Terminology Index

Glossary

2953 terms

Quantitative Risk Skepticism

Healthy skepticism toward quantitative risk results, recognizing input uncertainty, model limits, and the risk of false precision, so numbers inform rather than mislead decisions.

Quantitative Risk Value

The reasons to use quantitative risk methods, comparability, aggregation, dollar-level decision-making, defensibility, that justify investing the extra effort beyond qualitative analysis.

Query Performance

How fast and efficiently SIEM queries return results. Good performance is essential to detection, hunting, and investigation, since slow queries throttle analyst workflow and degrade SOC effectiveness.

SIEM query performance depends on data volumes, schema design, indexing, and how queries are written. Slow queries cost analyst time, delay triage, make ad-hoc hunting impractical, and can crowd out other workloads on the platform. Designing efficient queries (and indexing the right fields) is a foundational SIEM skill that scales with data growth, and it ties closely to query tuning. Good performance is what makes a SIEM usable in practice, not just in principle.

Introduced in: SIEM Query Fundamentals

Examples

Refactoring a slow query to return results in seconds rather than minutes.
Indexing fields used in filters to speed queries.
Recognizing slow queries as throttling SOC workflow.

Query Tuningrelates_to Indexesrelates_to Kusto Query Languagerelates_to Hot vs Cold Storagerelates_to SIEMrelates_to Query Tuningrelates_to SIEM Data Modelsrelates_to Splunk SPLrelates_to Structured Loggingrelates_to Telemetry Volumerelates_to

Query Reproducibility

Preservation of query text, time interpretation, data scope, relevant versions, and execution context so another analyst can reconstruct a result.

Query String

The part of a URL after the question mark that carries named parameters and values. Defenders read query strings to understand requests and to spot injection or tampering attempts in web traffic.

Query Tuning

The practice of refining SIEM queries to run faster, return more relevant results, and consume fewer resources, by reordering filters, narrowing time ranges, and reshaping logic.

Queue Management

The discipline of managing the SOC's alert queue, prioritizing, batching, and clearing items so the team handles the most important alerts in time without burning out or letting noise accumulate.

RAT Analysis

Analyzing Remote Access Trojan (RAT) samples to understand their command-and-control, capabilities, and persistence, producing indicators and detections for these long-running, attacker-controlled implants.

RBAC

Role-Based Access Control: an access model where permissions are assigned to roles, and users are granted access by being assigned roles, simplifying administration and supporting least privilege at scale.

RBAC at Scale

The challenges and patterns for using role-based access control across large cloud-native environments, role explosion, drift, and complexity, that require deliberate design and ongoing governance to keep RBAC working.

RBAC, ABAC, and ReBAC Authorization Models

RBAC grants permissions through roles, ABAC evaluates subject, resource, action, and environmental attributes, and ReBAC evaluates relationships such as owner or member.

RDP

Remote Desktop Protocol: Microsoft's protocol for graphical remote access to Windows systems. Widely used by admins and frequently abused by attackers for lateral movement and initial access when exposed.

RDP Lateral Movement Detection

Detecting attackers using RDP to move between hosts, by spotting anomalous interactive logons, unusual source-to-destination patterns, and unexpected use of administrative accounts over RDP, mapped to ATT&CK.

REST API Security Testing

Penetration testing focused on REST APIs, examining authentication, authorization, input handling, business logic, rate limiting, and data exposure to find vulnerabilities specific to API surfaces.

RPA Credentials

RPA credentials are passwords, tokens, certificates, or delegated identities used by robotic process automation bots to access applications and perform business tasks.

RSA

A widely used asymmetric (public-key) cryptography algorithm based on the difficulty of factoring large numbers, foundational to TLS, signatures, and PKI alongside newer alternatives like elliptic-curve cryptography.

Rainbow Table

A precomputed time-memory tradeoff structure for reversing unsalted password hashes; unique salts make broad table reuse impractical but do not stop guessing.

Rainbow Tables

Precomputed tables that reverse cryptographic hashes (especially of passwords) back to their inputs by trading storage for computation. Salting defeats them, which is why every password hash must be salted.

Ransom Decision Governance

Ransom decision governance defines who may decide, which legal and sanctions checks apply, and what recovery, safety, business, insurance, law-enforcement, and stakeholder evidence is required.

Ransomware

Malware that disrupts access to systems or data and demands payment.

Ransomware Analysis

Examining ransomware samples to understand how they encrypt, persist, communicate, and demand payment, producing indicators and detections, and informing both response and prevention.

Ransomware Analysis Safety

Ransomware analysis safety treats loaders, droppers, encryptors, scripts, and companion tools as potentially destructive and prioritizes containment over complete characterization.

Ransomware Recovery Design

Designing recovery so it can actually withstand ransomware, immutable backups, isolation, tested restoration, prioritization, since ransomware recovery is where many BC/DR plans first really break.

Ransomware Response

The incident-response approach for a ransomware event, containing spread, deciding on payment under legal guidance, restoring from backups, and coordinating with legal, regulators, and possibly law enforcement.

Ransomware Sanctions Risk

Ransomware sanctions risk is the possibility that a payment or related service involves a blocked person, jurisdiction, or property and violates applicable sanctions rules.

Rare Value Detection

An analytic that identifies uncommon entities or field values within a defined population and time window, requiring context because rarity is not maliciousness.

Rate Limit and Lockout Testing

Rate limit and lockout testing verifies how authentication and recovery controls constrain repeated activity across account, source, session, endpoint, tenant, and transaction dimensions.

Rate Limiting

Restricting how often a user, IP, or system can perform an action in a time window.

Raw Event Preservation

Raw event preservation retains the original collected record alongside parsed or normalized fields so analysts can validate interpretation and recover missing context.

ReBAC

Relationship-Based Access Control: an access model where permissions follow the relationships between entities (such as 'owns' or 'member of'), used in systems like file sharing and graph-based platforms.

Reachability and Exposure Context

Reachability and exposure context describes whether and how an attacker or untrusted input can reach a vulnerable interface under the current architecture and controls.

Reading FAIR Output

Interpreting FAIR's quantitative results, loss distributions, exceedance curves, confidence ranges, so analysts and decision-makers understand what the numbers mean and don't read them as point estimates.