XDR Analyst key terms

A platform approach that ingests and correlates telemetry from endpoints, networks, cloud workloads, email, and identity systems, then applies analytics and automation to detect, investigate, and respond to threats across those sources as one connected incident.

The process of linking events from different sensors by shared identifiers such as host, user, process, IP address, or time window, so that individually low-signal events combine into a single high-confidence detection narrative.

Normalizing and merging different representations of the same asset or person, such as a hostname, MAC address, cloud instance ID, and user principal name, into one identity so that activity across sources is attributed correctly.

Mapping raw vendor-specific event fields into a common schema so that queries, detections, and dashboards behave consistently regardless of which sensor produced the original record.

The disciplined practice of designing, testing, versioning, and tuning detection logic against known adversary behaviors, with measurable coverage and false-positive targets rather than ad hoc alert creation.

Managing detection rules in a version-controlled repository with peer review, automated testing, and CI/CD deployment, so changes are auditable and regressions are caught before production rollout.

Agent-based security software that continuously records process, file, registry, network, and memory activity on an endpoint, enabling behavioral detection, threat hunting, and remote containment actions on that host.

A hierarchical view of parent-child process relationships on a host, used to spot anomalous lineage such as a word processor spawning a command shell or a web server launching encoded PowerShell.

Capturing the full command line and arguments of executed processes, which often reveals intent such as encoded payloads, credential dumping flags, or script download URLs that the executable name alone would hide.

Legitimate, often signed system utilities such as certutil, mshta, or rundll32 that adversaries abuse to download payloads, execute code, or bypass controls while blending into normal administrative activity.

Remotely interacting with an endpoint through the EDR agent to run commands, collect volatile artifacts, isolate the host, or terminate processes, without needing physical or RDP access.

A containment action that cuts an endpoint off from the network except for the management channel, stopping lateral movement and exfiltration while preserving analyst access for investigation.

Malicious activity that runs in memory or through trusted interpreters such as PowerShell, WMI, or .NET rather than dropping an executable to disk, weakening signature-based detection and leaving fewer artifacts.

A Windows logging feature that records the content of PowerShell script blocks as they execute, capturing deobfuscated code that command-line logging alone would miss.

Summarized metadata about connections, such as source and destination IP, ports, protocol, byte counts, and timestamps, useful for spotting beaconing, scanning, and large transfers without full packet capture.

Examining connection timing and size patterns for regular, low-volume callbacks to the same destination, a hallmark of command-and-control channels that periodic jitter may partially disguise.

Code that produces large numbers of pseudo-random domain names so malware can locate its controller without a hardcoded address; detection relies on lexical patterns and high volumes of failed DNS lookups.

Encoding data inside DNS queries and responses to bypass egress controls, often visible as unusually long or high-entropy subdomains, excessive TXT or NULL record queries, and one domain contacted at high volume.

Storing complete packet payloads for retrospective analysis, which supports deep protocol inspection and evidence collection but demands significant storage and privacy controls compared with flow metadata.

Audit records of management actions in a cloud environment, such as identity changes, permission grants, key creation, and resource deletion, which reveal attacker attempts to persist or expand access.

Runtime signals from containers, serverless functions, and virtual machines, including process execution, syscalls, and outbound connections, used to detect compromise inside workloads rather than at the cloud API layer.

Techniques that break out of container isolation to reach the host or other tenants, often flagged by privileged container starts, host filesystem mounts, or unexpected kernel-level activity.

Behavioral analysis of authentication and authorization events, such as impossible travel, new device enrollment, MFA fatigue, and privilege changes, to detect account takeover and insider misuse.

A detection that flags successive successful sign-ins from geographically distant locations within a timeframe that makes physical travel infeasible, suggesting stolen credentials or session hijacking.

Repeatedly pushing authentication prompts to a victim until they approve one out of annoyance or confusion, sometimes paired with help-desk social engineering to enroll a new authenticator.

A phishing setup that proxies the real login page so the victim authenticates legitimately while the attacker captures the session cookie, defeating MFA that only protects the initial sign-in.

Stealing OAuth or session tokens so an attacker can replay them to access resources as the victim, often evading password and MFA controls until the token expires or is revoked.

Three DNS-based controls: SPF authorizes sending IPs, DKIM cryptographically signs messages, and DMARC ties them to the visible From domain and tells receivers how to handle failures.

Fraud in which an attacker takes over or spoofs a trusted mailbox to redirect payments or extract data, typically using conversational context, reply-chain hijacking, and no malware at all.

A concrete observable such as a file hash, IP address, domain, or registry key associated with known malicious activity; easy to share but short-lived because attackers rotate them.

A description of adversary technique or pattern, such as credential dumping via LSASS access, that stays relevant longer than atomic indicators and is harder for an adversary to change cheaply.

Tagging detections and observed activity to a structured catalog of adversary tactics and techniques, which exposes coverage gaps and gives analysts a shared vocabulary for reporting.

A system that ingests, deduplicates, scores, and distributes indicator and actor data to detection tools, managing confidence and expiry so stale indicators do not generate noise.

Assigning a reliability value to intelligence or a detection based on source quality, corroboration, and age, so analysts can prioritize high-fidelity findings and avoid acting on unverified data.

Proactively searching telemetry for a specific, testable adversary behavior derived from intelligence or ATT&CK gaps, then converting successful queries into durable detections.

A chronological reconstruction of events across all telemetry sources that establishes initial access, scope, lateral movement, and dwell time, forming the backbone of triage and reporting.

Establishing which accounts, hosts, and cloud resources an intrusion touched, using shared indicators and identity links, so containment and remediation cover the full extent rather than one alert.

Short-term actions that stop an intrusion from spreading, such as isolating hosts, disabling accounts, or blocking infrastructure, chosen to limit damage while preserving evidence for investigation.

Encoding response steps, such as enriching an alert, disabling a user, or isolating a host, as automated workflows that run consistently and free analysts for judgment-heavy decisions.

Adjusting detection logic, thresholds, allowlists, or enrichment so benign activity stops triggering alerts, done carefully to avoid suppressing the malicious behavior the rule was meant to catch.