OSDA flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

SOC Tier 1 analyst

Front-line role that monitors the alert queue, validates whether alerts are true or false positives, gathers initial evidence, and escalates confirmed incidents to Tier 2.

Mean time to detect

Average elapsed time between the occurrence of a security event and its detection by monitoring. Lower values indicate faster detection coverage across log sources and rules.

Chain of custody

Documented record of who collected, handled, and stored evidence, with timestamps and hashes, proving artifacts were not altered between collection and analysis.

Incident containment

Phase that stops the spread of an intrusion, for example by isolating hosts or disabling accounts, performed before eradication and recovery to preserve control.

Escalation severity matrix

Decision rule combining assessed impact with confidence in the evidence to assign priority levels, ensuring high-impact confirmed events reach senior responders first.

SOC runbook

Predefined procedure listing trigger conditions, data sources, triage steps, escalation contacts, and closure criteria so responders handle a given alert class consistently.

MITRE ATT&CK tactics

Adversary goals such as Initial Access, Persistence, Privilege Escalation, and Exfiltration. Techniques under each tactic describe how the goal is achieved and guide detection coverage.

Sigma rule

Vendor-neutral, YAML-based format describing log-based detection logic that can be converted into queries for multiple SIEM platforms, improving portability of detections.

YARA rule

Pattern-matching rule using strings and conditions to identify malware families in files or memory, commonly used in malware analysis and threat hunting.

Pyramid of Pain

Model ranking indicators by how much adversary cost their detection imposes. Hashes and IPs are low value; tactics, techniques, and procedures are highest.

Living-off-the-land binary

Signed legitimate system tool such as certutil or rundll32 abused by attackers to download, execute, or evade detection without introducing custom malware.

Command and control beaconing

Regular, periodic outbound connections to an external host with consistent intervals and payload sizes, a pattern suggesting compromised hosts checking in with attacker infrastructure.

Event normalization

Mapping raw logs from different sources into a common field schema and UTC timestamps so events can be correlated and queried consistently across the SIEM.

CVSS base score

Numeric severity 0.0 to 10.0 derived from exploitability and impact metrics of a vulnerability, independent of temporal and environmental factors at a specific organization.

EPSS score

Estimated probability that a vulnerability will be exploited in the wild within the next 30 days, used alongside severity scores to prioritize remediation effort.

CISA KEV catalog

Authoritative list of vulnerabilities with confirmed exploitation in the wild. Membership signals urgent remediation need and outranks raw severity scoring.

Risk calculation

Risk equals likelihood multiplied by impact. A lower-severity flaw on an exposed, business-critical asset can outrank a critical flaw on an isolated host.

Authenticated vulnerability scan

Scan using valid credentials to inspect installed software and configuration directly, producing fewer false positives and more accurate patch-level findings than unauthenticated scanning.

Compensating control

Alternative safeguard such as segmentation, a web application firewall rule, or a disabled service that reduces risk when a vulnerability cannot be patched immediately.

False negative in scanning

A scan result that fails to report a vulnerability that actually exists. This is more dangerous than a false positive because it creates silent exposure.

EDR telemetry

Endpoint sensor data covering process creation, file and registry changes, network connections, and memory activity, enabling behavioral detection beyond signature matching.

Sysmon Event ID 1

Windows process creation event recording image path, command line, parent process, user, and hashes, a primary data source for detecting suspicious execution.

IDS versus IPS

An intrusion detection system alerts on suspicious traffic passively; an intrusion prevention system sits inline and blocks it, so false positives can disrupt legitimate business traffic.

Network segmentation

Dividing a network into isolated zones with controlled inter-zone traffic, limiting how far an attacker can move laterally after compromising a single host.

Application allowlisting

Control that permits execution only of explicitly approved binaries, blocking unknown or unsigned software regardless of whether a signature exists for it.

JA3 fingerprint

Hash of TLS client hello parameters used to identify client applications in encrypted traffic without decryption, useful for detecting malware families and tooling.

Zero trust

Security model that grants no implicit trust based on network location; every access request is authenticated and authorized continuously regardless of source subnet.

Role-based access control

Model assigning permissions to roles rather than individuals, with users placed in roles, simplifying administration and supporting least privilege and access reviews.

Multi-factor authentication

Authentication requiring two or more distinct factor types, such as a password plus a hardware token. Two passwords or a password plus security question do not qualify.

Kerberoasting

Attack requesting service tickets for accounts with service principal names and cracking them offline. Mitigated by long random service passwords and group managed service accounts.

Vertical privilege escalation

Gaining access to a higher privilege level than the current account holds, for example a standard user obtaining administrator or domain administrator rights.

Active Directory tiering

Model separating Tier 0 identity systems, Tier 1 servers, and Tier 2 workstations so credentials from lower tiers never authenticate to higher-tier systems.

Separation of duties

Control requiring that no single identity can both request and approve a sensitive action, such as granting privileged access, reducing fraud and insider risk.