Palo Alto SecOps Professional key terms

A security orchestration, automation, and response platform that ingests alerts, runs playbooks, and manages incidents from a single console. It connects to many tools through integrations and supports both automated and analyst-driven workflows.

A platform that unifies SIEM, SOAR, attack surface management, and threat intelligence on one data layer. It applies machine learning to correlate and prioritize alerts, aiming to reduce manual triage and consolidate separate security consoles.

A cloud-delivered logging and analytics service that stores firewall, endpoint, and threat data. It supports long retention, fast querying, and feeds dashboards and Cortex XSOAR or XSIAM workflows with normalized telemetry.

A configurable category in Cortex XSOAR that defines the layout, fields, and default playbook for a class of incident. Each type controls how incoming alerts are displayed and which automation starts automatically.

A named data attribute on an incident, such as severity, source IP, or affected user. Fields can be custom, drive layouts and searches, and be referenced by playbook tasks and scripts.

The visual arrangement of incident fields, tabs, and sections shown to analysts. Layouts can be bound to incident types so each alert class displays only the most relevant information during triage.

A configured connection to an external product, holding the server URL, credentials, and parameters needed for commands. Multiple instances of one integration can run side by side, for example for separate tenants or regions.

A named operation exposed by an integration, such as querying an endpoint or blocking a hash. Playbooks and scripts call commands to perform actions and return structured results.

A structured workflow of tasks, conditions, and scripts that automates investigation or response steps. Playbooks can run automatically on new incidents or be triggered manually by analysts.

A single step inside a playbook, such as running a command, a script, a manual action, or a decision branch. Tasks define inputs, outputs, and conditions that determine the next step.

The rule that decides when a playbook starts, for example on incident creation, a field change, or a schedule. Triggers can filter by incident type, severity, or custom query so only matching incidents launch automation.

A playbook step that evaluates a script or expression and routes execution down one of several branches. It enables decision logic such as escalating only when a hash is found malicious.

In Cortex XSOAR, a reusable script or workflow component that playbooks invoke to transform data, call integrations, or make decisions. Automations reduce repetitive manual steps and standardize analyst actions.

The scheduled process by which an integration pulls new alerts from an external system into the platform. Fetch configuration controls the query, interval, deduplication, and mapping into incident fields.

The collection and transport of event data from sources such as firewalls, endpoints, and cloud services into the analytics platform. Ingestion may use brokers, collectors, or APIs and must handle parsing and normalization.

A lightweight virtual machine that mediates traffic between on-premises log sources and the cloud platform. It collects, buffers, and forwards events when direct internet connectivity from devices is impractical.

A component or group of components that receives logs from sources and forwards them for parsing and storage. Collectors can be deployed on-premises or in the cloud and are assigned to specific log sources.

The normalized schema that maps raw vendor fields into common event categories and attributes. A consistent model lets queries, correlation rules, and dashboards work across heterogeneous data sources.

Logic that extracts fields from raw log text and maps them to the normalized data model. Correct parsing is required for search, correlation, and detection to work on ingested events.

A logical grouping of normalized event or alert data that queries target. Datasets let analysts search a specific telemetry category, such as authentication or network traffic, without scanning everything.

A query language used to search and analyze ingested security data. It supports filtering, aggregation, joins, and time-based functions, and is used for hunting, dashboards, and detection logic.

A detection that evaluates a query against streaming or stored data and raises an alert when conditions match. Rules can group events, apply thresholds, and map results to incident fields.

A signal generated by a detection rule, analytic, or external source indicating possible malicious or anomalous activity. Alerts are triaged, enriched, and may be promoted into incidents for full investigation.

A tracked case that groups related alerts, evidence, and analyst actions for investigation and response. Incidents carry severity, status, owners, and linked artifacts, and are the unit automation operates on.

The initial assessment of an alert to decide whether it is a true threat, its severity, and what response is needed. Effective triage uses enrichment, deduplication, and clear escalation criteria.

A ranked value expressing how urgent or damaging an incident or alert is. Severity often drives routing, SLA targets, and which playbooks or notifications are triggered.

The process of adding context to an indicator or incident, such as reputation, geolocation, WHOIS, or sandbox results. Enrichment helps analysts decide quickly whether activity is benign or malicious.

An observable value associated with potential threats, such as an IP address, domain, file hash, or URL. Indicators are stored, scored, and correlated against telemetry to support detection and hunting.

Curated information about adversaries, campaigns, and indicators used to inform detection and response. It may come from commercial feeds, open sources, or internal research and is often scored for confidence and relevance.

A recurring source of indicators and context delivered in a structured format. Feeds are ingested, normalized, and often scored so analysts can weigh reliability and freshness.

A policy that ages out indicators after a set period or when confidence drops. Expiration prevents stale data from generating false positives and keeps detection logic aligned with current threats.

A proactive, hypothesis-driven search for adversary activity that evaded existing detections. Hunters use queries, telemetry, and intelligence to find patterns, then convert findings into new detections.

A knowledge base of adversary tactics and techniques observed in real intrusions. It provides a common vocabulary for mapping detections, prioritizing coverage gaps, and structuring threat hunting.

A collaborative workspace on an incident where analysts view evidence, run commands, chat, and track tasks. It keeps investigation history and artifacts in one place for handoffs and audits.

Files, entries, or notes attached to an incident that support analysis, such as logs, screenshots, or command output. Evidence is retained with the incident for review, reporting, and audit trails.

A defined target for response or resolution time based on incident severity or type. Breaches are tracked and reported so teams can measure operational performance and prioritize overdue work.

The process of identifying and merging duplicate alerts or indicators so one real-world event does not create many redundant cases. It reduces analyst workload and keeps incident counts meaningful.

A rule that suppresses known-benign activity from generating alerts or incidents. Exclusions should be scoped narrowly and reviewed regularly to avoid hiding genuine threats.