Concept Maps

Activation Decisions

The judgment calls about whether and when to formally declare an incident and stand up the response process, including who has authority to activate and what thresholds trigger it.

Alert Triage

The first analytical step after an alert fires: quickly assessing what it is, whether it is a real threat or a false positive, and how urgent it is, so the right ones move into deeper investigation.

Analyst Development

The growth of a security analyst's skills over time, from following playbooks toward independent investigation, hunting, and mentoring, built through hands-on incident experience and reflection.

Analyst Shifts

How SOC analyst coverage is scheduled across hours and days, such as rotating shifts or follow-the-sun staffing, to keep monitoring running while managing fatigue and handoffs between analysts.

Analyst Specialization

The way SOC analysts develop deeper expertise in particular areas, such as malware analysis, cloud, identity, or detection engineering, instead of all analysts handling everything at the same level.

Assembly for Analysts

A working familiarity with assembly language so a malware analyst can read disassembled code and understand what a sample does at the instruction level when higher-level clues are missing or obfuscated.

Attorney-Client Privilege in IR

The legal protection that can keep certain incident-response work confidential when it is done under the direction of legal counsel. It shapes how investigations are structured, communicated, and documented during major incidents.

Benign True Positive

An alert that correctly fired on the activity it was designed to detect, but where that activity turns out to be legitimate, such as an admin tool used by an authorized administrator. The detection worked; the behavior was simply expected.

Burnout

The exhaustion, cynicism, and reduced effectiveness that affect security analysts after prolonged stress, high alert volume, and relentless pace. It is a serious operational risk because it degrades detection quality and drives staff turnover.

Career Arc IR

The typical career progression in incident response, from junior responder through senior responder and incident commander toward leadership, and the skills and mindset shifts each stage requires.

Career Ladders

Defined progression paths for security analysts, laying out the levels (such as Tier 1 to Tier 3 and into specialties or leadership) and the skills and responsibilities expected at each. They give analysts a clear way to grow.

Cloud Hunting Data Sources

The telemetry a threat hunter draws on to hunt in cloud environments, such as control-plane and audit logs, identity sign-in logs, network flow logs, and managed detection findings. They are the raw material for cloud hunts.

Confidence Assessment

Judging and clearly stating how much trust to place in a piece of intelligence, based on source reliability and corroboration. It lets a SOC act on intelligence proportionately rather than treating every claim as equally certain.

Context Gathering

Collecting the surrounding information an analyst needs to make sense of an alert, the user, host, asset criticality, recent activity, and related events, so triage decisions rest on a full picture rather than the alert alone.

Crisis External Communication

Communicating with outside parties, customers, regulators, media, and the public, during a major incident, managed by incident leadership to inform stakeholders accurately while protecting the organization legally and reputationally.

Data-Driven Hunting

A threat-hunting approach that starts from the data itself, applying analytical techniques like frequency analysis, stack counting, and long-tail analysis to large datasets to surface anomalies worth investigating, rather than starting from a known threat.

DE-Hunting Interface

The working relationship between detection engineering and threat hunting, where hunters discover new attacker behaviors and detection engineers turn the repeatable ones into automated detections, creating a loop that steadily expands coverage.

DE-SOC Interface

The working relationship between detection engineering and the SOC, where the SOC operates and gives feedback on detections, and detection engineers use that feedback, false positives, missed threats, tuning needs, to improve them.

Detection Backlog

The prioritized list of detections a detection-engineering team intends to build or improve, fed by coverage gaps, threat intelligence, hunt findings, and SOC feedback. It turns scattered detection needs into managed, prioritized work.

Detection Documentation

The written record accompanying a detection, what it detects, the logic and data sources it uses, its assumptions, known false positives, and response guidance, so it can be understood, triaged, tuned, and maintained by others.

Detection Engineer

The role responsible for designing, building, testing, and maintaining the detections a SOC relies on, turning knowledge of attacker behavior into reliable, well-documented rules and analytics that surface threats.

Detection Hypothesis

A testable idea about how a specific attacker behavior would appear in available data, which a detection engineer forms before building a detection, stating what to look for and in which telemetry.

Detection Lifecycle

The full arc of a detection from idea to retirement, hypothesis, development, testing, deployment, tuning, monitoring, and eventual retirement, framing detection as something maintained over time rather than written once.

Detection Metadata

The structured attributes attached to a detection, such as the technique it covers, data sources, severity, confidence, false-positive notes, owner, and version, that make a detection manageable, searchable, and maintainable at scale.

Detection Robustness

How resistant a detection is to evasion and to breaking, a robust detection keys on hard-to-change attacker behavior rather than superficial, easily altered indicators, so attackers cannot trivially bypass it.

Detection Specificity

How precisely a detection targets malicious activity without flagging benign behavior, high specificity means few false positives, because the detection fires narrowly on what is actually suspicious.

Detection Strategy

The overall plan guiding what a team detects and how, defining priorities, the balance of detection types, coverage goals, and how detection effort aligns with the organization's threats and risk.

Detection-as-Code

Managing detections like software, defined in code, version-controlled, peer-reviewed, tested in pipelines, and deployed automatically, so detection engineering gains the rigor, repeatability, and collaboration of modern software development.

Disposition

The decision an analyst records to close out an alert or case, classifying it as a true positive, false positive, benign true positive, or escalation. It is the formal conclusion of triage and creates an accountable record.

Dynamic Analysis Methodology

The approach to analyzing malware by running it in a controlled, isolated environment and observing its behavior, what files, processes, registry keys, and network connections it creates, to understand what it does without reading its code.

Eradication

Removing the cause of an incident, such as malware, persistence, or unsafe access.

Evidence Collection

Gathering and preserving the data that supports an investigation, logs, artifacts, screenshots, and records, in a sound, documented way so it accurately reflects what happened and can support decisions or later review.

Evidence Strategy

In threat hunting, the plan for what data and evidence a hunt will examine to test its hypothesis, which sources, fields, and time ranges, so the hunt actually has the visibility to confirm or refute what it is looking for.

Executive Crisis Communication

How incident leadership communicates with and on behalf of executives during a major incident, coordinating leadership messaging, decisions, and external statements at the highest level, often with legal and board involvement.

External IR Coordination

Coordinating with outside parties during a major incident from a leadership standpoint, external responders, forensics firms, law enforcement, regulators, and partners, so their involvement is managed coherently rather than ad hoc.

External IR Support

Outside help brought in during an incident, such as incident-response retainers, forensics specialists, or threat-intelligence providers, when an incident exceeds the internal team's capacity, expertise, or capacity for objectivity.

Frequency Analysis

A hunting and analysis technique that counts how often values occur in a dataset, so rare occurrences stand out, on the principle that unusual, infrequent activity is more likely to be malicious than common, high-volume activity.

Ghidra Workflow

The process of using Ghidra, a free reverse-engineering tool, to analyze a malware binary, loading the sample, navigating its disassembly and decompiled code, and annotating findings to understand how the malware works.

Government Intelligence

Threat intelligence produced or shared by government bodies, such as national cybersecurity agencies, providing advisories, indicators, and threat assessments that a SOC can use, often authoritative but sometimes broad or delayed.

Hunt Conclusion

The closing stage of a threat hunt, where findings are assessed against the hypothesis, a verdict is reached (threat found or not), and outcomes, new detections, leads, or assurance, are determined and recorded.

Hunt Documentation

Recording a threat hunt, its hypothesis, data examined, methods, findings, and outcome, so the work is repeatable, its value is captured, and lessons (including new detections) carry forward.

Hunt Execution

The active phase of a threat hunt, where the hunter queries data, applies analysis techniques, and follows leads to test the hypothesis, turning the hunt plan into hands-on investigation of the environment.

Hunt Hypothesis

A specific, testable statement of what malicious activity might be present and how it would show up in data, that drives a threat hunt, giving it a clear question to investigate rather than aimless searching.

Hunt Hypothesis Library

A curated, reusable collection of hunt hypotheses an advanced hunting program maintains, so proven and candidate hunt ideas are organized, prioritized, and repeatable rather than reinvented each time.

Hunt Outcomes

The range of results a threat hunt can produce, finding an active threat, generating new detections, surfacing visibility gaps, or providing assurance that nothing was found, all of which are legitimate, valuable results.

Hunt Plan

The structured plan for a threat hunt that specifies the hypothesis, the data sources and techniques to use, the scope, and the success criteria, so the hunt is organized and repeatable rather than ad hoc.

Hunt Program Operations

The ongoing management of a threat-hunting program, planning and prioritizing hunts, allocating resources, tracking coverage and outcomes, and reporting value, so hunting runs as a sustained capability rather than occasional effort.

Hunt Report Structure

The standard format for documenting and communicating a threat hunt, covering the hypothesis, scope, data and methods, findings, and recommendations, so results are clear, comparable, and actionable to different audiences.

Hunting Maturity

How developed an organization's threat-hunting capability is, from ad-hoc, occasional hunts to a structured, data-rich, continuously improving program, used to assess where hunting stands and how to advance it.

Hunting Mindset

The proactive, skeptical, curiosity-driven attitude a threat hunter brings, assuming a breach may already exist and actively seeking it, rather than waiting for alerts. It is the mental posture that makes hunting work.

Hypothesis Formation

The analyst skill of forming a testable explanation for what an alert or anomaly might mean, then investigating to confirm or rule it out, bringing structure and direction to triage and investigation.

Hypothesis Refinement

Adjusting a hunt hypothesis as evidence accumulates, narrowing, broadening, or pivoting it based on what the data shows, so the hunt stays productive rather than rigidly pursuing an initial guess.

Hypothesis Sources

The inputs that generate hunt hypotheses, threat intelligence, knowledge of attacker techniques (like MITRE ATT&CK), past incidents, anomalies in data, and environmental knowledge, that give hunters credible ideas worth investigating.

Imposter Syndrome

The persistent feeling of self-doubt and not being competent enough despite real ability, common among security analysts given the field's breadth, that affects confidence and wellbeing if left unaddressed.

Incident Confirmation

The step in incident response of verifying that a suspected event is a genuine security incident before mobilizing the full response, distinguishing real incidents from false alarms so effort is not wasted or misdirected.

Incident Responder

A professional who handles security incidents hands-on, investigating, containing, eradicating, and recovering from intrusions, within incident response operations. The role demands technical depth, composure, and structured judgment under pressure.

Indicators of Compromise

Observable artifacts that signal a system may be compromised, such as malicious file hashes, IP addresses, domains, or registry keys, used to detect, hunt for, and confirm known threats across an environment.

Initial Assessment

An analyst's first evaluation of an alert, quickly judging what it is, how urgent and severe it appears, and what to do next, to triage it efficiently before deeper investigation.

Initial Communication

The first communications sent when an incident is confirmed, notifying the right internal people and stakeholders that an incident is underway, establishing channels and cadence so coordination starts on the right foot.

Initial Response

The first hands-on actions taken once an incident is confirmed, stabilizing the situation, beginning containment where needed, preserving evidence, and mobilizing responders, before the fuller investigation and response unfold.

Initial Scoping

Determining the breadth of an incident early on, which systems, accounts, and data are affected and how far the compromise reaches, so response is sized correctly and nothing affected is missed.

IR Mental Demands

The psychological strain of incident response work, pressure, uncertainty, long hours, high stakes, and on-call stress, that responders must manage to stay effective and avoid burnout over a career.

IR Skill Profile

The mix of competencies an effective incident responder needs, technical depth (forensics, systems, networking), structured analytical thinking, communication, and composure under pressure, that together define the role's requirements.

IR-SOC Boundary

The dividing line and handoff between SOC operations and the incident response function, defining when an issue stops being SOC triage and becomes an incident IR owns, so the transition is clear and nothing falls between them.

Long Tail Analysis

An analytic technique that focuses on the rare, infrequent items in a dataset, the 'long tail', on the principle that uncommon activity is more likely to be malicious than the common bulk. Used in hunting and log analysis.

On-Call Dynamics

The realities of being on-call for incident response, unpredictable disruptions, pressure to respond fast, fatigue, and impact on life, that affect responder effectiveness and wellbeing and must be managed deliberately.

Post-Incident Review

A structured review of what happened, what worked, and what should improve after an incident.

Proactive vs Reactive

The contrast between proactively looking for threats (hunting) and reactively responding to detections, foundational to threat hunting as a discipline distinct from waiting for alerts to fire.

Queue Management

The discipline of managing the SOC's alert queue, prioritizing, batching, and clearing items so the team handles the most important alerts in time without burning out or letting noise accumulate.

Response Tempo

The pace at which an organization handles an ongoing incident, decisions, communications, technical actions, that must be set and sustained deliberately rather than left to circumstance.

Rule Logic Design

Designing the logic of a detection rule, the conditions, thresholds, joins, and exclusions, so it accurately flags malicious activity with manageable false positives and stable behavior over time.

Severity Classification

Categorizing incidents by severity (critical, high, medium, low) using defined criteria, so response, escalation, and reporting follow consistent rules rather than ad-hoc judgment.

Short-Term Containment

Immediate actions taken to stop an active incident from spreading or worsening, isolating hosts, blocking IPs, disabling accounts, while longer-term containment and eradication are planned.

Stack Counting

A hunting and analytics technique that counts how often each value of a field occurs to surface rare items, on the premise that unusual values often indicate threats worth investigating.

Telemetry Mapping

Mapping the telemetry available to the detections and investigations it supports, so coverage gaps and surplus collection are both visible, and decisions about telemetry investment are evidence-based.

Threat to Detection

The detection-engineering practice of translating identified threats into specific detections, mapping each threat through hypothesis, data needs, rule logic, to a working production detection.

Triage Methodology

The disciplined approach an analyst uses to triage incoming alerts, gathering context, dispositioning, escalating, that turns alert volume into structured decisions rather than ad hoc reactions.

Triage Throughput

How many alerts a triage analyst processes per unit time, while maintaining quality, a key SOC operational metric that exposes capacity, methodology effectiveness, and queue health.

True Positive

An alert that correctly identifies a real threat. The outcome triage discipline aims to produce reliably, even amid volumes of false positives that can dull attention.

War Room

A dedicated space (physical or virtual) where the incident response team coordinates during a major incident, with continuous presence, fast decisions, and tight communication.