Glossary

Sysmon

Microsoft Sysinternals' Sysmon: a Windows service that emits detailed process, network, and file events, vastly richer than default Windows logging. A go-to source for endpoint detection and hunting.

System Calls

The interface user-space programs use to request services from the kernel, like reading files, opening network connections, or creating processes. Defenders inspect syscalls to characterize behavior.

System Hardening

The discipline of reducing a system's attack surface and weakening its exploitability through configuration, baselines, patching, and removing unnecessary capabilities. A foundational defensive practice.

Systemd

The init system and service manager used by most modern Linux distributions. Systemd controls how services start, run, and are logged, and is a key target for both administration and attacker persistence.

TCP

TCP is a transport protocol that creates reliable, ordered communication between systems.

TCP/IP Model

The layered conceptual model behind internet networking, network access, internet, transport, and application layers, that organizes how data moves end to end across networks.

TEF Estimation

In FAIR, estimating Threat Event Frequency, how often a threat event of interest could occur in a year, by combining contact frequency with probability of action.

TI Analyst Role

The threat-intelligence analyst role: producing and curating intelligence about adversaries and threats to support SOC, IR, and leadership decisions. A distinct path within security analysis.

TI Community

The community of practice around threat intelligence, ISACs, vendor analyst groups, public researchers, that practitioners participate in to share intelligence, sharpen craft, and build reputation.

TI Skills

The skills threat-intelligence analysts develop, source evaluation, structured analytic techniques, writing, attribution, language and OSINT, that are distinct from general SOC analyst skills.

TI Specializations

The areas TI analysts specialize in, threat-actor tracking, malware analysis, geopolitical/strategic, technical/tactical, that let the team cover the breadth of intelligence work in depth.

TI to Adjacent Roles

How threat-intelligence experience leads to adjacent careers, detection engineering, hunting, IR, security research, that use TI skills in different contexts.

TLD

Top-Level Domain, the rightmost component of a domain name like .com, .org, or country-code TLDs like .uk. Defenders track TLDs because some are heavily abused by attackers.

TLP (Traffic Light Protocol)

A simple labeling scheme for intelligence sharing, RED, AMBER, GREEN, CLEAR, that tells recipients who they may share information with, used widely across threat-intelligence communities.

TLS

TLS is a protocol that encrypts network communication and helps verify the identity of the service being contacted.

TOTP

Time-based One-Time Password, a code generated from a shared secret and the current time that changes every 30 seconds. The MFA factor used by Google Authenticator and similar apps.

TPRM Applied

Applying third-party risk management in practice end to end, vendor inventory, tiering, due diligence, contracts, monitoring, that builds a working TPRM function rather than a paper one.

TPRM Lifecycle

The end-to-end lifecycle of third-party risk management, identification, due diligence, contracting, monitoring, offboarding, that the GRC analyst manages through each stage.

TTP Mapping

Mapping observed activity (during a hunt or incident) to specific ATT&CK tactics, techniques, and procedures, so findings tie back to a shared framework for coverage, sharing, and analysis.

TTP-Based Hunting

Threat hunting organized around specific TTPs rather than indicators, looking for adversary behavior (credential dumping, lateral movement patterns) in telemetry to catch threats indicator-based detection misses.

TTPs

Tactics, Techniques, and Procedures: the patterned ways an adversary operates, more durable signals than indicators because attackers tend to keep their methods even when they rotate infrastructure.

TXT Record

A DNS record type that holds arbitrary text. Heavily used for security purposes: SPF, DKIM, DMARC, and domain-ownership verification all rely on TXT records.

Tabletop Exercise

A discussion-based exercise where teams walk through a hypothetical incident scenario, decisions, communications, actions, to test plans and build readiness without touching real systems.

Tactic

In MITRE ATT&CK terms, the why of an adversary action, the high-level objective like Initial Access, Persistence, or Exfiltration, under which specific techniques sit.

Tactical Intelligence

Intelligence about specific adversary techniques and immediate indicators, useful for hunters and detection engineers writing rules and looking for matches in current telemetry.

Tagging

Labeling alerts, tickets, or cases with structured tags for techniques, severity, source, status, that makes analyst data searchable, reportable, and useful for metrics over time.

Tamper Protection

Hardening that prevents users or malware from disabling or weakening security controls, like turning off antivirus, EDR, or logging. A core defense against well-known attacker tradecraft.

Team Capability

The team's collective skills, depth, and breadth to operate cloud workload protection effectively, recognized as a critical input alongside tools and process when designing a CWP program.

Technical Compliance Metrics

Compliance metrics derived from technical sources, configuration scans, vulnerability data, control telemetry, that make compliance measurable in real time rather than only via point-in-time audits.

Technical Controls

Controls implemented through technology, firewalls, MFA, encryption, EDR, that automate enforcement of security requirements. One of three foundational control categories alongside administrative and physical.

Technical Debt

Accumulated shortcuts, deferred work, and aging components in technology, that create risk over time, security gaps, fragile dependencies, hard-to-fix exposures, that compound until addressed.