Terminology Index

Glossary

2953 terms

Email and Phone Verification Limits

Email and phone verification prove control of a contact channel at a time, not legal identity, age, employment, ownership, authority, or durable possession.

Emergency Access Alerting

Emergency access alerting reports every sign-in attempt, credential change, role change, policy-exclusion change, and administrative action involving a designated emergency identity.

Emergency Access Resilience

Emergency access resilience keeps at least two independent, cloud-only administrative identities usable when normal identity controls, federation, devices, or approval paths fail.

Emergency Patch

An expedited update deployed outside normal cadence because the exposure and urgency justify accelerated testing, authorization, monitoring, and rollback preparation.

Emergency Patches

Patches applied urgently outside the normal schedule to fix a critical, actively threatened vulnerability, accepting the risk and disruption of fast deployment because the danger of leaving it unpatched is greater.

Emergency Stop and Escalation

Emergency stop and escalation are the predefined conditions and communication steps used to halt security testing when safety, availability, data, privilege, or scope becomes uncertain.

Emergency Vulnerability Response

Emergency vulnerability response is an event-driven workflow that accelerates identification, triage, treatment, verification, escalation, and communication for time-sensitive vulnerability risk.

Emerging Cloud Frameworks

Newer and evolving compliance frameworks and standards relevant to cloud, such as those addressing AI, sector-specific cloud requirements, and updated regional regimes, that organizations must watch as the compliance landscape shifts.

Encapsulation

Wrapping data with protocol headers as it moves through network layers.

Encryption

Transforming readable data into an unreadable form using a key and algorithm, so only those with the key can recover the original. It is the primary technical means of protecting confidentiality for data at rest and in transit.

Encryption at Rest (Cloud)

Encrypting data stored in cloud services, disks, databases, object storage, so it is unreadable without the keys, protecting it if the underlying storage is accessed improperly. A cloud engineer enables and manages it across services.

Encryption in Transit (Cloud)

Encrypting data as it moves between cloud services, users, and systems, using TLS and related protocols, so it cannot be intercepted or tampered with on the network. A cloud engineer enforces it across connections.

End-of-Life Product Risk

End-of-life product risk is the exposure created when a product or version no longer receives the security fixes, maintenance, or assurance the organization requires.

Endpoint Alert

An alert derived from host or device activity such as process, file, persistence, memory, configuration, identity, or network behavior.

Endpoint Alerts

SOC alerts originating from endpoint security tools like EDR and antivirus, flagging suspicious processes, malware, persistence, or anomalous host behavior. Endpoints are where much attacker activity executes, making these alerts high-value.

Endpoint Containment Verification

Endpoint containment verification proves that intended devices entered and maintain the selected isolation or restriction state while preserving required response management.

Endpoint Hardening

Reducing the attack surface of endpoints, laptops, desktops, and servers, by removing unnecessary software and services, applying secure configurations, enforcing patching, and deploying controls like EDR and disk encryption.

Endpoint Investigation

Authorized collection and analysis of endpoint process, identity, file, persistence, network, memory, configuration, and security-tool evidence to answer a scoped incident question.

Endpoint Isolation

A containment action that cuts a compromised host off from the network while keeping it accessible to responders, stopping the attacker from spreading or communicating out while preserving the system for investigation.

Endpoint Telemetry

The activity data collected from endpoints, process creation, file and registry changes, network connections, logons, that feeds detection and investigation. It is one of the richest and most important telemetry sources for defenders.

Endpoint Telemetry Coverage

The measured share of eligible endpoints that report the required event types and fields correctly and within the required time.

Endpoint and Network Containment

Endpoint and network containment uses authorized host, process, service, route, segmentation, proxy, DNS, and connection controls to interrupt defined harmful behavior.

Endpoint and State Inventory

An endpoint and state inventory records each web or API operation, its inputs, identity expectation, object, side effect, workflow state, content type, and known caller.

Engineer-Developer Interface

The working relationship between cloud security engineers and the developers who build on the cloud, defining how security guardrails, feedback, and requirements reach developers without becoming a blocker to their work.

Engineering Security Champions

Developers within engineering teams who take on a security advocacy role, spreading secure practices, providing a local security point of contact, and bridging their team with the security function in a DevSecOps model.

Engineering vs Operations

The distinction between building cloud security capabilities (engineering, automation, guardrails, tooling) and running them day to day (operations, monitoring, response), two complementary modes within the cloud security engineer role.

Enhanced Monitoring Period

An enhanced monitoring period defines post-recovery hypotheses, data, alerts, staffing, thresholds, review cadence, duration, privacy and cost controls, and evidence-based exit criteria.

Enrichment

Adding context to raw events and alerts, such as resolving an IP to a host and owner, tagging asset criticality, or attaching threat intelligence, so analysts can interpret and prioritize them faster and more accurately.

Raw telemetry is often cryptic, an IP, a username, a hash, and enrichment automatically attaches the context needed to make sense of it: who owns the host, how critical the asset is, whether an indicator is known-bad, the user's department. Performed in the logging and detection pipeline, enrichment reduces the manual lookups analysts would otherwise do, speeds triage, and improves alert quality and prioritization.

Introduced in: Logging, Monitoring, and Telemetry

Examples

Resolving an alert's IP to a hostname, owner, and asset criticality automatically.
Tagging an indicator with threat-intelligence context as events are ingested.
Attaching a user's role and department to an identity alert.

Context Gatheringrelates_to Lookup Tablesrelates_to Alert Fatiguerelates_to Intelligence in Detectionrelates_to Identity Telemetryrelates_to Alert Volumerelates_to Eventsrelates_to Identity Telemetryrelates_to Intelligence in Detectionrelates_to Intelligence in Triagerelates_to Lookup Tablesrelates_to Multi-Source Correlationrelates_to

Enrichment Provenance

The source, observation time, authority or confidence, and failure state associated with context added to an event.

Enterprise Access Model (Tier Model)

Microsoft's Enterprise Access Model organizes control, management, data or workload planes and their access pathways, building on the legacy three-tier AD administrative model.

Enterprise Risk Management

A coordinated, organization-wide approach to identifying, assessing, and managing all major risks, financial, operational, strategic, cyber, in one framework, so leadership sees and governs the full risk picture rather than isolated silos.

Entity Identifier Quality

The stability, uniqueness, scope, and provenance that determine whether an account, device, workload, session, or request identifier can be correlated safely.