ETMD EP Practitioners key terms

An intrusion technique that uses legitimate, preinstalled system tools such as PowerShell, WMI, or certutil to carry out malicious actions, helping the attacker blend in with normal administrative activity and evade signature-based detection.

The ordered sequence of stages an adversary moves through, from initial access to impact, used to map detections and controls to each phase of an intrusion, commonly aligned with frameworks like MITRE ATT&CK and the Cyber Kill Chain.

A forensic artifact such as a file hash, malicious domain, IP address, or registry key that suggests a system has been breached. IoCs are reactive evidence of past activity and can be blocked or searched for across the estate.

A behavioral signal that focuses on the intent and methods of an adversary, such as a process spawning an encoded shell, rather than on static artifacts. IoAs remain useful even when attackers change tools or hashes.

Malicious software that encrypts or steals data and demands payment to restore access or prevent disclosure. Endpoint defenses counter it through behavioral blocking, rollback, and detection of mass file modification activity.

A standardized identifier for a specific adversary method, such as T1059 Command and Scripting Interpreter. Techniques let analysts map detections, alerts, and coverage gaps to a shared vocabulary of observed attacker behavior.

A security solution that continuously records endpoint activity such as process creation, network connections, and file changes, then applies analytics to detect, investigate, and respond to threats through telemetry rather than relying only on static signatures.

The core agent that prevents threats on a device using antivirus signatures, behavioral rules, exploit mitigation, and firewall control. An EPP blocks known and suspicious activity, while EDR extends visibility and response on top of it.

A named collection of settings that determines how the endpoint agent behaves, including scan schedules, protection modules, and response actions. Policies are assigned to device groups and enforced by the management console.

The mechanism by which settings from a parent policy or group flow down to child groups unless explicitly overridden. Understanding inheritance order prevents unexpected behavior when multiple policies apply to one device.

The ranking rule that decides which policy wins when several apply to the same device or user. Precedence is typically determined by explicit ordering, with higher-ranked policies overriding lower-ranked ones regardless of assignment order.

A logical container used to organize endpoints so that policies, exclusions, and update rings can be applied consistently. Grouping by role or risk profile simplifies administration and limits the blast radius of policy changes.

A safeguard that prevents users, malware, or unauthorized administrators from disabling or altering the security agent, its services, registry keys, or configuration, ensuring protection stays active even on compromised or misconfigured hosts.

A staged rollout group that controls when devices receive agent or content updates. Rings let administrators validate new versions on a small pilot set before expanding to production, reducing the risk of widespread disruption.

A delivered package of detection signatures, behavioral rules, machine-learning models, or reputation data that the agent uses to identify threats. Frequent, small updates keep detection current between full agent releases.

A pattern or fingerprint, such as a file hash or byte sequence, used to identify known malicious code. Signatures are fast and precise for known threats but ineffective against new or modified malware without additional behavioral layers.

A detection method that watches how processes, files, and network activity behave and flags patterns consistent with malicious intent, such as credential dumping or script-based execution, rather than matching static file signatures.

A trained classifier that scores files or behaviors as benign or malicious based on learned features rather than fixed signatures. Models are updated as content and help catch new variants, but may produce false positives requiring tuning.

The process of quickly reviewing a detection to decide its severity, whether it is a true or false positive, and what response is required. Effective triage prioritizes alerts by risk and context to focus analyst effort.

An alert generated for activity that is actually benign, such as a legitimate administrative script flagged as malicious. High false-positive rates cause alert fatigue and are reduced through tuning and well-scoped exclusions.

A confirmed or suspected security event that requires investigation and coordinated response. Incidents are tracked through defined lifecycle stages from detection and containment to eradication, recovery, and lessons learned.

The structured phases of handling a security event, typically preparation, detection and analysis, containment, eradication, recovery, and post-incident review. Following the lifecycle keeps response consistent and auditable.

The response action that stops an incident from spreading, such as isolating a host from the network or disabling a compromised account. Containment aims to limit damage while preserving evidence for investigation.

A response capability that cuts a device off from the network while keeping the security agent connected to the console, allowing analysts to investigate and remediate without allowing lateral movement or data exfiltration.

The ability to run investigation and remediation actions on an endpoint from the management console, such as collecting files, querying running processes, or killing a process, without physically accessing the device.

A ranked value assigned to an alert or incident that reflects its potential impact and urgency. Severity drives escalation and response timelines, and should be based on context such as asset criticality and attacker behavior.

A proactive, hypothesis-driven search through endpoint and network telemetry to find threats that automated detections missed. Hunting relies on analyst expertise, behavioral queries, and knowledge of adversary techniques rather than waiting for alerts.

A hunt structured around a testable statement about attacker behavior, such as assuming credential dumping has occurred, then querying telemetry to confirm or refute it. The result improves detection content regardless of outcome.

The raw event data an agent collects, including process, file, registry, and network activity. Rich telemetry is the foundation of hunting, triage, and forensics, and its retention period determines how far back investigations can reach.

A bulk search across the estate for known bad artifacts such as hashes, domains, or filenames to find additional compromised hosts. Sweeps convert a single confirmed finding into a broader scoping effort.

An external or internal source of current adversary information, such as malicious IPs, domains, and tactics, that is ingested to enrich detections and hunting. Feed quality and relevance must be validated to avoid noise.

A structured comparison of an organization's detection and control coverage against a framework of known attacker techniques, revealing blind spots where additional telemetry, rules, or controls are needed.

A rule that tells the security agent to ignore specified files, folders, processes, or behaviors. Exclusions reduce false positives and performance impact but create blind spots, so they must be narrowly scoped, justified, and reviewed.

The ongoing adjustment of detections, policies, and exclusions to improve accuracy and reduce noise while preserving protection. Tuning is driven by alert data, false-positive trends, and changes in the environment.

The controls and review process around exclusions, including approval, documentation, ownership, and periodic revalidation. Strong governance prevents accumulated, unjustified exclusions from silently weakening protection over time.

A chronological record of administrative and security-relevant actions, such as policy changes, exclusion additions, and response actions. Audit trails support accountability, troubleshooting, and compliance evidence.

An access model that grants permissions based on a user's assigned role rather than individual identity. RBAC limits who can change policies, approve exclusions, or perform response actions, supporting least privilege and separation of duties.

The generation of documented evidence, such as policy coverage, patch status, and detection metrics, to demonstrate adherence to internal standards or external regulations. Reports must be accurate, reproducible, and retained per policy.

A defined commitment for operational performance, such as the maximum time to respond to a critical alert or deploy an agent update. SLAs set expectations and are tracked through operational metrics and reporting.

The average elapsed time between the occurrence of a threat and its detection. MTTD is a key operational metric that reflects detection effectiveness and is improved through better telemetry, tuning, and hunting.

The average time from detection to containment or resolution of an incident. MTTR measures response efficiency and is reduced through automation, clear playbooks, and adequate analyst staffing.