Glossary

Alert Triage Methodology

A repeatable, structured way to triage alerts, defining the questions to ask, the context to gather, and the criteria for deciding an alert's disposition, so triage stays consistent across analysts and shifts.

Alert Volume

The total number of alerts a monitoring system generates over time. When volume outpaces the team's capacity, important alerts get buried and analysts experience fatigue, so managing volume is central to effective detection.

All-Hazards Planning

Continuity planning based on the consequences and capabilities a disruption creates rather than relying on a separate plan for every possible cause.

Allowlist Governance

Allowlist governance manages detection exceptions as narrow, evidenced, approved, monitored, owned, and time-bounded changes.

Allowlist Management

The disciplined practice of maintaining the exceptions that tell a detection to ignore specific known-benign activity, so that tuning down noise does not silently create blind spots attackers can hide in.

Allowlist Validation

An input-handling defense that checks user input against a list of explicitly permitted values or patterns and rejects everything else, rather than trying to block known-bad input. It is the safer default for validating untrusted data.

Alternative Hypothesis Testing

Deliberate search for evidence that distinguishes a leading explanation from plausible benign, accidental, or different malicious explanations.

Analysis Documentation

Recording how a risk analysis was performed, including the assumptions, data sources, methods, and reasoning behind each estimate, so the conclusions can be understood, defended, and revisited later.

Analyst Career Ladder

An analyst career ladder defines observable competencies, scope, authority, support, and transparent advancement criteria across technical and leadership paths.

Analyst Career Scenarios

Realistic examples of analyst responsibilities, decisions, constraints, evidence, communication, and progression used to compare roles and build relevant skills.

Analyst Development

The growth of a security analyst's skills over time, from following playbooks toward independent investigation, hunting, and mentoring, built through hands-on incident experience and reflection.

Analyst Shift

A scheduled period of security-operations responsibility with defined queue ownership, escalation coverage, handoff, staffing, and fatigue controls.

Analyst Shifts

How SOC analyst coverage is scheduled across hours and days, such as rotating shifts or follow-the-sun staffing, to keep monitoring running while managing fatigue and handoffs between analysts.

Analyst Specialization

The way SOC analysts develop deeper expertise in particular areas, such as malware analysis, cloud, identity, or detection engineering, instead of all analysts handling everything at the same level.

Analyst vs Adjacent Roles

The distinction between a security analyst and neighboring roles like SOC analyst, penetration tester, incident responder, or engineer, clarifying what an analyst owns (assessing and communicating risk) versus what overlapping roles do.

Analyst-Client Relationship

The working relationship between a security assessor and the team being assessed, spanning expectation-setting at kickoff, communication during the engagement, and follow-up on remediation, so findings are received and acted on rather than resisted.

Analytical Thinking for Security

The disciplined reasoning a security analyst applies to evidence: forming hypotheses, weighing what the data supports, avoiding bias, and drawing conclusions that hold up. It is the core mental skill behind good assessment and investigation.

Analytical Tradecraft

The professional standards intelligence analysts use to produce sound, trustworthy assessments: distinguishing fact from inference, expressing confidence honestly, considering alternatives, and sourcing claims clearly.

Annual Review Cycle

A scheduled, recurring review of security policies, typically yearly, to confirm each one is still accurate, relevant, and aligned with current risks and regulations, updating or retiring those that are out of date.

Anomaly Detection

Finding activity that differs from an expected pattern or baseline.

Anomaly Detection (Identity)

Detection of identity behavior that differs from a defined baseline or peer expectation, treated as a signal requiring contextual validation rather than proof of compromise.

Anti-Analysis Awareness

Anti-analysis awareness considers whether timing, user interaction, hardware, locale, domain state, tooling, debugger checks, missing inputs, or dead infrastructure changed the behavior observed in a lab.

App Registration Security

Securing application registrations in Microsoft Entra ID (Azure AD), the entries that let apps authenticate and request permissions. Over-permissioned or stale registrations and their secrets are a common cloud-identity attack path.

Applicability Determination

An applicability determination records why an obligation applies, does not apply, or needs qualified review for defined entities, processing, products, data, locations, and relationships.

Application Access Mediation

Application access mediation authenticates, authorizes, constrains, monitors, and terminates access where application identities and operations are visible.

Application Allowlisting

An endpoint control that allows only explicitly approved programs to run and blocks everything else, sharply reducing what malware can execute even if it lands on a machine.

Application Attack Surface Mapping

Application attack surface mapping inventories reachable clients, routes, APIs, roles, tenants, files, jobs, webhooks, administrative functions, dependencies, data types, and error or recovery flows.

Application Hardening

Configuring an application and its supporting services to reduce their attack surface: disabling unused features, removing default accounts and sample content, suppressing version banners, and applying secure settings and patches.

Application Protocol

Rules and message formats used by applications to communicate over a transport, such as HTTP, DNS, SMTP, SSH, or database protocols.

Application Security Logging

Purpose-designed application events for security-relevant decisions and actions, using stable meanings while excluding unnecessary secrets.

Approval Evidence

Approval evidence proves who made an access decision, under what authority, for which exact subject, entitlement, duration, context, conflicts, and conditions.