

Honeypots Honeynets

Honeytoken

Host-Based Intrusion Detection

Hypothesis-Driven Threat Hunting

I

IDS

Immutable Logs

Impact Flag

Indicator Enrichment

Indicator of Attack

Indicator of Compromise

Indicators of Attack

Indicators of Attack IoA

Indicators of Compromise

Indicators of Compromise IoC

Infrastructure Monitoring

Insider Activity Monitoring

Insider Risk Management

Insider Threat Analytics

Insider Threat Management

Insider Threat Playbook

Integrity Monitoring Tool

Internal Threat Simulation

Internet Protocol IPv6

Intrusion Detection

Intrusion Detection System (IDS)

IOC Indicator of Compromise

IP Blacklist Monitoring

IP Reputation

IP Reputation Analysis

K

Key Performance Indicator

L

Lifecycle

Log Aggregation

Log Anomaly Detection

Log Buffer

Log File Integrity

Log Management

Log Management System

Log Parsing

Log Retention

Log Source Normalization

Log Tamper Detection

Logging

Logging and Auditing

Logging and Monitoring

Logging Facility

Logging Levels

Logging Monitor

Low and Slow Attack Detection

M

Managed Detection and Response

Managed Detection and Response (MDR)

Managed Security Service Provider

Mean Time to Acknowledge (MTTA)

Mean Time to Detect

Mean Time to Detect (MTTD)

Mean Time to Repair (MTTR)

Mean Time to Respond

Mean Time to Respond (MTTR)

Metrics and (KPIs)

MITRE Caldera

Monitoring

Monitoring Dashboard

Monitoring Rules

Monitoring Strategy

Multi-Platform Threat Intelligence

N

Network Behavior Analysis

Network Detection and Response

Network Traffic Analysis (NTA)

Next-Gen Endpoint Protection

Next-Generation Antivirus

Non-Persistence

O

Orchestration Tool

Outlier Behavior Detection

Overt Security Testing

P

Passive DNS Monitoring

Passive Threat Detection

Patch Distribution

Patch Prioritization

Patch Validation Process

Patch Verification

Performance Monitoring

Playbook Automation

Policy Violation Alerting

Posture Assessment

PowerShell Security

Pre-Attack Indicator

Predictive Risk Intelligence

Priority

Priority Level

Privileged Activity Alerting

Proactive Threat Hunting

Process Hollowing Detection

Process Monitoring

Protective Monitoring

Public Threat Feed

Purple Team

Purple Team Automation

Purple Teaming

Pyramid of Pain

R

Reactive Security

Real User Monitoring (RUM)

Real-Time Alerting

Real-Time Monitoring

Red Team

Red Team Report

Remote Logging

Remote User Monitoring

Reputation-Based Detection

Reputation-Based Filtering

Response Playbook Automation

Retrospective Detection

Root Account Monitoring

Rule SID

Runbook Automation

Runtime Threat Analytics

Runtime Threat Detection

S

Scenario-Based Testing

Secure Endpoint

Secure Log Transport

Security Audit Trail

Security Chaos Engineering

Security Control Validation

Security Data Lake

Security Event

Security Incident and Event Management

Security Indicator

Security Information And Event Management (SIEM)

Security Intelligence

Security Intelligence Feed

Security Knowledge Graph

Security Logging Architecture

Security Logging Strategy

Security Monitoring Strategy

Security Monitoring Tool

Security Operations Center (SOC)

Security Orchestration

Security Orchestration Automation and Response

Security Orchestration Automation and Response (SOAR)

Security Telemetry

Security Telemetry Stream

Security Update Management

Security Validation

SIEM

SIEM Alert Triage

SIEM Correlation Rule

SIEM Correlation Rules

SIEM Deployment

SIEM Integration

SIEM Rule Optimization

SIEM Security Information and Event Management

SIEM Use Case

Sigma Rule

Sigma Rules

Signature Collision Detection

Signature Detection

Signature Management

Signature-Based Detection

Single Pane of Glass

Site Reliability Engineering

Situational Awareness

Snort Rules

SOAR Playbooks

SOC Tiers

Software Patch Automation

Software Patch Validation

SSCP

Static Malware Analysis

STIX TAXII

Stolen Credential Monitoring

Strategic Threat Intelligence

Structured Threat Analysis

Suricata

Suspicious Domain Detection

Suspicious Login Pattern

Symantec Endpoint Protection

Synthetic Performance Monitoring

Synthetic Threat Generation

Syslog

Syslog Server

System Anomaly Detection

System Integrity Check

System Log Audit

System Log Integrity

System Service Validation

T

Tactical Threat Intelligence

Tamper Evident Logging

Telecommunications

Telemetry

Threat Advisory Correlation

Threat and Vulnerability Management (TVM)

Threat Automation Framework

Threat Confidence Score

Threat Correlation

Threat Coverage Map

Threat Coverage Matrix

Threat Detection

Threat Emulation

Threat Emulation Lab

Threat Emulation Platform

Threat Exposure Mapping

Threat Feed

Threat Feed Aggregation

Threat Feed Integration

Threat Graph

Threat Hunting Maturity Model (HMM)

Threat Hunting Platform

Threat Hunting Playbooks

Threat Information Sharing

Threat Intelligence Automation

Threat Intelligence Lifecycle

Threat Intelligence Platform

Threat Intelligence Platform (TIP)

Threat Intelligence Taxonomy

Threat Propagation Analysis

Threat Sharing Protocol

Threat Simulation Tool

Threat Visualization

Ticketing System

Transaction Monitoring

Troubleshooting Flow

True Positive

Trusted Platform Module (TPM)

Tunneling

U

UEBA

UEBA Threshold Tuning

Unauthorized Login Alerting

Unusual Geolocation Detection

User and Entity Behavior Analytics

User and Entity Behavior Analytics (UEBA)

User Behavior Analytics

User Behavior Analytics (UBA)

User Risk Profiling

V

Virtual Private Network (VPN)

Virtualization

Visibility Gap

Vulnerability Age Analysis

Vulnerability Alerting

Vulnerability Correlation

Vulnerability Enumeration

Vulnerability Intelligence

Vulnerability Intelligence Feed

Vulnerability Management

Vulnerability Management Lifecycle

Vulnerability Management Playbook

Vulnerability Management Process

Vulnerability Mitigation

Vulnerability Prioritization

Vulnerability Scanner Tuning

Vulnerability Threat Mapping

W

Waterfall Model

Workflow Automation

X

XDR Integration

Y

YARA Rules

Z

Zero Day Correlation

Zero Day Variant Detection

← Back to the full A–Z glossary