Cisco CyberOps Professional key terms

A centralized team and facility responsible for continuously monitoring, detecting, analyzing, and responding to security incidents across an organization's IT environment. SOC functions typically include tiered analysts, incident response, threat intelligence, and engineering.

A structured six-phase process for handling security incidents: preparation; identification; containment; eradication; recovery; and lessons learned. Each phase has specific goals and deliverables that guide responders from initial detection through post-incident improvement.

Security Information and Event Management: a platform that collects, normalizes, correlates, and analyzes log and event data from diverse sources to detect threats and support investigations. SIEMs typically provide dashboards, alerting, and long-term log retention.

Security Orchestration, Automation, and Response: a platform that integrates security tools and automates incident response workflows through playbooks. SOAR reduces manual effort by orchestrating actions such as enrichment, notification, and containment across multiple systems.

A predefined, repeatable sequence of steps and automated actions used to handle a specific type of security incident or event. Playbooks codify response procedures, reduce human error, and enable consistent, faster remediation when triggered manually or automatically.

A detailed, step-by-step operational guide for performing a specific administrative or response task, often written for human operators. Unlike automated playbooks, runbooks emphasize manual procedures, decision points, and escalation paths for complex or low-frequency activities.

The use of technology to execute security tasks with minimal human intervention, such as alert enrichment, ticket creation, or blocking indicators. Automation improves speed and consistency but requires careful testing and guardrails to avoid unintended actions.

The coordinated integration and sequencing of multiple security tools and systems to perform a unified workflow. Orchestration connects disparate technologies, such as firewalls, endpoint agents, and ticketing systems, so they can act together under automated control.

The process of parsing and transforming log data from different sources into a common, standardized format and schema. Normalization enables consistent searching, correlation, and reporting across heterogeneous devices and applications within a SIEM or data lake.

A logical condition or pattern in a SIEM or analytics platform that matches multiple events across sources and time to generate an alert. Correlation rules detect complex behaviors that single events would not reveal, such as brute-force followed by successful login.

An alert or detection that incorrectly identifies benign activity as malicious. High false-positive rates burden analysts and can cause alert fatigue, so tuning detection logic and enrichment are essential to maintain effective security operations.

A failure to detect or alert on activity that is actually malicious. False negatives represent dangerous gaps in detection coverage and are often addressed through threat hunting, improved sensor placement, and detection engineering.

The process of reviewing, prioritizing, and validating security alerts to determine which require investigation or response. Triage uses severity, context, and enrichment to separate true incidents from noise and to route work appropriately.

A forensic artifact or observable, such as a file hash, IP address, domain, or registry key, that suggests a system or network may have been breached. IoCs are reactive evidence of past or ongoing compromise and can be shared for detection.

A behavioral or contextual sign that an adversary is actively conducting an attack, such as unusual process execution or lateral movement patterns. IoAs focus on intent and behavior rather than static artifacts, making them more resilient to attacker changes.

A publicly maintained knowledge base of adversary tactics, techniques, and procedures based on real-world observations. ATT&CK provides a common language for describing attacker behavior and is widely used for detection mapping, threat hunting, and gap analysis.

The behavioral patterns of an adversary: tactics describe high-level goals, techniques describe how goals are achieved, and procedures describe specific implementations. TTPs are more durable indicators than static IoCs for attributing and detecting threat activity.

Evidence-based knowledge about existing or emerging threats, including context, mechanisms, indicators, and implications, that informs decision-making. It can be strategic, operational, tactical, or technical and is used to prioritize defenses and accelerate investigations.

A proactive, hypothesis-driven process of searching for undetected adversary activity within an environment. Hunters use threat intelligence, TTPs, and analytics to uncover stealthy threats that automated detection may have missed.

A structured threat hunting approach that begins with a testable hypothesis about attacker behavior, then uses data analysis to confirm or refute it. This method focuses hunting efforts and produces reusable detection logic from findings.

The extent to which an organization's monitoring and analytics can identify adversary behaviors across its environment. Coverage is often mapped to frameworks like MITRE ATT&CK to reveal gaps and guide investment in sensors, logging, and detection rules.

The incident response phase focused on limiting the spread and impact of an incident. Strategies include isolating hosts, blocking network traffic, disabling accounts, and segmenting environments, with short-term and long-term options weighed against operational risk.

The incident response phase in which the root cause and all malicious components, such as malware, persistence mechanisms, and compromised accounts, are removed from the environment. Eradication must be thorough to prevent reinfection before recovery begins.

The incident response phase that restores affected systems and services to normal operation, often from trusted backups or rebuilt systems. Recovery includes validation, monitoring for recurrence, and gradual return to production while confirming security controls.

The post-incident phase in which responders review the incident and response to identify strengths, weaknesses, and improvement actions. Outputs often include updated playbooks, new detections, and training recommendations to strengthen future response.

The documented, chronological record of evidence handling that shows who collected, accessed, transferred, and stored evidence, and when. Maintaining an unbroken chain of custody is essential for evidence integrity and admissibility in legal or disciplinary proceedings.

The process of creating a bit-for-bit copy of a storage device or memory for investigative analysis, preserving original evidence. Forensic images are hashed to verify integrity and are analyzed using specialized tools to recover artifacts and timeline activity.

The assurance that digital evidence has not been altered or corrupted from the time of collection through analysis and presentation. It is maintained through cryptographic hashing, write blockers, documented procedures, and strict chain-of-custody controls.

A security solution that continuously monitors endpoint activity, records telemetry, and provides detection, investigation, and response capabilities. EDR enables analysts to query process, file, and network events and to isolate or remediate compromised hosts.

A security technology that monitors network traffic and metadata to detect malicious or anomalous activity and support response. NDR uses behavioral analytics, machine learning, and traffic inspection to identify threats that evade signature-based tools.

Analytical techniques that model normal activity and flag deviations that may indicate compromise, rather than relying solely on known signatures. Behavioral analytics can detect novel threats and insider activity but require tuning to manage false positives.

The identification of data points, events, or behaviors that deviate significantly from an established baseline. In security operations, anomaly detection helps surface unusual user, network, or system activity for further investigation, though not all anomalies are malicious.

A documented, measured reference state of normal system, network, or user behavior used for comparison. Baselines enable analysts and tools to identify deviations, support anomaly detection, and verify configuration compliance over time.

The automated collection and transmission of data from systems, sensors, and applications for monitoring and analysis. Security telemetry includes logs, endpoint events, network flows, and cloud audit records that feed detection and investigation platforms.

A pattern-matching rule used to identify and classify malware samples based on textual or binary characteristics. YARA rules are widely used in malware analysis, scanning, and threat intelligence sharing to detect known malicious code families.

The process of examining malicious software to understand its functionality, capabilities, and indicators. It includes static analysis of code and structure and dynamic analysis of behavior in a controlled sandbox, supporting detection and response.

Executing suspicious files or code in an isolated, instrumented environment to observe behavior safely. Sandboxing reveals actions such as file creation, registry changes, and network callbacks, which inform detection and containment decisions.

The examination of malware or suspicious code by running it in a controlled environment and observing its behavior. Dynamic analysis captures runtime actions like process injection, persistence, and command-and-control communication that static review may miss.

The examination of a file or code without executing it, using techniques such as string extraction, header inspection, and disassembly. Static analysis can reveal capabilities and indicators quickly but may be obscured by packing or obfuscation.