Terminology Index

Glossary

64 terms starting with "E"

Showing 1-32 of 64 terms

ECDH

Elliptic Curve Diffie-Hellman: the elliptic-curve version of the Diffie-Hellman key exchange, letting two parties establish a shared secret efficiently and securely with much smaller keys than traditional Diffie-Hellman.

ECDSA

Elliptic Curve Digital Signature Algorithm: a widely used algorithm for creating digital signatures using elliptic-curve cryptography, providing authenticity and integrity with smaller keys and faster operation than RSA signatures.

EDR

Endpoint Detection and Response: software on endpoints that continuously records activity, detects malicious behavior, and lets responders investigate and act, such as isolating a host, giving deep visibility and control over what happens on each device.

EdDSA

Edwards-curve Digital Signature Algorithm: a modern elliptic-curve signature scheme (notably Ed25519) designed for speed, strong security, and resistance to common implementation mistakes that have undermined older signature algorithms.

Egress

Network traffic leaving a network or host, outbound flows toward the internet or another network. Controlling and monitoring egress is key to stopping data exfiltration and command-and-control communication.

Egress Control

Restricting and inspecting outbound traffic from cloud workloads so they can only reach approved destinations, limiting an attacker's ability to exfiltrate data or reach command-and-control if a workload is compromised.

Egress Filtering

Controlling outbound network traffic to limit data loss and attacker movement.

Email Alerts

SOC alerts generated from email security signals, such as detected phishing, malicious attachments or links, or suspicious sender behavior, which analysts triage to catch one of the most common attack delivery channels.

Emergency Patches

Patches applied urgently outside the normal schedule to fix a critical, actively threatened vulnerability, accepting the risk and disruption of fast deployment because the danger of leaving it unpatched is greater.

Emerging Cloud Frameworks

Newer and evolving compliance frameworks and standards relevant to cloud, such as those addressing AI, sector-specific cloud requirements, and updated regional regimes, that organizations must watch as the compliance landscape shifts.

Encapsulation

Wrapping data with protocol headers as it moves through network layers.

Encryption

Transforming readable data into an unreadable form using a key and algorithm, so only those with the key can recover the original. It is the primary technical means of protecting confidentiality for data at rest and in transit.

Encryption at Rest (Cloud)

Encrypting data stored in cloud services, disks, databases, object storage, so it is unreadable without the keys, protecting it if the underlying storage is accessed improperly. A cloud engineer enables and manages it across services.

Encryption in Transit (Cloud)

Encrypting data as it moves between cloud services, users, and systems, using TLS and related protocols, so it cannot be intercepted or tampered with on the network. A cloud engineer enforces it across connections.

Endpoint Alerts

SOC alerts originating from endpoint security tools like EDR and antivirus, flagging suspicious processes, malware, persistence, or anomalous host behavior. Endpoints are where much attacker activity executes, making these alerts high-value.

Endpoint Hardening

Reducing the attack surface of endpoints, laptops, desktops, and servers, by removing unnecessary software and services, applying secure configurations, enforcing patching, and deploying controls like EDR and disk encryption.

Endpoint Isolation

A containment action that cuts a compromised host off from the network while keeping it accessible to responders, stopping the attacker from spreading or communicating out while preserving the system for investigation.

Endpoint Telemetry

The activity data collected from endpoints, process creation, file and registry changes, network connections, logons, that feeds detection and investigation. It is one of the richest and most important telemetry sources for defenders.

Engineer-Developer Interface

The working relationship between cloud security engineers and the developers who build on the cloud, defining how security guardrails, feedback, and requirements reach developers without becoming a blocker to their work.

Engineering Security Champions

Developers within engineering teams who take on a security advocacy role, spreading secure practices, providing a local security point of contact, and bridging their team with the security function in a DevSecOps model.

Engineering vs Operations

The distinction between building cloud security capabilities (engineering, automation, guardrails, tooling) and running them day to day (operations, monitoring, response), two complementary modes within the cloud security engineer role.

Enrichment

Adding context to raw events and alerts, such as resolving an IP to a host and owner, tagging asset criticality, or attaching threat intelligence, so analysts can interpret and prioritize them faster and more accurately.

Enterprise Risk Management

A coordinated, organization-wide approach to identifying, assessing, and managing all major risks, financial, operational, strategic, cyber, in one framework, so leadership sees and governs the full risk picture rather than isolated silos.

Entra ID Assessment

Assessing the security of Microsoft Entra ID (the cloud identity service formerly Azure AD), reviewing privileged roles, conditional access, app registrations, MFA coverage, and risky configurations, since it is the front door to Microsoft cloud resources.

Ephemeral Evidence

Evidence in cloud environments that is short-lived and may disappear quickly, such as data on an auto-scaling instance that is terminated, requiring responders to capture it fast before it is gone.

Ephemeral Ports

The short-lived, high-numbered ports an operating system temporarily assigns to the client side of a network connection, used for the duration of that connection and then released. They help defenders interpret which side initiated traffic.

Eradication

Removing the cause of an incident, such as malware, persistence, or unsafe access.

Eradication Verification

Confirming that an attacker and all their footholds, malware, accounts, persistence, have actually been removed from the environment before declaring an incident resolved, rather than assuming eradication succeeded.

After eradication, responders must verify it worked: that all malware is gone, every attacker account and persistence mechanism is removed, and no overlooked foothold remains, because a single missed backdoor lets the attacker return. Verification combines checking the specific artifacts removed with broader hunting for anything missed. Only verified eradication justifies moving to recovery, so skipping it risks reinfection and a recurring incident.

Introduced in: Incident Response Operations

Examples

Confirming every attacker-created account and persistence entry is gone.
Hunting for any overlooked backdoor before declaring the incident resolved.
Verifying malware is fully removed across all affected hosts.

soc intermediate eradication-verification

No related terms linked yet.

Escalation

Handing an alert or incident to a higher tier, specialist, or team when it exceeds an analyst's scope or authority, such as raising a confirmed intrusion to incident response or a senior analyst. It ensures threats reach the right responders.

Escalation Criteria

The defined conditions that determine when an alert or incident should be escalated, such as confirmed compromise, high severity, sensitive assets, or exceeding an analyst's authority, so escalation is consistent rather than guesswork.

Espionage

Attacks motivated by stealing secrets, intellectual property, state, or trade secrets, intelligence, or sensitive data, typically by well-resourced, patient actors like nation-states who prioritize stealth and long-term access over disruption.

Event IDs

Numeric codes that identify specific event types in Windows logs (such as 4624 for a logon), letting defenders search for, filter, and build detections around particular activities recorded by the operating system.