Terminology Index

Glossary

2953 terms

Initial Scoping

Determining the breadth of an incident early on, which systems, accounts, and data are affected and how far the compromise reaches, so response is sized correctly and nothing affected is missed.

Initial Stakeholder Handoff

An initial stakeholder handoff gives the responsible incident role a compact evidence-labeled summary of observations, confidence, affected entities, actions, active risks, gaps, and required decisions.

Injection

A class of web vulnerabilities where untrusted input is interpreted as commands or code, such as SQL or command injection, letting an attacker alter queries or execute unintended actions. Input validation and parameterization are the defenses.

Injection Testing Safety

Injection testing safety limits authorized probes to the least harmful input and environment needed to determine whether untrusted data reaches an interpreter unsafely.

Input Validation

Checking external input against expected rules before the application trusts or stores it.

Insecure Randomness

Random or pseudorandom output with insufficient unpredictability, entropy, uniqueness, or state protection for its security-sensitive purpose.

Insider Activity Alert

An alert involving behavior by an authorized identity that may indicate mistake, compromise, policy violation, negligence, or malicious intent without prejudging which explanation is true.

Insider Activity Alerts

SOC alerts flagging potentially malicious or risky behavior by insiders, employees or contractors, such as unusual data access, policy violations, or signs of misuse, that analysts triage with care given the human and legal sensitivity.

Insider Risk

The risk posed by people inside the organization, employees, contractors, partners, who through malice, negligence, or compromise could harm security. It spans the full range from accidental mistakes to deliberate sabotage or theft.

Insider Threat

The potential for a person or identity with authorized access or organizational knowledge to cause harm intentionally, negligently, accidentally, or through compromise.

Insider Threat Response

The response to a confirmed or suspected insider threat, handled with special care for evidence, legal involvement, and discretion, since the subject is a trusted person with legitimate access and the matter carries HR and legal weight.

Insider Threats

Threats that come from people with legitimate access, malicious insiders stealing or sabotaging, negligent insiders causing accidental harm, or compromised insiders whose access an attacker has hijacked. They bypass perimeter defenses.

Instance Identity and Metadata Protection

Instance identity and metadata protection limits a virtual machine's cloud permissions and hardens the service and network path that provide temporary credentials and configuration.

Integration Data Governance

Integration data governance controls what a compliance integration may collect, transform, store, expose, and retain from connected systems.

Integrity

Integrity means information or systems remain accurate, complete, and protected from unauthorized change.

Intelligence Cycle

The structured process of producing threat intelligence, planning and direction, collection, processing, analysis, and dissemination, that turns raw data into finished intelligence and feeds back into new requirements.

Intelligence Integration

Weaving threat intelligence into all SOC functions, detection, triage, hunting, and incident response, so intelligence actively shapes operations rather than sitting in isolated reports. It is what makes a SOC threat-informed.

Intelligence Reports

The finished intelligence products a SOC produces or consumes, written assessments of threats, actors, campaigns, or indicators, tailored to an audience so decision-makers and operators can act on the analysis.

Intelligence Requirements

The defined questions an intelligence effort sets out to answer, what the organization needs to know about threats to make decisions, that direct collection and analysis so intelligence is purposeful rather than aimless.

Intelligence in Detection

Applying threat intelligence to detection, using knowledge of adversary indicators and techniques to build, prioritize, and enrich detections, so the SOC catches what intelligence says is actually threatening it.

Intelligence in Hunting

Using threat intelligence to drive threat hunting, letting knowledge of adversaries and their techniques generate hunt hypotheses and focus hunts on the threats most likely to target the organization.

Intelligence in IR

Applying threat intelligence during incident response, using knowledge of adversaries and their TTPs to understand an incident, anticipate the attacker's next moves, and respond more effectively.

Intelligence in Triage

Using threat intelligence during alert triage, enriching alerts with intelligence about indicators, actors, and techniques so analysts can judge severity and prioritize faster and more accurately.

Intelligence-Driven Hunting

A hunting approach that starts from threat intelligence, using knowledge of a specific adversary, campaign, or technique to drive a focused hunt for that threat in the environment, contrasted with data-driven hunting.

Intermediate CA

A certificate authority that sits between the trusted root CA and end-entity certificates in a chain of trust. Roots sign intermediates, which sign certificates, so the root's key can stay offline and protected.

Internal Audit

An independent, in-house function that examines an organization's controls, risks, and processes and reports assurance to leadership and the board, helping verify that governance and controls actually work, framed here as a GRC partner.

Internal Audit Career

A career in internal audit, progressing from staff auditor through senior, manager, and audit leadership (such as chief audit executive), building independent assurance skills across an organization's risks and controls.

Internal Audit Charter

The formal document that establishes an internal audit function's purpose, authority, scope, and independence, approved by the board or audit committee, giving the function its mandate to operate and access what it needs.

Internal Audit Function

The organizational unit that performs internal audit, its people, structure, mandate, and processes, providing independent assurance over controls, risk, and governance to management and the board.

Internal Intelligence

Threat intelligence derived from an organization's own data, its incidents, alerts, logs, and observed attacks, which is highly relevant because it reflects the threats actually targeting that specific environment.

Internal intelligence is generated from the organization itself: indicators and TTPs seen in its own incidents, patterns in its telemetry, and lessons from past attacks. Because it reflects threats that have actually reached the organization, it is often the most relevant intelligence of all, complementing external sources. A SOC harvests internal intelligence from its operations and feeds it back into detection, hunting, and response, closing the loop between what it experiences and how it defends.

Introduced in: Threat Intelligence for SOC Analysts

Examples

Deriving indicators from the organization's own past incidents.
Using patterns in internal telemetry as threat intelligence.
Feeding lessons from a handled attack back into detection.

Internal Intelligence Productionrelates_to Open Source Intelligencerelates_to Indicators of Compromiserelates_to Intelligence Cyclerelates_to Industry Sharingrelates_to Pivotingrelates_to Internal Intelligence Productionrelates_to Intelligence-Driven Huntingrelates_to

Internal Intelligence Production

The process of generating threat intelligence from an organization's own operations, systematically capturing indicators, TTPs, and lessons from incidents and telemetry and turning them into reusable, shareable intelligence.

Internal Stakeholder Communication

Communicating with internal parties during an incident, IT, affected business units, leadership, legal, and staff, keeping the right people informed and coordinated so the organization responds as one.