Short definitions for detection, threat, vulnerability, and incident-response terms.
| Term | Definition |
|---|---|
| SIEM | Security information and event management system that aggregates and analyzes security telemetry |
| EDR | Endpoint detection and response tooling for endpoint telemetry, investigation, and response support |
| IOC | Indicator of compromise, such as a malicious hash, domain, IP address, or artifact |
| CVSS | Common Vulnerability Scoring System, a standardized method for communicating vulnerability characteristics and severity |
| Containment | Incident-response action that limits spread or impact |
| Threat hunting | Proactive search for suspicious behavior using hypotheses and available evidence |
| False positive | Alert that appears suspicious but does not represent the condition it was intended to detect |
| Detection coverage | Degree to which telemetry and analytics can identify relevant activity |