Terminology Index

Glossary

1801 terms

Showing 1249-1280 of 1801 terms

Privileged Session Monitoring

Recording and observing privileged sessions, video or keystroke logs of admin activity, so administrative actions are accountable, auditable, and reviewable for misuse or compromise.

Proactive vs Reactive

The contrast between proactively looking for threats (hunting) and reactively responding to detections, foundational to threat hunting as a discipline distinct from waiting for alerts to fire.

Reactive security responds to events as they happen, alert triage, incident response, classical SOC operations. Proactive security goes hunting: assuming threats may be present and actively searching for them before detections fire. Both are necessary, alerts cover known patterns, hunting reaches what they miss. Understanding the proactive-vs-reactive distinction is foundational to threat hunting and frames why hunting exists alongside, rather than instead of, traditional detection-and-response.

Introduced in: Threat Hunting Fundamentals

Examples

Reactively triaging alerts as they arrive in the SOC.
Proactively hunting for adversary activity that no alert flagged.
Using both proactive hunts and reactive response together.

soc intermediate proactive-vs-reactive

No related terms linked yet.

Procedure

A step-by-step instruction describing how to perform a specific task in line with policy and standards. Procedures sit at the operational level of the policy hierarchy, turning intent into concrete action.

Process

A running instance of a program on an operating system.

Process Anomaly Detection

Detecting unusual process behavior on endpoints, rare process names, unexpected parents, anomalous command lines, or atypical execution patterns, on the premise that abnormal processes often indicate malicious activity.

Process Evidence

Evidence that a security or compliance process actually ran, sign-offs, ticket records, meeting minutes, demonstrating to auditors that defined processes are followed in practice rather than only documented.

Process ID

A unique number an operating system assigns to a running process, used to identify and reference it. Defenders use PIDs to follow specific processes through investigation and to correlate events to the same execution.

Process Injection

An attacker technique that inserts malicious code into a legitimate running process, so the code runs under that process's identity and trust, evading defenses that focus on suspicious processes.

Process Monitor Analysis

Using Process Monitor (procmon), or similar tools, to observe and analyze a sample's process, file, registry, and network activity during dynamic malware analysis, revealing detailed behavior in real time.

Process Policy Metrics

Metrics measuring how well the policy-management process itself is running, drafting cycle times, review timeliness, exception handling, retirement, separate from measuring individual policy effectiveness.

Process Tree

The hierarchy of processes and their parents on a system, showing which process spawned which. Reading the tree gives crucial context for detection and investigation by exposing unusual lineage.

Production Kubernetes

The realities of running Kubernetes securely at production scale, hardening the cluster, operating policies and controls over time, handling change and incidents, beyond what initial deployment requires.

Program Governance

The structures that direct and oversee a security program, leadership, roles, policies, metrics, accountability, so the program operates coherently rather than as a collection of isolated activities.

Progressive Microsegmentation

Rolling out microsegmentation gradually in stages rather than all at once, starting with monitoring, then enforcing in narrow scopes and expanding, so the transition succeeds without breaking applications.

Protocol

A protocol is a set of rules that systems follow to communicate.

Provisioning

Creating and granting accounts and access to identities, the joining-and-onboarding side of the identity lifecycle. Done well, provisioning is automated, timely, and grants only the access actually needed.

Proxy Frameworks

Frameworks an organization adopts as a proxy for, or wrapper over, a more specific set of obligations, allowing the organization to use one recognized framework to satisfy or signal multiple underlying requirements.

Proxy Logs

Logs from web proxies recording the URLs users and systems accessed, including method, response, and often categories, a rich source of telemetry for detecting C2, exfiltration, and policy violations.

Psychological Safety

The team-level condition where people feel safe to speak up, report mistakes, ask questions, or raise risks without fear of blame, foundational to security culture, learning, and effective blue-team operations.

Public Address Space

IP addresses that are routable on the public internet, assigned and managed globally. Recognizing the boundary between public and private addressing is foundational to understanding exposure and network traffic.

Public Cloud

Cloud infrastructure shared among many customers and offered as a service by a provider (such as AWS, Azure, or GCP). It delivers scale and economic efficiency through shared multi-tenant resources.

Public Key

The non-secret half of an asymmetric key pair, shared openly, used to encrypt to the holder of the matching private key or to verify signatures the private key produced.

Public Storage Buckets

A common cloud misconfiguration where object-storage buckets are set to public access, exposing data to the internet. A frequent, high-impact issue that posture management and assessment focus on.

Public-Facing Applications

Applications reachable from the public internet, a primary attack surface in the threat landscape, since they are continuously probed and exploited by opportunistic and targeted attackers alike.

Purple Team Exercises

Collaborative exercises where red-team attackers and blue-team defenders work together openly, attacking and defending in real time to validate detections, improve response, and transfer knowledge.

Push Notification MFA

A possession-factor MFA method that sends an approval prompt to a registered device for the user to tap. Convenient and stronger than passwords alone, but vulnerable to MFA fatigue and relay attacks.

Pyramid of Pain

A model showing that some indicators (hashes, IPs) are cheap for attackers to change while behaviors and TTPs are painful, so detections built on the upper layers cause far more disruption to adversaries.

Qualitative Analysis Depth

The level of rigor and structure brought to qualitative risk analysis, from quick scoring to deep documented reasoning about scenarios, which determines how trustworthy and useful qualitative results are for decisions.

Qualitative Risk

Risk analysis expressed in non-numeric, descriptive terms such as high/medium/low or red/amber/green, common in GRC for its accessibility, often paired with structured criteria for consistency.

Qualitative Risk Limitations

The constraints of qualitative risk methods, subjective ratings, poor comparability across raters, inability to combine or compare in dollar terms, that motivate using quantitative methods like FAIR for certain decisions.

Quantitative Risk

Risk analysis expressed in numbers, frequencies, probability distributions, and dollar amounts, that enables comparison, aggregation, and clear financial reasoning. FAIR is the leading quantitative approach in cybersecurity.

Quantitative Risk Communication

Presenting quantitative risk results, ranges, distributions, and confidence, to decision-makers in ways they can act on, avoiding the false precision and impenetrability that quantitative analyses can otherwise convey.