Glossary

Network

The interconnected systems and the paths between them over which data flows. Understanding what a network is, its devices, protocols, and connections, is foundational to defending it, monitoring it, and reasoning about attacks.

Network ACLs

Stateless rules that allow or deny traffic at the subnet level in cloud networks, providing a coarse layer of network access control complementary to stateful security groups around individual resources.

Network Alerts

SOC alerts generated from network-level signals, IDS/IPS hits, suspicious connections, DNS anomalies, that analysts triage to find network-based attacks like command-and-control, scanning, and exfiltration.

Network Anomaly Detection

Detecting unusual network behavior, traffic that deviates from baselines, rare destinations, atypical volumes or patterns, on the premise that abnormality often indicates malicious activity. A core network-detection technique.

Network Behavior Analysis

In malware analysis, examining the network activity a sample produces, DNS lookups, connections, command-and-control traffic, downloads, to understand its capabilities and extract network indicators.

Network Evidence

Evidence collected from network sources, logs, captures, flow data, IDS alerts, that defenders use to investigate incidents and prove what happened on the wire. It is a core form of incident evidence.

Network Firewalls

Devices or services that filter network traffic between zones, allowing or denying flows by rules to enforce segmentation and perimeter control. Among the oldest and most foundational network-security controls.

Network Policies (K8s)

Kubernetes resources that restrict which pods can communicate with which, enforcing network segmentation inside a cluster so a compromised pod cannot freely reach others. A core part of cluster workload protection.

Network Policies Production

Operating Kubernetes network policies in real production at scale, designing them sustainably, rolling them out without breaking apps, monitoring effectiveness, and maintaining them as workloads change.

Network Reconnaissance

Attacker activity that probes a network to map its devices, services, and weaknesses, scans, sweeps, and queries, that often precedes intrusion. Recognizing it is foundational to detecting attacks early.

Network Segmentation

Separating a network into smaller zones to reduce exposure and limit movement.

Network Telemetry

The data network devices and tools produce, flow records, packet captures, DNS, proxy, firewall, and IDS logs, that defenders collect for detection, hunting, and investigation. The lifeblood of network monitoring.

Network Threat Model

A model of how an attacker might attack the network, what enters and leaves, where boundaries are, what is trusted, used to anticipate threats and design controls so the network defends what matters.

Network Visibility

How much of what happens on the network defenders can actually see and analyze, determined by the telemetry collected, monitoring tools, and instrumentation. Without visibility, network defense and investigation are blind.

NetworkService

A built-in Windows service account with limited local privileges but ability to authenticate to the network as the computer itself. Defenders recognize it as a normal context, and abnormal behavior from it as suspicious.

Next-Generation Firewalls

Firewalls that inspect traffic beyond ports and addresses, looking at applications, users, and content, with features like deep packet inspection, IPS, and identity awareness, providing richer policy and detection than traditional firewalls.

Non-Repudiation

The property that a party cannot credibly deny having performed an action, since cryptographic or audit evidence ties them to it. It supports accountability alongside the CIA triad's other properties.

OAuth 2.0

An authorization framework that lets an application obtain limited access to a user's resources on another service without handling the user's password, by issuing scoped access tokens. It underpins much of modern delegated access.

OPA Gatekeeper

A Kubernetes admission controller built on Open Policy Agent that enforces policy on resources as they are created, blocking or auditing workloads that violate rules, so cluster policy is enforced automatically.

OPA and Sentinel

Two policy-as-code tools, Open Policy Agent (OPA) and HashiCorp Sentinel, that a cloud engineer uses to define and automatically enforce policies on infrastructure and access, codifying guardrails as testable rules.

OSI Model

A conceptual model that organizes network communication into layers.

OWASP Testing Guide

A comprehensive, community-developed methodology for testing web application security, organizing the techniques and checks a tester uses to systematically assess an application for vulnerabilities.

Obligation vs Aspiration

The distinction in policy writing between mandatory requirements (obligations, what people must do) and aspirational guidance (what is encouraged), so policies are clear about what is enforceable versus merely desirable.

On-Call Dynamics

The realities of being on-call for incident response, unpredictable disruptions, pressure to respond fast, fatigue, and impact on life, that affect responder effectiveness and wellbeing and must be managed deliberately.

One-Way Functions

Functions that are easy to compute in one direction but infeasible to reverse, the mathematical basis of much cryptography, especially hashing, where you cannot practically recover the input from the output.

Open Policy Agent for IaC

Using Open Policy Agent to enforce security policy on infrastructure-as-code before deployment, evaluating Terraform or similar definitions against rules so non-compliant infrastructure is blocked in the pipeline.

Open Source Contribution

Contributing to shared open-source detection content, rules, analytics, and tools, so detection engineers both benefit from and give back to the community, raising the collective quality of detections.

Open Source Intelligence

OSINT: intelligence gathered from publicly available sources, websites, social media, public records, forums, that a SOC uses to understand threats, actors, and its own exposure without privileged access.

OpenID Connect

An identity layer on top of OAuth that helps applications verify who a user is.

Operational Evidence

Compliance evidence showing that a control operated consistently over time, logs, tickets, records of recurring activities, as opposed to point-in-time proof, demonstrating the control works in practice, not just on paper.

Operational Intelligence

Threat intelligence about specific campaigns, operations, or imminent threats, more detailed than strategic intelligence but broader than individual indicators, helping defenders prepare for and respond to active threat activity.