Glossary

Action Items

The concrete follow-up tasks that come out of a post-incident review, each describing a specific improvement, such as a configuration change, new detection, or process update, meant to reduce the chance or impact of a future incident.

Action-Oriented Reporting

A style of risk reporting that frames findings around the decisions and actions the audience can take, rather than just listing data. It tells leaders what changed, why it matters, and what to do next.

Activation Decisions

The judgment calls about whether and when to formally declare an incident and stand up the response process, including who has authority to activate and what thresholds trigger it.

Active Directory

A directory service commonly used to manage Windows identities, devices, and policy.

Active Directory Security

The practice of protecting Microsoft Active Directory, the on-premises identity service that authenticates users and controls access across most enterprise networks. Because nearly everything trusts it, compromising AD often means compromising the whole environment.

Active Directory Security Architecture

The structural design choices that make Active Directory defensible, such as administrative tiering, forest and domain trust boundaries, privileged access workstations, and the placement of controls that limit how far an attacker can move after a foothold.

Actor Profiling Use

Applying knowledge of a specific threat actor, such as their goals, typical tools, and behaviors, to make SOC work sharper, like prioritizing the detections and hunts most relevant to adversaries that actually target your organization.

Actor-Based Hunting

A threat-hunting approach that builds hypotheses around a specific adversary, searching for the tools, techniques, and behaviors that group is known to use, rather than hunting for generic anomalies.

Ad-Hoc Requirements

One-off intelligence questions that arise outside the standing set of priority requirements, such as an urgent request to learn more about a threat actor newly seen in your environment. They need a fast, focused answer rather than ongoing collection.

Adequacy Decision Verification

Adequacy decision verification confirms that a current official Article 45 decision covers the destination, exact recipient category or entity, and planned transfer.

Admin Consent (OAuth Apps)

Admin consent approves an application's requested delegated or application permissions on behalf of an organization in an OAuth-based platform.

AdminSDHolder Abuse

AdminSDHolder abuse changes the protected-object security template so SDProp can propagate attacker-controlled permissions to privileged Active Directory users and groups.

Administrative Control

A governance or people-oriented control such as policy, approval, training, review, contractual requirement, or separation of duties.

Administrative Controls

Security measures based on policies, procedures, and people rather than technology, such as security awareness training, access review processes, hiring background checks, and acceptable-use policies. They direct how people should behave to keep systems safe.

Administrative Tool Context

Administrative tool context distinguishes expected from concerning dual-use activity through source, identity, target, time, approval, artifact provenance, parent process, command purpose, and subsequent actions.

Administrator

A highly privileged user who can change important system or application settings.

Admission Control

A gatekeeping step that checks whether a workload, image, or change is allowed to run before it is admitted into an environment, blocking anything that fails policy such as an unsigned container image or one with critical vulnerabilities.

Admission Controllers

Kubernetes components that intercept requests to the cluster's API server and can validate or modify them before objects are created, letting security teams enforce policy such as blocking privileged pods or requiring trusted images.

Advanced Audit Policy Configuration

Advanced Audit Policy Configuration is the granular Windows policy framework for choosing security-audit subcategories and whether successful or failed activity is recorded.

Adversary Emulation

Safely reproducing the specific techniques a real threat actor uses to test whether your defenses detect and stop them. Unlike a broad penetration test, it follows a known adversary's playbook to validate detection coverage.

Affected-Product Verification

Affected-product verification establishes that the named product, component, version, platform, feature, and required vulnerable condition are present in the identified asset or artifact.

Agent and Agentless Coverage

Agent and agentless coverage compares collection source, location, freshness, depth, workload overhead, provider-resource use, privileges, blind spots, supported response, and failure behavior.

Agent vs Agentless

Two ways to gather security data from cloud workloads. Agent-based methods install software on each workload for deep, real-time visibility, while agentless methods scan workloads from outside (for example via snapshots or APIs) for broad, low-friction coverage.

Alert Design

Deciding how a detection turns into an actionable alert: what conditions trigger it, what context it carries, how severe it is, and how it routes to analysts, so that the alert is meaningful and not lost in noise.

Alert Evidence Corroboration

Alert evidence corroboration tests a detection summary against independent raw process, identity, network, file, email, application, threat, and sensor-health evidence.

Alert Fatigue Condition

A system condition where alert volume, repetition, weak context, unclear ownership, or low actionability impairs sustained attention.

Alert Management Design

The design of how a security operations center handles its stream of alerts end to end: how alerts are prioritized, routed, assigned service-level targets, and escalated, so analysts work the most important things first without drowning.

Alert Precision

The fraction of generated alerts confirmed as true positives, calculated as true positives divided by true positives plus false positives.

Alert Queue Health

Evidence that alerts reach the intended queue, remain visible, receive ownership, and progress under defined priorities.

Alert Routing

Alert routing assigns security work to a capable, available, and authorized owner using priority, service, platform, region, sensitivity, and capacity.

Alert Triage

The first analytical step after an alert fires: quickly assessing what it is, whether it is a real threat or a false positive, and how urgent it is, so the right ones move into deeper investigation.