Terminology Index

Glossary

2953 terms

Internet Exposure

The degree to which an organization's systems and services are reachable from the public internet, a primary attack surface, since anything exposed can be discovered and attacked, so minimizing exposure is core to hardening.

Internet Routing

Exchange and selection of reachability information across autonomous systems, commonly using BGP, whose paths do not by themselves establish endpoint identity or trust.

Investigation

A structured review of evidence to determine what happened and what to do next.

Investigation Confidence State

An investigation confidence state labels a finding with a defined level of support, its evidence, uncertainty, alternatives, and conditions that would change the conclusion.

Investigation Expansion

Broadening an investigation as new leads emerge, following indicators and behaviors to additional systems, accounts, and activity, so the full scope of an incident is uncovered rather than just the initial alert.

Investigation Limitation Statement

An investigation limitation statement identifies unavailable, incomplete, unreliable, filtered, or expired evidence and the conclusions that the gap weakens.

Investigation Notes

The contemporaneous record an analyst keeps during an investigation, what was checked, found, and concluded, so the work is documented, defensible, shareable in handoffs, and useful for review and lessons learned.

Investigation notes capture the analyst's process and findings as they go: queries run, evidence found, reasoning, and conclusions. Good notes make an investigation reproducible and defensible, enable clean handoffs to other analysts or shifts, support escalation and reporting, and feed post-incident review. They are a discipline that separates rigorous investigation from undocumented effort, and they matter especially when a case becomes a formal incident with legal weight.

Introduced in: SOC Analyst Fundamentals

Examples

Recording queries run and evidence found as an investigation proceeds.
Documenting reasoning so a handoff preserves context.
Keeping notes that support escalation and later review.

Investigation Scoperelates_to Handoffrelates_to Evidence Collectionrelates_to Dispositionrelates_to Post-Incident Reviewrelates_to IR-SOC Boundaryrelates_to Investigation Scoperelates_to Knowledge Capturerelates_to

Investigation Question Log

An investigation question log records each material unknown, why it matters, planned evidence sources, query or action, result, confidence, and next pivot.

Investigation Scope

The defined boundaries of an investigation, which systems, accounts, time range, and questions it covers, kept deliberate so the analyst neither misses relevant activity nor wanders into unbounded, unfocused effort.

Investigation Workflow

An investigation workflow validates the alert logic and raw evidence, expands the timeline, corroborates independent sources, evaluates alternative explanations, preserves evidence, and documents the conclusion and uncertainty.

Isolation

Separating processes, users, or systems so they cannot interfere with or access one another, an operating-system and security principle that limits how far a compromise can spread and what a process can reach.

Issue Validation and Closure

Issue validation and closure independently confirm that an agreed action was implemented and that the affected control objective now operates as intended within a stated scope and period.

Istio

A popular service mesh for Kubernetes that manages and secures communication between microservices, providing mutual TLS, fine-grained authorization, and traffic control without changing application code.

JWT

JSON Web Token: a compact, self-contained token format that carries claims (such as identity and permissions) in a signed, and optionally encrypted, structure, widely used for authentication and authorization in web and API systems.

Join Semantics

Join semantics define which rows survive a table combination and how duplicate key matches expand, exclude, or preserve results.

Joiner Mover Leaver

The identity-lifecycle pattern for creating access when a person joins, updating it when duties change, and removing or transferring it when the relationship ends.

Joiner Mover Leaver Governance

Joiner mover leaver governance maps approved identity state changes to timely, least-privileged access additions, modifications, removals, ownership transfers, and verified target outcomes.

Joiner Process

A joiner process creates and activates an identity and its approved baseline access when a person or workload begins a valid relationship with an organization.

Joiner-Mover-Leaver

The model describing the three key transitions in the identity lifecycle, joining (onboarding and provisioning access), moving (role changes and access adjustment), and leaving (deprovisioning), that access management must handle reliably.

Journalctl

The command-line tool for querying the systemd journal on Linux, the centralized log of system and service events. Defenders use it to investigate activity, service behavior, and signs of compromise on Linux hosts.

Jump Server

An intermediary system through which authorized administrators reach protected systems, with strong authentication, tiering, session controls, and monitoring required.

Jump Servers

Hardened intermediary hosts that administrators must connect through to reach sensitive systems, concentrating and controlling administrative access so it can be monitored, restricted, and kept off the general network.

Just Culture

An organizational culture that responds to mistakes by learning rather than blaming, distinguishing honest error from recklessness, so people report incidents and problems openly instead of hiding them out of fear.

Just-In-Time Access

Temporary access granted only when needed and removed afterward.

Just-in-Time (JIT) Access

Just-in-Time access grants a defined privilege only when it is needed and removes it after a bounded task or duration.

Just-in-Time Learning

Delivering security education at the moment it is relevant, such as a brief prompt when a risky action occurs, rather than only in scheduled training, so guidance lands when it is most likely to change behavior.

Just-in-Time Privileged Access

Granting privileged access only for the moment it is needed and automatically revoking it afterward, rather than leaving standing admin rights, so the window an attacker could abuse privileged accounts is minimized.

KEV Catalog

CISA's Known Exploited Vulnerabilities catalog of vulnerabilities with evidence of exploitation, used with applicable directives, due dates, asset validation, and local prioritization.

KPI and KRI Context

KPI and KRI context defines whether a measure tracks execution or signals exposure and records its objective, population, period, threshold, owner, source, limitation, and action.

KPIs

Key performance indicators: metrics that measure how well a security program or function is performing against its objectives, used to track effectiveness, demonstrate value, and guide improvement.

KRBTGT Double-Reset

A krbtgt double-reset rotates an Active Directory domain's Kerberos ticket-signing account twice so compromised key material leaves the current-and-previous-key validation window.

KRIs

Key risk indicators: metrics that signal changes in risk exposure, giving early warning when a specific risk is increasing so the organization can act before it materializes. The abbreviation of key risk indicators.