Terminology Index

Glossary

2953 terms

SAML

Security Assertion Markup Language: a long-standing federation standard for single sign-on, where an identity provider asserts a user's identity to a service provider via signed XML messages.

SAML 2.0

SAML 2.0 is an XML-based federation standard in which an identity provider sends signed assertions about an authenticated subject to a service provider.

SAST Implementation

Operating Static Application Security Testing in practice, integrating it into pipelines, tuning to manage noise, prioritizing findings, and making developers act on results so SAST delivers real value.

SBOM

A software bill of materials that lists components used in an application or system.

SBOM and Dependency Correlation

SBOM and dependency correlation maps vulnerability information to software components, relationships, builds, artifacts, products, and deployments using supplier and package identity evidence.

SCA Implementation

Operating Software Composition Analysis to track and secure open-source dependencies, integrating it into pipelines, managing findings, and driving updates so supply-chain risk in dependencies is actually addressed.

SCIM Protocol

System for Cross-domain Identity Management: a standard for provisioning users, groups, and identity attributes between systems, the protocol modern IAM uses to keep accounts in sync across applications.

SCIM Provisioning Validation

SCIM provisioning validation proves that identity create, update, disable, rehire, and entitlement changes reach the intended target with correct attributes and state.

SGID

The set-group-ID bit on Unix-like executables and directories. On executables it runs the program with the group's permissions; on directories it inherits the group to new files. A classic permission concept defenders inspect.

SHA-1

An older cryptographic hash function (160-bit) once widely used but now broken for security: practical collisions exist, so it must not be used for signatures or integrity guarantees.

SHA-256

A widely used cryptographic hash function (256-bit) from the SHA-2 family, currently the standard secure choice for integrity, signatures, and IOC fingerprints across modern cryptography.

SIEM

Security Information and Event Management: the platform that collects, stores, normalizes, and analyzes security telemetry, the central tool for detection, hunting, and investigation in modern SOCs.

SIEM Data Models

The schemas and structures SIEMs use to normalize events from many sources into common fields, so queries and detections work across them rather than re-implementing per source.

SIEM data models, common information models, CIM, ECS, normalize fields like user, host, action, source IP across diverse log sources. Detection rules and queries written against the model work regardless of which source produced the event, dramatically reducing duplication. Understanding the data model is foundational to writing efficient SIEM queries: queries that respect the model are portable and fast, while those that don't break easily. As a SIEM-query fundamentals topic, data models underpin scalable detection engineering.

Introduced in: SIEM Query Fundamentals

Examples

Normalizing user, host, and action fields across diverse log sources.
Writing a detection against the data model that works across sources.
Recognizing common information model fields when querying.

SIEMrelates_to Kusto Query Languagerelates_to Log Source Taxonomyrelates_to Query Performancerelates_to Detection engineeringrelates_to Splunk SPLrelates_to SIEMrelates_to Structured Loggingrelates_to

SIEM Investigation Workflow

The standard pattern analysts follow to investigate alerts and incidents in a SIEM, gathering context, pivoting across data, and building a timeline using the SIEM's query and visualization tools.

SLA (Service Level Agreement) Tracking

SLA tracking measures a documented service commitment using explicit scope, start and stop events, pauses, exclusions, priority rules, data source, and owner.

SLA and Contract Risk

Risks that arise from service-level agreements and contracts, with vendors, customers, partners, that the organization must understand, monitor, and treat as part of risk management.

SMB

Server Message Block: a Windows file-sharing and inter-system protocol heavily used legitimately and heavily abused by attackers for lateral movement and remote execution.

SMB Hardening (SMBv1/Signing)

SMB hardening removes obsolete SMB dialects and requires modern protections such as signing, safe authentication, and encryption where confidentiality is needed.

SMB Lateral Movement Detection

Detecting attackers using SMB to move between hosts, by spotting unusual share access, remote command execution patterns, and anomalous SMB authentication, mapped to ATT&CK.

SMS OTP

One-time passcodes delivered via SMS as an MFA factor, widely used, easy to deploy, but weaker than modern phishing-resistant methods because SMS can be intercepted, SIM-swapped, or phished.

SMTP

Simple Mail Transfer Protocol: the protocol that moves email between servers across the internet. Foundational to email infrastructure and a target for both abuse and detection.

SNI

Server Name Indication: a TLS extension that tells the server which hostname the client is connecting to, so a single IP can host TLS certificates for many names. Defenders read SNI in traffic to identify destinations.

SNMP

Simple Network Management Protocol: a protocol for monitoring and configuring network devices, widely deployed and historically prone to weak community-string authentication that attackers exploit.

SOAR

Security Orchestration, Automation, and Response: platforms that automate SOC workflows, enrichment, containment, response steps, by linking tools together, so analysts spend less time on repetitive work.

SOAR Integration Safety

SOAR integration safety constrains automated security actions with authorization, confidence gates, dependency checks, scope limits, reversibility, expiry, rollback, failure handling, and audit records.

SOC

The team or function that monitors, detects, and responds to security threats day to day, the operational center of blue-team work. Often used as shorthand for Security Operations Center.

SOC 2

An audit framework from the AICPA that assesses a service organization's controls against the Trust Services Criteria, widely demanded by customers as evidence of security and operational maturity.

SOC 2 Cloud

Operating SOC 2 compliance in cloud environments, leveraging provider attestations for inherited controls and demonstrating customer-side controls for what shared responsibility leaves to the customer.

SOC 2 Gap Assessment

An internal assessment that compares current controls against SOC 2 Trust Services Criteria to find gaps before an external audit, so they can be remediated in time.

SOC 2 Policy Coverage

Ensuring an organization's policy set covers all areas SOC 2 expects, access control, change management, vendor risk, incident response, so audit evidence about policies is complete.

SOC 2 Policy Requirements

The specific policies SOC 2 expects to see, with content, ownership, and approvals appropriate to the Trust Services Criteria, that organizations meet to satisfy the policy side of SOC 2.

SOC 2 Program Design

The capstone exercise of designing a complete SOC 2 program, scope, controls, policies, evidence, audit plan, that demonstrates a working approach to satisfying SOC 2 end to end.