List of the most commonly used terms in a modern SOC

Table of Contents

SIEM (Security Information and Event Management): A solution that aggregates, normalizes, and analyzes log data from across an organization’s IT environment to detect security threats, compliance violations, and anomalies.
SOAR (Security Orchestration, Automation, and Response): Technologies that enable organizations to collect inputs from various security tools (like SIEMs), automate repetitive tasks (like isolating an infected host), and streamline incident response workflows.
EDR (Endpoint Detection and Response): An endpoint security solution that records and stores endpoint-system-level behaviors, uses various data analytics techniques to detect suspicious system behavior, provides context for those behaviors, and blocks malicious activity.
NDR (Network Detection and Response): Security tools that monitor network traffic for suspicious activity, known threats, and anomalies using techniques like machine learning and protocol analysis, allowing for automated responses.
XDR (Extended Detection and Response): An evolution of EDR that collects and automatically correlates data across multiple security layers (endpoints, networks, cloud, and identity) to improve threat detection and response times.
UEBA (User and Entity Behavior Analytics): A category of security tools that analyze user and entity behavior to detect anomalies, insider threats, and compromised credentials (highly relevant to your IAM/CyberArk background).

Event: Any observable occurrence in a system or network (e.g., a user logging in, a firewall blocking a port).
Alert: An event or series of events that trigger a notification because they match a specific security rule, signature, or anomaly threshold.
Incident: A validated alert that represents a genuine security threat, policy violation, or negative event that requires a response.
Triage: The process of reviewing and prioritizing incoming alerts to determine which ones are true incidents and how severe they are.
False Positive: An alert triggered by benign activity that is incorrectly flagged as malicious.
True Positive: An alert triggered by actual malicious activity.
False Negative: A failure to generate an alert for actual malicious activity (a missed detection).

MTTD (Mean Time to Detect): The average amount of time it takes for the SOC to identify a security threat or breach from the moment it occurs.
MTTA (Mean Time to Acknowledge): The average time it takes for a SOC analyst to acknowledge and begin investigating an alert.
MTTR (Mean Time to Respond/Resolve/Remediate): The average time it takes to mitigate, contain, or fully resolve a security incident once it has been detected.
MTTC (Mean Time to Contain): The average time it takes to stop the threat from spreading further within the environment.

CTI (Cyber Threat Intelligence): Information collected and analyzed to understand a threat actor’s motives, targets, and behaviors, helping organizations make proactive security decisions.
IOC (Indicator of Compromise): Artifacts or forensic data (e.g., malicious IP addresses, file hashes, suspicious domain names) that indicate a system or network has been compromised.
TTP (Tactics, Techniques, and Procedures): The specific methods and patterns of behavior used by threat actors to achieve their goals.
Threat Hunting: The proactive practice of searching through networks, endpoints, and cloud environments to detect and isolate advanced threats that evade automated security tools.
MITRE ATT&CK: A globally accessible knowledge base of adversary tactics and techniques based on real-world observations, used as a foundation for threat intelligence and hunting.

Zero-Day (0-day): A vulnerability in software or hardware that is unknown to the vendor or for which no patch is currently available.
CVE (Common Vulnerabilities and Exposures): A standardized dictionary of publicly known cybersecurity vulnerabilities, assigning each a unique identifier (e.g., CVE-2023-1234).
CVSS (Common Vulnerability Scoring System): An open framework used to communicate the characteristics and severity (scored 0.0 to 10.0) of software vulnerabilities.
Exploit: A piece of software, a chunk of data, or a sequence of commands that takes advantage of a bug or vulnerability to cause unintended behavior.
Payload: The component of an attack that actually executes the malicious action (e.g., the ransomware encryption script or the reverse shell).
Lateral Movement: The process by which an attacker progressively moves through a network from one compromised system to another, searching for sensitive data and high-value assets.

Chain of Custody: A documented, chronological paper trail that shows the seizure, custody, control, transfer, analysis, and disposition of physical or electronic evidence, ensuring it is legally admissible.
Artifacts: Digital evidence left behind on a system or network as a result of an action (e.g., registry keys, browser history, memory dumps, log files).
PCAP (Packet Capture): A file containing network packet data captured by a tool like Wireshark or tcpdump, used for deep-dive network forensics.
Root Cause Analysis (RCA): A method of problem-solving used to identify the exact underlying cause of a security incident, rather than just treating its symptoms.
Memory Dump (Crash Dump): A snapshot of a computer’s RAM at a specific point in time, used by forensic analysts (using tools like WinDbg or Volatility) to find hidden malware, decrypted passwords, or running processes.

Playbook: A predefined, automated sequence of actions in a SOAR platform designed to respond to a specific type of security incident (e.g., a Phishing Playbook).
Runbook: A written, step-by-step manual or set of instructions for SOC analysts to follow when investigating or responding to an incident (often the manual precursor to an automated Playbook).
Use Case: A specific scenario or threat model that the SOC is designed to detect (e.g., “Detect Impossible Travel,” “Detect Privilege Escalation”).

techyengineer