Terminology Index

Glossary

2953 terms

Incident Response Preparation

Incident response preparation establishes and tests governance, authority, roles, contacts, inventory, access, playbooks, evidence, communications, continuity, suppliers, training, and recovery capabilities.

Incident Role Activation

Incident role activation assigns accountable coordination, investigation, recording, technical ownership, evidence, continuity, legal, privacy, communications, and decision responsibilities needed for a case.

Incident Scope Hypothesis

An incident scope hypothesis is a testable statement about affected identities, assets, data, time, techniques, and access paths, with evidence that would support or contradict it.

Incident Severity

A rating of how serious an incident is, based on its impact and scope, that drives prioritization, escalation, resource allocation, and communication, so response effort matches the incident's actual significance.

Incident Severity Declaration

An incident severity declaration applies organizational criteria for observed impact, privilege, spread, business service, data, safety, disruption, and required coordination.

Incident Timeline Quality

Incident timeline quality measures whether source events, ingestion, detection, escalation, decisions, actions, validation, communications, recovery, gaps, and clock uncertainty are accurately distinguished.

Incident Timeline Reconstruction

Incident timeline reconstruction orders source events, ingestion, detection, discovery, decisions, response actions, and recovery while retaining original time, normalization, confidence, and clock limitations.

Incident-Derived Intelligence

Incident-derived intelligence turns validated procedures, infrastructure, artifacts, identity patterns, timing, and defensive observations into bounded internal or shareable information.

Indexes

Data structures in logging and SIEM platforms that organize stored events so they can be searched quickly. Indexing makes telemetry usable for detection and investigation but adds storage and cost, shaping what is kept hot.

Indicator Decay

Indicator decay is the change in an indicator's relevance as files, infrastructure, campaigns, ownership, and benign use change over time.

Indicator Extraction

Pulling concrete indicators, such as file hashes, domains, IPs, or behavioral patterns, out of a threat hunt's findings, so what the hunt discovered can be operationalized into detections and shared intelligence.

When a hunt uncovers malicious activity, indicator extraction captures the reusable signals it revealed, IOCs like hashes, domains, and IPs, and behavioral indicators of the technique, so they can be turned into detections, fed to threat intelligence, and used to sweep for the same activity elsewhere. It is a key step in converting hunt findings into lasting value, bridging the hunt's discovery to detection engineering and the finding lifecycle.

Introduced in: Threat Hunting Fundamentals

Examples

Extracting a malicious domain and hash from a hunt's findings.
Capturing a behavioral pattern to turn into a detection.
Sharing extracted indicators with threat intelligence.

Indicators of Compromiserelates_to Behavioral Operationalizationrelates_to Hunt Finding Lifecyclerelates_to DE-Hunting Interfacerelates_to IOC Operationalizationrelates_to Internal Intelligence Productionrelates_to IOC Operationalizationrelates_to Process Monitor Analysisrelates_to Ransomware Analysisrelates_to RAT Analysisrelates_to Static Analysis Fundamentalsrelates_to Stealer Analysisrelates_to Yara Rulesrelates_to Yara String Selectionrelates_to

Indicator Pivot

Using one observed indicator on a host, such as a suspicious process, path, or registry key, as a starting point to find related artifacts and expand understanding of what an attacker did on the system.

Indicator Pivoting

An analyst investigation skill of moving from one indicator to related ones, an IP to the domains it hosts, a hash to where else it appears, to expand an investigation and uncover the full scope of activity.

Indicator of Compromise

Evidence that suggests a system or account may have been compromised.

Indicator-Led Scope Expansion

Indicator-led scope expansion searches validated hashes, domains, addresses, URLs, certificates, filenames, message identifiers, and account artifacts across relevant telemetry.

Indicators of Attack

Signals that focus on attacker behavior and intent, the actions and techniques being carried out, rather than static artifacts. They detect attacks in progress even when no known indicator of compromise is present.

Indicators of Compromise

Observable artifacts that signal a system may be compromised, such as malicious file hashes, IP addresses, domains, or registry keys, used to detect, hunt for, and confirm known threats across an environment.

Industry Framework Selection

Choosing security frameworks based on an organization's industry and its specific regulatory and customer demands, since sectors like healthcare, finance, and government gravitate toward frameworks suited to their obligations.

Industry Sharing

The practice of organizations sharing threat intelligence with one another, often through industry groups like ISACs, so defenders benefit from collective knowledge of threats targeting their sector.

Industry-Specific Cloud Frameworks

Cloud compliance frameworks tailored to particular industries, such as healthcare, finance, or government cloud requirements, that an organization must meet on top of general cloud compliance when operating in a regulated sector.

Information Security Policy

The high-level policy that sets an organization's overall direction and requirements for protecting information, the foundational governance document from which more specific policies, standards, and procedures flow.

Information Stealer Analysis

Information stealer analysis identifies data stores and APIs discovered or accessed, successful collection and transformation, staging, and completed transfer by malware focused on credentials, sessions, wallets, or documents.

Infrastructure as Code

Managing infrastructure with versioned configuration files instead of only manual changes.

Ingress

Network traffic entering a network or host, inbound flows from outside. Controlling ingress with firewalls and access rules is fundamental to limiting what can reach internal systems and reducing attack surface.

Inherence Factor

An authentication factor based on something you are, a biometric trait like a fingerprint, face, or iris, used to verify identity. It is one of the three classic factor categories alongside knowledge and possession.

Inherent Risk

The level of risk that exists before any controls are applied, the raw exposure of an activity or asset on its own. It is compared with residual risk (after controls) to show how much controls reduce risk.

Inheritable Controls

Controls that a cloud customer can rely on the provider to fulfill under shared responsibility, so the customer inherits them rather than implementing them, reducing the customer's own compliance burden for those controls.

Initial Access

The first successful foothold an attacker gains in an environment.

Initial Access Hunts

Threat hunts focused on finding how attackers first got in, searching for signs of phishing payloads, exploited services, or other initial-access techniques that may have established an undetected foothold.

Initial Assessment

An analyst's first evaluation of an alert, quickly judging what it is, how urgent and severe it appears, and what to do next, to triage it efficiently before deeper investigation.

Initial Communication

The first communications sent when an incident is confirmed, notifying the right internal people and stakeholders that an incident is underway, establishing channels and cadence so coordination starts on the right foot.

Initial Response

The first hands-on actions taken once an incident is confirmed, stabilizing the situation, beginning containment where needed, preserving evidence, and mobilizing responders, before the fuller investigation and response unfold.