Cisco 350-201 CBRCOR key terms

A seven-stage model describing how an adversary progresses from reconnaissance through weaponization, delivery, exploitation, installation, command and control, and actions on objectives, used to place defenses at each stage.

A curated knowledge base of adversary tactics, techniques, and procedures observed in real intrusions, organized by platform and used to map detections, prioritize coverage gaps, and structure threat hunting.

A three-level description of adversary behavior: the tactical goal, the general method used to achieve it, and the specific implementation details that distinguish one actor or toolset from another.

Observable artifacts such as malicious file hashes, domains, IP addresses, or registry keys that suggest a system has been breached, typically consumed as machine-readable feeds for detection and blocking.

Behavioral evidence of an active intrusion, such as unusual process parentage or anomalous authentication patterns, which is more durable than static compromise artifacts and better suited to detecting variants.

A system that ingests, normalizes, scores, and distributes threat data from multiple sources so that analysts and security controls can consume consistent, deduplicated intelligence.

The practice of rating intelligence and alerts by how trustworthy the source is and how much impact the activity would have, so responders can triage limited attention toward the highest-risk findings.

An analytic framework relating four core features of any intrusion, namely adversary, capability, infrastructure, and victim, with edges that reveal how the features interact and where pivoting is possible.

The analytic judgment of which group or sponsor is responsible for an intrusion, based on infrastructure overlap, tooling, targeting, and timing, usually expressed with explicit confidence levels rather than certainty.

A proactive, hypothesis-driven search through telemetry for adversary activity that existing detections missed, ending with new detections, tuning, or a documented conclusion that no activity was found.

Detection methods that model normal patterns of user, host, or network activity and flag statistically unusual deviations, catching novel techniques that signature matching cannot recognize.

A recorded reference state of expected system, network, or user behavior gathered over a defined period, against which later activity is compared to identify meaningful deviation.

A technique that flags observations deviating from an established model of normal behavior, trading higher sensitivity to unknown threats for a greater volume of benign findings to investigate.

An alert raised on activity that is actually benign, which consumes analyst time and erodes trust in detection tooling when not tuned out.

The iterative adjustment of rule logic, thresholds, and exclusions to reduce false positives and false negatives while preserving coverage of the behaviors a detection was written to catch.

The first-pass review of an alert to determine whether it represents real malicious activity, its scope and severity, and whether it should be escalated, closed as benign, or investigated further.

A platform that collects logs from many sources, normalizes and correlates them against rules, and surfaces alerts and dashboards, serving as the central console for monitoring and investigation.

A tooling category that executes automated playbooks for enrichment, notification, and containment, reducing manual steps in alert handling and enforcing consistent response actions.

The conversion of heterogeneous log formats into a common schema with consistent field names and value types, enabling correlation and search across sources in a SIEM.

Logic that combines multiple events across sources or time windows to detect a pattern, such as repeated failed logins followed by a success, that no single event reveals alone.

A vendor-neutral, YAML-based format for describing log-based detection logic that can be converted into queries for many SIEM and EDR platforms, supporting portable and shareable detections.

A pattern-matching rule, built from strings and conditions, used to identify and classify malware samples and suspicious files during scanning or forensic review.

Endpoint software that continuously records process, file, registry, and network telemetry, applies behavioral detections, and offers response actions such as isolating a host or killing a process.

Summarized metadata about network connections, including source, destination, ports, byte counts, and timestamps, useful for spotting beaconing, data transfer, and lateral movement without full packet capture.

The inspection of packet captures and flow records to identify malicious communication, protocol abuse, exfiltration, and command-and-control channels that endpoint tools may not observe.

Regular, periodic outbound connections from an infected host to attacker infrastructure, whose consistent timing and small repeated payloads are a strong signal of remote access malware.

The channel an attacker uses to send instructions to and receive results from compromised hosts, often disguised as normal web, DNS, or cloud traffic to blend into the environment.

An adversary approach that abuses legitimate built-in tools such as PowerShell, WMI, or certutil instead of dropping custom malware, making activity harder to distinguish from administration.

Techniques an attacker uses to move from one compromised host to others, such as remote service creation or credential reuse, expanding access toward high-value targets.

The step in which an attacker gains higher permissions than initially obtained, through credential theft, misconfiguration abuse, or exploitation, to reach protected data and systems.

Mechanisms an attacker installs so access survives reboots, credential changes, or cleanup, such as scheduled tasks, services, or startup entries that must be found and removed during response.

Examining the parent-child relationships and command-line arguments of running processes to spot suspicious lineage, such as a word processor spawning a scripting interpreter.

Detonating a suspicious file or URL in an isolated, instrumented environment to observe its behavior and extract network and host artifacts without risking production systems.

The ordered phases of preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned that structure how an organization handles a security incident.

The response phase that limits an incident's spread and impact, for example by isolating hosts, disabling accounts, or blocking traffic, while preserving evidence needed for investigation.

The response phase that removes the root cause of an incident, including malware, persistence mechanisms, and exploited vulnerabilities, so the threat cannot simply resume.

The response phase that restores affected systems and services to normal operation, validates that they are clean, and monitors closely for signs of reinfection before returning to steady state.

A post-incident review that documents what happened, what worked, and what failed, producing concrete changes to detections, playbooks, and controls rather than a narrative report alone.

A documented, repeatable sequence of steps and decision points for handling a specific incident type, often automated in a SOAR platform to ensure consistent and timely response.

The documented, unbroken record of who collected, handled, and stored evidence and when, which preserves its integrity and admissibility in legal or disciplinary proceedings.

Creating a bit-for-bit copy of a disk, memory, or device with verified hashing before analysis, so investigators can examine evidence without altering the original.

Evidence that disappears when a system loses power, such as running processes, network connections, and memory contents, which must be collected first in a live response.