OSDA key terms

A team and facility responsible for continuously monitoring, detecting, investigating, and responding to security events across an organization, typically organized in tiers from alert triage to deep incident analysis.

The first-pass review of a security alert to decide whether it is a true positive, a false positive, or needs escalation, based on severity, context, and available evidence.

A platform that collects logs and events from many sources, correlates them against detection rules, and surfaces alerts through dashboards and search for analysts to investigate.

A documented, repeatable sequence of steps analysts follow for a specific alert type or incident scenario, defining who does what, which tools to use, and when to escalate.

A low-level operational procedure describing the exact commands, queries, or clicks needed to complete a task, often embedded within or referenced by a broader playbook.

The phased process of preparing for, identifying, containing, eradicating, recovering from, and learning from a security incident, used to structure and track response work.

Actions taken to limit the spread and impact of an active incident, such as isolating a host, disabling an account, or blocking network traffic, before eradication and recovery.

The response phase in which the root cause of an incident is removed, for example by deleting malware, patching the exploited flaw, or rebuilding a compromised system.

A post-incident review that documents what happened, what worked, what failed, and which detection, process, or control improvements should follow, often producing tracked action items.

A documented record of who collected, handled, transferred, and stored evidence, and when, so that its integrity can be defended in an investigation or legal proceeding.

An alert that fires on activity that is actually benign, consuming analyst time and, if frequent enough, eroding trust in the detection that produced it.

Malicious or policy-violating activity that occurs without generating any alert, representing a detection gap that attackers can exploit if it remains unknown.

A platform that automates repetitive SOC tasks such as enrichment, ticket creation, and containment actions by connecting tools through scripted workflows triggered by alerts.

Adjusting detection logic, thresholds, exclusions, or data sources to reduce noise while preserving true detections, usually driven by evidence from alert review.

A public knowledge base of adversary tactics and techniques observed in real intrusions, used to describe attacker behavior and map detections to specific methods.

In ATT&CK, the adversary's immediate goal at a stage of an intrusion, such as initial access, persistence, or exfiltration; techniques are grouped under each tactic.

In ATT&CK, a specific method an adversary uses to achieve a tactic, such as phishing for initial access or scheduled tasks for persistence, often with sub-techniques.

A forensic artifact such as a malicious file hash, domain, IP address, or registry key that suggests a system has been compromised and can be used for detection and blocking.

Evidence of adversary behavior or intent in progress, such as unusual process parentage or credential dumping attempts, which is generally more durable than static artifacts.

Detection logic that identifies malicious activity from patterns of action, such as process relationships or unusual command lines, rather than from fixed file or network signatures.

Detection that matches known patterns, such as malware hashes or byte sequences, against observed activity; reliable for known threats but blind to novel variants.

A regularly updated source of threat data, such as malicious IPs, domains, or hashes, that can be ingested into security tools to enrich alerts and block known bad infrastructure.

The process of adding context to an indicator, such as reputation, geolocation, WHOIS data, or related campaigns, so an analyst can judge whether it is truly malicious.

The collection and normalization of log data from endpoints, servers, network devices, and cloud services into a central platform for search, correlation, and retention.

Detection logic that combines multiple events or conditions across sources within a time window to identify a pattern that no single event would reveal.

The discipline of designing, testing, deploying, and maintaining detection content, measured by coverage of relevant threats and by alert quality rather than alert volume.

The degree to which an organization's monitoring can observe and alert on relevant adversary techniques, often visualized by mapping existing detections against ATT&CK techniques.

A weakness in software, configuration, or process that could be exploited to compromise confidentiality, integrity, or availability of a system or its data.

A public catalog that assigns a unique identifier to each disclosed vulnerability, enabling consistent reference across scanners, vendors, and advisories.

A standardized framework for scoring the technical severity of a vulnerability, typically from 0 to 10, based on exploitability and impact characteristics rather than organizational context.

The potential for loss or harm from a threat exploiting a vulnerability, commonly assessed as a function of likelihood and impact and reduced through controls or remediation.

The structured process of identifying assets, threats, and vulnerabilities and estimating the likelihood and impact of harm to prioritize treatment decisions.

The risk that remains after controls and remediation have been applied, which an organization must consciously accept, transfer, or further reduce.

Automated probing of systems and applications to identify known weaknesses, missing patches, and misconfigurations, producing findings that feed remediation workflows.

The lifecycle of identifying, testing, deploying, and verifying software updates that fix vulnerabilities, balanced against operational risk and change control requirements.

Code or a technique that takes advantage of a vulnerability to achieve an attacker's objective, such as remote code execution or privilege escalation.

How practical it is for an attacker to actually exploit a given vulnerability, considering factors such as public exploit availability, attack complexity, and required access.

An agent-based tool that continuously records endpoint activity such as process creation and network connections, enabling behavioral detection, investigation, and remote response actions.

A response action that cuts an endpoint off from most network communication while preserving the security agent's connection, limiting malware spread during investigation.

A network control that permits or denies traffic between zones based on rules such as source, destination, port, and protocol, enforcing segmentation policy.

Intrusion detection systems passively monitor traffic and alert on suspicious patterns, while intrusion prevention systems sit inline and can actively block matching traffic.

Dividing a network into isolated zones with controlled traffic between them, so that a compromise in one zone cannot freely reach sensitive systems in another.

An attacker technique that abuses legitimate built-in tools such as PowerShell or Windows Management Instrumentation to operate without dropping obvious malware binaries.

The principle of granting users, services, and processes only the access needed to perform their function, and no more, to limit the blast radius of compromise or error.

Gaining a higher level of access than originally granted, either by exploiting a flaw to move from user to administrator or by abusing misconfigured permissions.

An access model where permissions are assigned to roles rather than individuals, and users receive access by being placed into the appropriate roles.

Authentication requiring two or more independent factors, such as a password plus a hardware token or push approval, reducing the value of a stolen password.

An attack that repeatedly triggers push notifications or prompts until a user approves one, granting the attacker access with valid but stolen credentials.

Extracting stored password hashes or secrets from a system, such as from memory or credential stores, to reuse them for lateral movement or privilege escalation.

Techniques an attacker uses to move from one compromised host or account to others in the environment, often reusing credentials and remote administration tools.

A periodic audit confirming that each account's permissions are still required and appropriate, removing stale, excessive, or orphaned access before it can be abused.