Glossary

Plain answers to the terms you’ll hear in a SOC, in threat hunting and in interviews.

A

Advanced hunting: The query tool in Microsoft Defender XDR. You search up to 30 days of raw data from devices, email, identities and cloud apps with KQL.Practise KQL →
Alert triage: Deciding quickly whether an alert is real and how serious it is, then closing it, investigating it or escalating it.

D

Data Lake (Sophos): Where Sophos Central keeps endpoint data uploaded by scheduled queries, so you can search earlier activity and devices that are offline. Each query covers up to 30 days.Sophos SQL cheat sheet →
Detection rule: A saved query that runs on a schedule and raises an alert when it finds a match.

E

ECSElastic Common Schema: Elastic’s standard field names, like process.name and host.name, so data from different sources can be searched the same way.Elastic cheat sheet →
EDREndpoint detection and response: Software on laptops and servers that records activity like processes, files and network connections, detects threats, and lets you respond, for example by isolating a device.
Encoded command: A PowerShell command passed in Base64 with -EncodedCommand, or its short forms -e and -ec. Attackers use it to hide what a script does.Find it in an interview task →
Event ID: The number Windows gives each type of event. For example, 4624 is a successful sign-in, 4625 is a failed one, and 4698 is a new scheduled task.

F

False positive: An alert that fires on harmless activity. Tuning a rule means cutting these down without missing real attacks.

I

IOCIndicator of compromise: A clue that a system may have been attacked, like a known bad IP address, domain or file hash.

K

KQL: Two different languages share this name. Kusto Query Language is Microsoft’s, used in Defender and Sentinel. Kibana Query Language is Elastic’s search bar syntax.See every query language →

L

Lateral movement: When an attacker uses one compromised machine or account to reach others, often through remote sign-ins, file shares or tools like PsExec.Find it in an interview task →
Live Discover: The Sophos Central tool that runs osquery SQL on devices that are online right now, to see their processes, ports, users and files.Practise Sophos SQL →
Logon type: A number in Windows sign-in events that says how someone signed in. Type 2 is at the keyboard, type 3 is over the network, and type 10 is Remote Desktop.
LOLBinsLiving off the land binaries: Programs that come with Windows, like certutil.exe or mshta.exe, that attackers misuse so their activity blends in with normal admin work.

M

MITRE ATT&CK: A free, public catalogue of attacker tactics and techniques. Teams use it to label detections and plan hunts.

O

osquery: An open-source tool that lets you ask a computer about its state, like running processes and user accounts, with SQL, as if it were a database.

P

Persistence: Anything an attacker sets up to keep access after a restart or a password change, like a scheduled task, a service or a startup entry.
Pipe: The | character in KQL, SPL and ES|QL. It passes the result of one step to the next, so a query reads from top to bottom.

S

SIEMSecurity information and event management: A system that collects logs from across an organisation into one place, so analysts can search them, connect related events and raise alerts.
Sigma: An open format for detection rules. You write a rule once and convert it into each SIEM’s query language.
SOCSecurity operations centre: The team that monitors an organisation’s security, triages alerts and responds to incidents, often around the clock.

T

Threat hunting: Searching your data for signs of an attack that no alert has caught, usually starting from an idea of what an attacker might do.Who it’s for →

X

XDRExtended detection and response: EDR extended to more sources, like email, identity, network and cloud, with their data and alerts in one place.

Know the words, then practise the work

SOC Fluent gives you exercises to solve in KQL, Elastic and Sophos SQL, on realistic lab data. Join the waitlist and we’ll email you once, on launch day.

Join the waitlist See pricing

Free to join. Students get 50% off at launch.