Terminology Index

Glossary

2953 terms

Detection Research

The investigative work a detection engineer does to understand an attacker technique before building a detection, studying how it behaves, what telemetry it generates, and how attackers vary and evade it.

Detection Response Contract

A detection response contract defines where a match goes, how it is routed, what context is required, when it is acknowledged or escalated, and what validation, containment, preservation, and closure actions apply.

Detection Robustness

How resistant a detection is to evasion and to breaking, a robust detection keys on hard-to-change attacker behavior rather than superficial, easily altered indicators, so attackers cannot trivially bypass it.

Detection Rule Specification

A detection rule specification documents the rule's hypothesis, owner, version, mappings, telemetry, schema, logic, timing, entities, tuning, enrichment, severity, confidence, response, tests, limitations, and history.

Detection Severity and Confidence

Detection severity and confidence separate plausible consequence from the strength and completeness of evidence supporting the detection hypothesis.

Detection Specificity

How precisely a detection targets malicious activity without flagging benign behavior, high specificity means few false positives, because the detection fires narrowly on what is actually suspicious.

Detection Strategy

The overall plan guiding what a team detects and how, defining priorities, the balance of detection types, coverage goals, and how detection effort aligns with the organization's threats and risk.

Detection Strategy and Analytic Distinction

The detection strategy and analytic distinction separates a high-level approach for detecting behavior from the platform-specific logic and Data Components used to implement that approach.

Detection Test Plan

A detection test plan defines positive, negative, boundary, variation, telemetry-loss, suppression, and response cases with preconditions, expected events, results, cleanup, and pass criteria.

Detection Testing

Verifying that a detection works by running the targeted technique, or a safe simulation of it, and confirming the detection fires as intended while gauging its false-positive behavior, before relying on it.

Detection Threshold Calibration

Detection threshold calibration selects and revises cutoffs using representative history, telemetry-quality checks, known attack tests, and an explicit alert-volume or response objective.

Detection Validation

Detection validation demonstrates that an analytic receives the required telemetry, identifies defined test behaviors, preserves expected benign workflows, and produces useful alert context within operational limits.

Detection Validation Dataset

An authorized set of expected-positive, benign, edge, and failure cases used to test telemetry and detection behavior.

Detection Version Control

Detection version control manages queries, metadata, tests, mappings, suppressions, playbooks, and deployment configuration through reviewed, attributable, reversible changes.

Detection and Analysis

The incident-response phase where a potential incident is detected, validated, and analyzed to understand its nature and scope, turning an initial signal into a confirmed, understood incident that response can act on.

Detection engineering

The practice of designing, testing, and improving logic that identifies suspicious activity.

Introduced in: Detection Engineering, Blue Team Operations, Logging, Monitoring, and Telemetry

Adversary Emulationrelates_to Atomic Red Teamrelates_to Blue Teamrelates_to Continuous Improvementrelates_to Coverage Metricsrelates_to Data Lakesrelates_to DE Skillsrelates_to DE-Adjacent Rolesrelates_to DE-Hunting Interfacerelates_to DE-SOC Interfacerelates_to Detection and Analysisrelates_to Detection Communityrelates_to Detection Engineerrelates_to Functional Exercisesrelates_to Indexesrelates_to IOC Operationalizationrelates_to Playbook Developmentrelates_to Proactive vs Reactiverelates_to Purple Team Exercisesrelates_to Query Tuningrelates_to Regression Testingrelates_to Response Automationrelates_to Rule Logic Designrelates_to Security Engineeringrelates_to Serverless Detectionrelates_to SIEMrelates_to SIEM Data Modelsrelates_to Sigma Rulesrelates_to SOC-Engineering Interfacerelates_to Sysmonrelates_to Tactical Intelligencerelates_to Telemetry Gapsrelates_to Threat Huntersrelates_to Threat Huntingrelates_to Threat to Detectionrelates_to TI to Adjacent Rolesrelates_to Tool Integrationrelates_to Cloud Audit Logrelates_to

Detection-as-Code

Managing detections like software, defined in code, version-controlled, peer-reviewed, tested in pipelines, and deployed automatically, so detection engineering gains the rigor, repeatability, and collaboration of modern software development.

Detective Control

A control designed to notice suspicious, unwanted, or policy-breaking activity.

Detective Controls

Security controls that identify and signal that an incident is happening or has happened, such as logging, monitoring, intrusion detection, and alerting. They do not prevent attacks but enable timely response.

Deterrent Control

A control that discourages unwanted behavior by increasing risk or friction for misuse.

Deterrent Controls

Security controls that discourage an attacker from attempting an attack by raising the perceived risk or effort, such as warning banners, visible monitoring, or signs of strong security, working through psychology rather than technical blocking.

DevSecOps Outcome Metrics

DevSecOps outcome metrics measure verified risk reduction and control reliability alongside the effect security work has on software delivery.

DevSecOps Principles

The core ideas behind building security into software delivery: shift security left, automate it in the pipeline, share responsibility across dev, sec, and ops, give fast developer feedback, and treat security as a continuous part of building software.

Developer Security Feedback

Giving developers fast, clear, actionable security feedback within their existing workflow, in the IDE, pull request, or pipeline, so they can fix issues immediately rather than learning about them late from a separate security team.

Device Compliance Integration

Tying access decisions to a device's compliance state in zero trust, so that only devices meeting security requirements (patched, encrypted, managed, healthy) are allowed access, and non-compliant ones are blocked or restricted.

Device Posture Signals

Device posture signals are time-bounded observations about asset identity, management, platform, configuration, encryption, integrity, endpoint protection, vulnerability, and incident state.

Device Trust in ZTA

The zero-trust principle that a device's identity and security posture must be established and continuously verified before it is trusted to access resources, so access depends on the device, not just the user.

Diffie-Hellman

A key-exchange method that lets two parties establish a shared secret over an insecure channel without ever transmitting the secret itself, foundational to setting up encrypted connections like TLS.

Digital Signature

A cryptographic proof that data came from a private key holder and has not changed.

Digital Signatures

A cryptographic technique that proves a message or file came from a specific signer and was not altered, by signing with a private key that anyone can verify with the matching public key. It provides authenticity, integrity, and non-repudiation.

Directory Service

A system that stores and organizes identity, device, and access information.

Directory Services

Systems that store and organize identity information, accounts, groups, attributes, and devices, and answer authentication and lookup requests, serving as the authoritative source of identities for an organization. Active Directory is the classic example.