Exabeam Analyst flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

TDIR lifecycle

The sequence of detection, triage, investigation, containment, eradication, recovery, and lessons learned that moves an alert from generation to closure with documented evidence at each stage.

Alert triage

The first-pass assessment that decides whether an alert is a true positive, its severity, and whether it warrants escalation, based on entity legitimacy and behavioral context.

Pivot

A search step that moves from one artifact to a related one, such as user to host to process to network destination, narrowing scope or revealing lateral movement.

Containment

The response action that limits spread of a confirmed incident, such as host isolation or account disablement, performed after preserving volatile evidence like memory and logs.

Mean time to detect

The average elapsed time between the occurrence of malicious activity and its first alert, computed from event timestamps and alert creation time to measure detection effectiveness.

False positive rate

The proportion of alerts from a detection rule that are not real threats, measured by testing the rule against known-good baseline data before production tuning.

MITRE ATT&CK

A knowledge base of adversary tactics and techniques used to map detections, structure investigations, and reconstruct an attack timeline in a consistent vocabulary.

Eradication

The response phase that removes the root cause of an incident, such as deleting malware, closing the exploited vulnerability, or resetting compromised credentials.

UEBA baseline

A per-entity, time-aware profile of normal behavior built from attributes like role, department, and location, against which deviations are scored for anomaly detection.

Peer group

A set of entities sharing attributes such as department or role, used as the comparison population so that anomalies are measured against similar users rather than everyone.

Risk score decay

The mechanism by which an entity's cumulative risk score decreases over time as normal behavior continues, preventing old anomalies from keeping scores permanently elevated.

First-seen activity

An event involving a new country, device, or asset for an entity; benign alone, it becomes high risk when paired with privileged access or sensitive data.

Low-and-slow attack

Malicious activity spread across many days so per-event volume stays under static thresholds, detected through aggregation windows of one to four weeks.

Risk-based alerting

A model that opens investigations only when cumulative entity risk crosses a threshold, rather than on every individual rule hit, reducing analyst noise.

Service account baseline

A separate behavioral profile for machine-driven accounts, since their login times, hosts, and volumes differ markedly from human user patterns.

Behavioral feature

A measurable attribute of entity activity, such as login time-of-day, source geography, session duration, or data volume, used as input to anomaly models.

Anomaly versus outlier

An anomaly deviates from the entity's own history, while an outlier deviates from its peer group; distinguishing them separates role changes from genuine threats.

Log normalization

The mapping of vendor-specific event fields into a common schema so that one correlation query works consistently across multiple log sources.

Log source health

Ongoing monitoring of events per second per source, alerting when a feed drops to zero, because a silent source creates an undetected blind spot.

Correlation rule

Logic that combines events to produce an alert, typically as single-event, threshold, sequence, or absence-of-event patterns evaluated over a time window.

Sequence rule

A correlation type that fires when event A is followed by event B within a defined time window, used to detect multi-step attack patterns.

Absence-of-event rule

A detection that fires when an expected log, such as a daily backup or endpoint heartbeat, never arrives, indicating a control failure or tampering.

Retention tier

A storage classification, such as hot, warm, or archive, that balances fast searchable access for recent data against cheaper long-term compliance storage.

Identity enrichment

The lookup that resolves an IP address to an asset and its assigned user, accounting for DHCP and VPN reuse, so alerts name a person rather than an address.

Ingest filtering

Dropping or sampling high-volume low-value logs at the collector while keeping full fidelity for authentication, endpoint, and perimeter sources to control cost.

Clock skew

A difference in system time between log sources that breaks event ordering; correlation therefore relies on timestamps normalized to a single time zone.

Malicious insider

An employee who intentionally steals or damages data, detected through out-of-role access, volume spikes, and activity near resignation or review dates.

Compromised insider

A legitimate employee whose credentials an external attacker has taken over; detection blends account anomaly signals with endpoint and network evidence.

Process tree analysis

Endpoint review of parent-child process relationships and command lines, such as an office application spawning a script interpreter, to spot malicious execution.

Data exfiltration signal

Behavioral indicator such as large uploads to unfamiliar destinations, bulk file compression before transfer, or off-hours copying of sensitive documents.

Departure risk window

The period from resignation notice to last working day, when bulk data copying is most common and monitoring of departing employees is elevated.

Honeytoken

A decoy file or credential with no legitimate use, so any access generates a high-fidelity alert because normal users have no reason to touch it.