Glossary

Hot Standby

A disaster-recovery setup where a fully running duplicate system stands ready to take over almost instantly if the primary fails, giving very fast recovery at higher cost than colder standby options.

Hot and Archive Tier

An architecture that separates frequently queried telemetry from slower or less expensive retained storage with tested restoration behavior.

Hot vs Cold Storage

The tradeoff in log and data storage between hot storage, fast and immediately searchable but costly, and cold storage, cheap for long retention but slow to access, used to balance cost against analysis needs.

HttpOnly Flag

A cookie attribute that prevents JavaScript from reading the cookie, so that even if a site has a cross-site scripting flaw, an attacker's script cannot steal the protected cookie, such as a session token.

Human Factors

The ways cognition, workload, incentives, interfaces, training, culture, authority, communication, and organizational design influence secure or unsafe behavior.

Human Review and Automation Boundaries

Human review and automation boundaries assign deterministic, tested governance actions to automation while reserving ambiguous, conflicted, or high-impact decisions for accountable judgment.

Human-in-the-Loop Containment

Human-in-the-loop containment presents an authorized responder with validated evidence, the exact proposed action, likely blast radius, reversibility, expiry, and rollback before consequential automation executes.

Hunt After Eradication

Proactively hunting through the environment after eradicating a threat to confirm the attacker is truly gone and has left no overlooked foothold, rather than assuming eradication was complete.

Hunt Alternative Explanation

A hunt alternative explanation is a plausible benign or different security interpretation tested with independent identity, change, artifact, ownership, and behavior evidence.

Hunt Attribution Boundary

The hunt attribution boundary separates evidence of behavior, infrastructure, and procedural consistency from the specialized conclusion that a particular actor is responsible.

Hunt Authority

Hunt authority defines the systems, data, queries, enrichment, active tests, collection, retention, sharing, and escalation actions permitted during a threat hunt.

Hunt Baseline Window

A hunt baseline window is the documented period and operating conditions used to estimate expected behavior, including seasonality, changes, incidents, sensor state, and retention.

Hunt Behavior Abstraction

Hunt behavior abstraction represents security-relevant action, subject, object, sequence, context, and outcome without depending unnecessarily on one tool name or exact string.

Hunt Conclusion

The closing stage of a threat hunt, where findings are assessed against the hypothesis, a verdict is reached (threat found or not), and outcomes, new detections, leads, or assurance, are determined and recorded.

Hunt Context Enrichment

Hunt context enrichment adds time-bound, sourced information such as ownership, role, exposure, privilege, signer, prevalence, change, vulnerability, reputation, or intelligence to an observation.

Hunt Documentation

Recording a threat hunt, its hypothesis, data examined, methods, findings, and outcome, so the work is repeatable, its value is captured, and lessons (including new detections) carry forward.

Hunt Escalation Package

A hunt escalation package gives responders supported facts, entities, timeline, evidence references, queries, confidence, impact and scope hypotheses, preservation needs, active risk, and prior actions.

Hunt Evidence Ledger

A hunt evidence ledger links material observations and conclusions to source records, queries, stable entities, timestamps, enrichment, handling, interpretation, and limitations.

Hunt Evidence Plan

A hunt evidence plan maps each analytic question to required events, fields, entities, context, collection points, retention, enrichment, and validation.

Hunt Evidence Standard

A hunt evidence standard defines what turns an initial candidate into a malicious, benign, policy-violating, or inconclusive finding.

Hunt Exclusion Governance

Hunt exclusion governance requires every filter or allowlist to have a narrow basis, owner, evidence, scope, review date, expiry, and method for detecting drift or abuse.

Hunt Execution

The active phase of a threat hunt, where the hunter queries data, applies analysis techniques, and follows leads to test the hypothesis, turning the hunt plan into hands-on investigation of the environment.

Hunt Exit Criteria

Hunt exit criteria define when a hunt concludes, refines, pauses, or transfers based on completed analysis, unresolved candidates, time, visibility, or incident escalation conditions.

Hunt Finding Confidence

Hunt finding confidence communicates how strongly evidence supports an observation or conclusion, which alternatives and gaps remain, and what would change the assessment.

Hunt Finding Escalation

Hunt finding escalation moves a lead into incident scope when evidence meets defined suspected or confirmed criteria and updates containment, preservation, ownership, timeline, and impact workstreams.

Hunt Finding Lifecycle

The path a threat-hunt finding follows after discovery, from validation and triage through escalation, operationalization into a detection, or recording as assurance, so what a hunt uncovers turns into lasting value.

Hunt Hypothesis

A specific, testable statement of what malicious activity might be present and how it would show up in data, that drives a threat hunt, giving it a clear question to investigate rather than aimless searching.

Hunt Hypothesis Library

A curated, reusable collection of hunt hypotheses an advanced hunting program maintains, so proven and candidate hunt ideas are organized, prioritized, and repeatable rather than reinvented each time.

Hunt Identifier Integrity

Hunt identifier integrity preserves stable entity identifiers and mapping logic across people, accounts, sessions, devices, processes, workloads, resources, applications, addresses, and data.

Hunt Intelligence Relevance

Hunt intelligence relevance evaluates whether reporting applies to local technology, identity, geography, sector, exposure, data, and threat models while retaining source, age, confidence, and bias.

Hunt Knowledge Base

A hunt knowledge base preserves reviewed questions, data assumptions, query versions, validation cases, exclusions, results, decisions, and reusable follow-up knowledge.