Fortinet FCSS SOC key terms

A team and facility that continuously monitors, detects, triages, and responds to security events across an organization, typically organized into tiers with defined escalation paths and documented runbooks.

A platform that ingests logs and telemetry from many sources, normalizes them, correlates events against rules and analytics, and raises alerts. It is the central collection and detection layer for most SOCs.

A tool that automates response actions by running playbooks that call APIs, enrich alerts, and coordinate tasks across security products. It reduces manual handling time and enforces consistent response steps.

A documented, repeatable sequence of steps an analyst or automation follows for a given alert type, covering triage, containment, eradication, and closure criteria. Playbooks make response consistent and auditable.

Operational instructions for performing a specific administrative or technical procedure, such as re-enabling a blocked interface or restoring a configuration backup. Runbooks emphasize mechanics, while playbooks emphasize decision logic during incidents.

The structured process of preparing for, detecting, containing, eradicating, recovering from, and learning from a security incident. Each phase has entry criteria, owners, and evidence-handling requirements documented in advance.

A documented record of who collected, handled, and stored evidence, and when. It preserves evidentiary integrity so findings remain defensible in legal or disciplinary proceedings.

An alert that correctly identifies malicious or policy-violating activity. Distinguishing true from false positives drives tuning decisions and determines whether a detection rule stays enabled.

An alert raised for activity that is actually benign. Excessive false positives cause alert fatigue and can mask genuine incidents, so tuning thresholds and exceptions is a core SOC task.

Adjusting detection rules, thresholds, exclusions, and severity mappings so alerts reflect real risk. Tuning balances sensitivity against analyst workload and should be revalidated after environment changes.

Logic that combines multiple events or conditions across sources and time windows into a single higher-confidence alert, such as several failed logins followed by a success from a new location.

An observable artifact such as a file hash, domain, IP address, or registry key that suggests a compromise has occurred. IOCs are reactive and decay quickly as attackers change infrastructure.

A behavior or pattern indicating that an intrusion is in progress, such as credential dumping or lateral movement. IOAs focus on attacker technique rather than static artifacts, making them more durable than IOCs.

A public knowledge base of adversary tactics and techniques observed in real intrusions. SOC teams map detections to it to find coverage gaps and to describe incidents in a shared vocabulary.

Proactive, hypothesis-driven searching through telemetry for evidence of compromise that existing detections missed. Findings feed new detection rules and improved visibility rather than immediate blocking alone.

A continuously updated source of indicators, reputation data, and adversary context that security devices consume to block or flag known-bad infrastructure. Feed quality and staleness directly affect false positive rates.

Configuring a device to send its event logs to an external collector such as a SIEM or syslog server. Reliable forwarding, correct time synchronization, and adequate retention are prerequisites for investigation.

A standard protocol and message format for transmitting event logs over the network, commonly to UDP or TCP port 514 or an encrypted alternative. Severity and facility fields let receivers filter and route messages.

An ordered rule set that matches traffic by source, destination, service, user, and application, then applies an action such as allow, deny, or inspect. Ordering and implicit deny behavior determine actual outcomes.

A bundle of inspection settings such as antivirus, intrusion prevention, web filtering, and application control attached to a policy. Profiles apply only to traffic the policy permits, so placement matters.

Inspection that detects known exploit and attack signatures in traffic and can block matching sessions. Signature action, severity thresholds, and anomaly settings determine whether traffic is dropped or only logged.

Decrypting TLS traffic, inspecting the plaintext, then re-encrypting it. Without it, encrypted malicious payloads pass uninspected; certificate trust, exemptions, and privacy rules must be planned carefully.

A client-side control that accepts only a specific certificate or public key for a destination. Pinned applications break under interception, so they typically require inspection exemptions or dedicated handling.

Rewriting source or destination addresses and ports as packets traverse a device. Policy lookup order relative to NAT, plus address objects used in rules, frequently causes unexpected allow or deny results.

The set of routes a device uses to choose an outgoing interface and next hop for a destination. Longest-prefix match, administrative distance, and policy routes all influence the forwarding decision.

A rule that overrides the routing table for matching traffic, often to steer specific sources or applications out a chosen interface. It is evaluated before normal destination-based lookup.

The default drop applied to traffic that matches no explicit rule. Because it is invisible in the rule list, troubleshooting often starts by confirming whether a matching rule exists at all.

Software-defined wide area networking that selects paths per application using link quality measurements such as latency, jitter, and packet loss. Rules define which traffic uses which member links and failover behavior.

A health check that measures latency, jitter, and loss toward a target to decide whether a WAN link meets a performance threshold. Failed probes trigger steering or failover to another member.

An access model that grants users reach to specific applications rather than the whole network, after verifying identity and device posture per session. It replaces broad VPN-style network access with per-application tunnels.

A converged cloud-delivered architecture combining network connectivity services with security inspection at the edge nearest the user. It shifts policy enforcement from the data center to a global points-of-presence fabric.

A proxy that filters outbound web traffic by URL category, reputation, and content, and applies antivirus and file controls. It enforces acceptable-use and blocks access to malicious or prohibited sites.

A control layer that discovers sanctioned and unsanctioned cloud applications, enforces usage policy, and inspects data moving to SaaS. It addresses shadow IT and data exposure outside the traditional perimeter.

Cloud services and applications adopted by users without IT approval or visibility. Discovery and classification of these services is a prerequisite for deciding whether to block, monitor, or sanction them.

The assessed security state of an endpoint, including OS patch level, disk encryption, antivirus status, and management enrollment. Posture checks gate access decisions in zero trust policy.

Detection and control of sensitive data such as personal identifiers, card numbers, or source code leaving approved boundaries. Rules match patterns or fingerprints and can block, quarantine, or just log.

Labeling information by sensitivity so that handling, retention, and transfer rules can be applied consistently. Effective DLP depends on accurate classification rather than pattern matching alone.

Continuous assessment of cloud configurations against benchmarks and policy to find public storage, overly permissive roles, and missing encryption. It reports drift and prioritizes remediation by risk.

Agent-based or API-based monitoring of virtual machines and containers for malware, file integrity changes, and runtime behavior. It extends host-level detection into environments where perimeter controls do not apply.

Granting only the permissions needed for a task, for the shortest practical duration. It limits blast radius when credentials leak and is a recurring finding in cloud posture assessments.

A document defining who may perform which actions on which resources under what conditions. Misconfigured wildcards and trust relationships are common causes of cloud privilege escalation.

Hardware and software that monitor or control physical processes, such as PLCs, RTUs, and HMIs. Availability and safety dominate design choices, so active scanning and abrupt blocking are used cautiously.

A reference architecture that segments industrial networks into levels from physical process up to enterprise IT, with controlled conduits between them. It guides zoning decisions and where to place enforcement points.

An IEC 62443 concept in which assets are grouped into zones of similar trust and connected only through defined, controlled conduits. Firewalls and gateways implement the conduit policy between zones.

An industrial controller that executes logic to drive machinery and processes. Many legacy PLCs use proprietary protocols with no authentication, so network segmentation is the primary protection.

A widely used industrial protocol for reading and writing registers on controllers. It lacks built-in authentication and encryption, so access must be restricted by network controls and monitored for anomalous writes.

Observing OT traffic by mirroring or tapping network segments without sending probes that could disturb fragile devices. It builds an asset inventory and baselines normal behavior for later anomaly detection.

Physical separation in which a network has no connection to other networks. It is the strongest isolation but is often eroded by maintenance laptops and removable media, which must themselves be controlled.