Glossary

Triage Methodology

The disciplined approach an analyst uses to triage incoming alerts, gathering context, dispositioning, escalating, that turns alert volume into structured decisions rather than ad hoc reactions.

Triage Throughput

How many alerts a triage analyst processes per unit time, while maintaining quality, a key SOC operational metric that exposes capacity, methodology effectiveness, and queue health.

True Positive

An alert that correctly identifies a real threat. The outcome triage discipline aims to produce reliably, even amid volumes of false positives that can dull attention.

True Positive Rate

From a blue-team-operations lens, the proportion of real threats that the detection correctly fires on, a measure of detection sensitivity, also called recall.

True Positives

From a logging/monitoring lens, the alerts that turned out to be real, that detection-engineering teams track to evaluate which rules are actually catching threats and refine accordingly.

Trust Chain

A chain of trust in cryptography: a certificate is trusted because it was signed by an issuer that is itself trusted, up to a root CA that is trusted by configuration. Foundational to PKI.

Trust Policy

In AWS IAM, the policy attached to a role that defines who can assume it, distinct from the permissions policy that defines what the role can do. Misconfigured trust policies are a major cloud security issue.

Tuning Anti-Patterns

Common bad habits in detection tuning, suppressing whole rules, broad exclusions, untracked changes, that reduce noise short-term but degrade detection coverage and program credibility over time.

Tuning Documentation

Recording detection-tuning changes, what was changed, why, by whom, when, so the program has institutional memory and can audit, review, or undo decisions later.

Tuning Methodology

A disciplined approach to reducing false positives without losing real detections, by analyzing root causes, choosing targeted refinements, measuring impact, and documenting decisions.

Twelve-Factor Implications

The security implications of building apps along the twelve-factor methodology, externalized config, stateless processes, log streams, that shape how cloud-native security applies to those apps.

UAC Bypass

Techniques that subvert Windows User Account Control to elevate privilege without prompting the user, exploiting auto-elevation paths, misconfigurations, or trust assumptions in elevated processes.

UDP

UDP is a transport protocol that sends messages without setting up a reliable connection first.

UID

User Identifier: a numeric ID Unix systems use internally to identify users. UID 0 is root, and tracking UIDs is foundational to understanding Unix permissions and audit logs.

URL

Uniform Resource Locator: the structured address identifying a resource on the web. Reading URLs precisely (scheme, host, path, query) is foundational to web defense and threat investigation.

USB Control

Restricting how USB devices can be used on endpoints, blocking unknown storage, limiting device classes, requiring approval, to defend against data exfiltration and malicious device threats.

Unencrypted Storage

Cloud storage left without encryption (or with default keys only), a common cloud-foundational issue that exposes data to anyone who gains access to the storage layer or its backups.

Unit Testing

Writing automated tests for individual detection rules to verify they fire on expected inputs and don't fire on safe ones, the smallest-grain check in a detection-as-code testing strategy.

Unmanaged Device Policy

Zero-trust policy that limits or denies access from devices the organization doesn't manage, BYO, contractor, personal, since unmanaged devices can't be trusted to enforce security baselines.

Unquoted Service Path

A Windows misconfiguration where a service's executable path isn't enclosed in quotes, letting an attacker who can write to certain directories hijack the service for privilege escalation.

User Account Control

A Windows feature that prompts users before allowing actions requiring administrative privilege, separating most user activity from elevated activity to reduce silent misuse of admin rights.

User Communication

How analysts communicate with affected users during investigations or incidents, clear, calm, appropriately scoped, that builds trust and gets accurate information without spreading panic.

User Context

The set of attributes tied to a logged-in user (account, group memberships, tokens, privileges) that processes operate under on a Windows or Linux system. Defenders read user context constantly.

User Space

The portion of memory and execution where non-kernel programs run, contrasted with kernel space. Most software, including malware, lives in user space, with privilege boundaries enforced at the kernel boundary.

VLANs

Virtual LANs: logical segmentation of a physical network into separate broadcast domains, used to isolate traffic and enforce segmentation without separate physical infrastructure.

VM Configuration Management

Managing the configuration of cloud VMs at scale, baselines, drift detection, automated remediation, so workloads stay aligned to expected state instead of diverging silently.

VM Detection Patterns

The patterns that detect threats and misconfigurations on cloud VMs, suspicious processes, lateral-movement signs, configuration drift, runtime anomalies, that cloud-workload-protection programs operationalize.

VM Exception Management

Managing exceptions in vulnerability management, the cases where a vulnerability can't be remediated in the normal window, with documented rationale, compensating controls, and expiration.

VM Integration

Integrating vulnerability management with adjacent functions, asset inventory, patching, ticketing, IR, so VM data flows into operational work rather than sitting in standalone reports.

VM Patching at Cloud Scale

Patching cloud VM fleets at scale, often via image rebuilds or scheduled rolling updates, rather than in-place patches, since cloud-native patterns favor replace over update.

VM Program Metrics

The metrics that measure a vulnerability-management program, MTTR, SLA compliance, critical-vulnerability backlog, scan coverage, that give leaders a credible view of program health.