Glossary

Action Item Tracking

The practice of recording the follow-up tasks identified in a post-incident review and tracking each one to completion with an owner and due date, so lessons from an incident actually turn into fixes.

Action Items

The concrete follow-up tasks that come out of a post-incident review, each describing a specific improvement, such as a configuration change, new detection, or process update, meant to reduce the chance or impact of a future incident.

Action-Oriented Reporting

A style of risk reporting that frames findings around the decisions and actions the audience can take, rather than just listing data. It tells leaders what changed, why it matters, and what to do next.

Activation Decisions

The judgment calls about whether and when to formally declare an incident and stand up the response process, including who has authority to activate and what thresholds trigger it.

Active Directory

A directory service commonly used to manage Windows identities, devices, and policy.

Active Directory Security

The practice of protecting Microsoft Active Directory, the on-premises identity service that authenticates users and controls access across most enterprise networks. Because nearly everything trusts it, compromising AD often means compromising the whole environment.

Active Directory Security Architecture

The structural design choices that make Active Directory defensible, such as administrative tiering, forest and domain trust boundaries, privileged access workstations, and the placement of controls that limit how far an attacker can move after a foothold.

Actor Profiling Use

Applying knowledge of a specific threat actor, such as their goals, typical tools, and behaviors, to make SOC work sharper, like prioritizing the detections and hunts most relevant to adversaries that actually target your organization.

Actor-Based Hunting

A threat-hunting approach that builds hypotheses around a specific adversary, searching for the tools, techniques, and behaviors that group is known to use, rather than hunting for generic anomalies.

Ad-Hoc Requirements

One-off intelligence questions that arise outside the standing set of priority requirements, such as an urgent request to learn more about a threat actor newly seen in your environment. They need a fast, focused answer rather than ongoing collection.

Administrator

A highly privileged user who can change important system or application settings.

Admission Control

A gatekeeping step that checks whether a workload, image, or change is allowed to run before it is admitted into an environment, blocking anything that fails policy such as an unsigned container image or one with critical vulnerabilities.

Admission Controllers

Kubernetes components that intercept requests to the cluster's API server and can validate or modify them before objects are created, letting security teams enforce policy such as blocking privileged pods or requiring trusted images.

Adversary Emulation

Safely reproducing the specific techniques a real threat actor uses to test whether your defenses detect and stop them. Unlike a broad penetration test, it follows a known adversary's playbook to validate detection coverage.

Agent vs Agentless

Two ways to gather security data from cloud workloads. Agent-based methods install software on each workload for deep, real-time visibility, while agentless methods scan workloads from outside (for example via snapshots or APIs) for broad, low-friction coverage.

Alert Design

Deciding how a detection turns into an actionable alert: what conditions trigger it, what context it carries, how severe it is, and how it routes to analysts, so that the alert is meaningful and not lost in noise.

Alert Fatigue

Reduced attention caused by too many low-value or repetitive alerts.

Alert Management Design

The design of how a security operations center handles its stream of alerts end to end: how alerts are prioritized, routed, assigned service-level targets, and escalated, so analysts work the most important things first without drowning.

Alert Triage

The first analytical step after an alert fires: quickly assessing what it is, whether it is a real threat or a false positive, and how urgent it is, so the right ones move into deeper investigation.

Alert Triage Methodology

A repeatable, structured way to triage alerts, defining the questions to ask, the context to gather, and the criteria for deciding an alert's disposition, so triage stays consistent across analysts and shifts.

Alert Volume

The total number of alerts a monitoring system generates over time. When volume outpaces the team's capacity, important alerts get buried and analysts experience fatigue, so managing volume is central to effective detection.

Allowlist Management

The disciplined practice of maintaining the exceptions that tell a detection to ignore specific known-benign activity, so that tuning down noise does not silently create blind spots attackers can hide in.

Allowlist Validation

An input-handling defense that checks user input against a list of explicitly permitted values or patterns and rejects everything else, rather than trying to block known-bad input. It is the safer default for validating untrusted data.

Analysis Documentation

Recording how a risk analysis was performed, including the assumptions, data sources, methods, and reasoning behind each estimate, so the conclusions can be understood, defended, and revisited later.

Analyst Development

The growth of a security analyst's skills over time, from following playbooks toward independent investigation, hunting, and mentoring, built through hands-on incident experience and reflection.

Analyst Shifts

How SOC analyst coverage is scheduled across hours and days, such as rotating shifts or follow-the-sun staffing, to keep monitoring running while managing fatigue and handoffs between analysts.

Analyst Specialization

The way SOC analysts develop deeper expertise in particular areas, such as malware analysis, cloud, identity, or detection engineering, instead of all analysts handling everything at the same level.

Analyst vs Adjacent Roles

The distinction between a security analyst and neighboring roles like SOC analyst, penetration tester, incident responder, or engineer, clarifying what an analyst owns (assessing and communicating risk) versus what overlapping roles do.

Analyst-Client Relationship

The working relationship between a security assessor and the team being assessed, spanning expectation-setting at kickoff, communication during the engagement, and follow-up on remediation, so findings are received and acted on rather than resisted.

Analytical Thinking for Security

The disciplined reasoning a security analyst applies to evidence: forming hypotheses, weighing what the data supports, avoiding bias, and drawing conclusions that hold up. It is the core mental skill behind good assessment and investigation.

Analytical Tradecraft

The professional standards intelligence analysts use to produce sound, trustworthy assessments: distinguishing fact from inference, expressing confidence honestly, considering alternatives, and sourcing claims clearly.