Glossary of cybersecurity, SOC and monitoring.

System, data, process or infrastructure whose unavailability, alteration or exposure may significantly affect the business.

In practice: Identifying critical assets allows us to prioritize monitoring, response and recovery according to real impact.

Notification generated when a rule, model or analyst detects a potentially risky condition.

In practice: An alert does not amount to an incident: it must first be enriched, correlated and classified.

Technique that looks for deviations from the usual behavior of users, devices or applications.

In practice: Helps detect abuse of credentials and abnormal movements that do not always coincide with a known signature.

Using flows, integrations and rules to execute repetitive analysis or response tasks without manual intervention at each step.

In practice: It should be implemented with risk-sensitive controls, traceability and approval points.

Team responsible for defending systems, detecting malicious activity and responding to incidents.

In practice: You can operate internally, with a specialized supplier or through a hybrid model.

Specialized operation that combines people, processes and technology to monitor, detect, analyze and respond to digital threats.

In practice: The focus is on turning technical signals into actionable safety decisions for the organization.

Actions to limit the scope and impact of an incident while the investigation continues.

In practice: It may include isolating an endpoint, blocking an account, restricting an IP, or segmenting a service.

Process of linking signals from different sources to identify patterns with greater context.

In practice: It reduces noise and allows to detect sequences that, observed separately, would seem harmless.

Computer Security Incident Response Team: coordinated computer security incident management team.

In practice: Define roles, communications, analysis, containment, recovery and post-incident learning.

Public and standardized identifier assigned to a known security vulnerability.

In practice: The CVE facilitates the exchange of information, but the priority also depends on the exposure and the impact on each company.

Data Loss Prevention: Controls to detect and prevent the exposure, transfer or unauthorized use of sensitive information.

In practice: It can be applied to endpoints, mail, cloud and network traffic.

Endpoint Detection and Response: technology that records activity in end teams and helps detect, investigate and respond to threats.

In practice: Provides detailed telemetry of endpoint processes, files, users and connections.

Final device connected to a network, such as a notebook, server, cell phone or workstation.

In practice: It is a key source of telemetry and one of the most used entry points by attackers.

Recording of an activity relevant to safety, although not necessarily malicious.

In practice: Events feed analysis and rules; a combination of events can produce an alert.

Warning that appears to indicate a threat, but corresponds to a legitimate activity or without material risk.

In practice: Continuous tuning allows you to reduce false positives without losing visibility over real threats.

Control that allows or blocks network traffic according to defined policies.

In practice: Their records provide context on connections, origins, destinations, ports and actions applied.

Process organized to identify, analyze, contain, eradicate and recover an operation after an incident.

In practice: Includes responsible, evidence, communications, target times and a subsequent review.

Set of measures to reduce the attack surface of a system through safe configurations and removal of unnecessary functions.

In practice: It relies on standards, inventory, change management and continuous verification.

Intrusion detection and prevention systems that inspect activity to identify or block suspicious patterns.

In practice: An IDS alerts; an IPS can also intervene on traffic according to the policy configured.

Observable data associated with a possible intrusion, such as an IP, domain, hash, file or activity pattern.

In practice: IOCs are useful for seeking evidence, but should be evaluated with context and validity.

Analysed information about actors, campaigns, techniques and indicators that helps anticipate and prioritize risks.

In practice: Its value appears when it is integrated into decisions, detection rules and threats hunting exercises.

International standard for establishing, maintaining and improving an information security management system.

In practice: An SOC can provide evidence and operational controls, although certification covers all management defined by the organisation.

Record generated by a system, application or device on an activity that occurred.

In practice: Its quality, context, retention and timing condition the ability to investigate incidents.

Managed Detection and Response: managed service aimed at detecting, investigating and responding to threats with technology and specialists.

In practice: The scope varies depending on the provider, the sources included and the level of response agreed.

Multifactor authentication: a mechanism that requires two or more independent factors to verify an identity.

In practice: It reduces the risk associated with password theft, although it must be accompanied by monitoring and access policies.

Knowledge base that organizes tactics and techniques used by adversaries during an attack.

In practice: It allows mapping detection coverage, identifying gaps and communicating scenarios with a common language.

Mean Time to Detect: Average time it takes an organization to detect a relevant activity or incident.

In practice: It must be measured with consistent criteria to guide improvements in sources, rules and processes.

Mean Time to Respond or Recover: Average time used to respond to or recover the operation, as defined.

In practice: It is useful to document what beginning and end metrics are used to avoid misleading comparisons.

Network Operations Center: team focused on availability, performance and continuity of infrastructure and services.

In practice: It is complemented by the SOC, which prioritizes risks, threats and security incidents.

Architecture that combines local infrastructure with public or private cloud services.

In practice: Monitoring needs to standardize telemetry of identities, endpoints, applications, network and cloud platforms.

Documented sequence of decisions and actions to respond to a specific security scenario.

In practice: Define validations, responsible, evidence, communications and closure criteria.

Attack that numbers, steals or blocks information and requires a payment or condition to recover it or prevent its publication.

In practice: Response requires early detection, containment, reliable support, coordination and business continuity.

Potential for a threat to take advantage of a vulnerability and generate an impact on business objectives.

In practice: It is analyzed by combining probability, exposure, controls, impact and tolerance of the organization.

Security Information and Event Management: a platform that centralizes, normalizes, correlates and consults security events.

In practice: An SIEM is a technological piece; to produce results it needs useful sources, rules, tuning and operation.

Security Orchestration, Automation and Response: a platform that connects tools and automates response flows.

In practice: Helps to run playbooks consistently, but requires government and maintenance of integrations.

Security Operations Center: a function that monitors, detects, investigates and coordinates the response to security threats.

In practice: It can be internal, outsourced or hybrid and is not limited to a particular tool.

Operation SOC with continuous coverage 24 hours, every day of the year.

In practice: Requires guards, procedures, scaling, tools and actual ability to sustain the response out of schedule.

Service in which a provider operates in whole or in part the capabilities of an SOC for an organization.

In practice: The contract should clarify coverage, integrations, responsibilities, times, deliverables and service governance.

Proactive search for behaviors or evidence of threats that were not detected by existing alerts.

In practice: Part of hypothesis, telemetry available and knowledge of the environment to find covert activity.

Initial assessment of an alert to determine its validity, severity, scope and priority.

In practice: A good triage brings together enough context to rule out noise or climb with useful evidence.

Weakness in software, configuration, process or control that can be exploited to affect security.

In practice: Technical criticism must be combined with exposure and the impact of the asset in order to prioritize remediation.

Open source security platform that brings together capabilities for log analysis, endpoint monitoring, integrity and detection.

In practice: Can be integrated into an SOC operation along with automation, intelligence and response processes.

Extended Detection and Response: approach that correlates telemetry and response actions between multiple layers of security.

In practice: It can include endpoints, identity, mail, network and cloud depending on the platform and integrations available.

Security model based on explicitly verifying each access, limiting privileges and assuming that no area is reliable by default.

In practice: It requires solid identity, segmentation, context, observability and continuous review.