Alert fatigue
When security teams receive so many alerts, many of them false, that real threats get missed or ignored.
Related: SOC analyst, False positive, SOAR
SOC & Threat Detection
Glossary category
SOC & Threat Detection
How security teams monitor, detect and respond to attacks around the clock.
24 terms
Terms in SOC & Threat Detection
DFIR
Digital Forensics and Incident Response
Digital forensics and incident response: investigating how an attack happened, preserving evidence and recovering from it.
Related: Incident response, IOC, Ransomware
SOC & Threat Detection
EDR
Endpoint Detection and Response
Software on laptops and servers that records activity, detects malicious behaviour and lets security teams investigate and contain threats on the device.
SOC & Threat Detection
False positive
An alert that flags harmless activity as malicious.
Related: Alert fatigue, SIEM, SOC
SOC & Threat Detection
Honeypot
A decoy system set up to attract attackers so their methods can be detected and studied.
Related: Threat intelligence, Lateral movement, Threat hunting
SOC & Threat Detection
Incident response
The structured process of preparing for, detecting, containing, removing and recovering from a cyber attack.
SOC & Threat Detection
IOA
Indicator of Attack
Signs of attacker behaviour in progress, such as credential dumping, that point to an attack before damage is done.
Related: IOC, Threat hunting, MITRE ATT&CK
SOC & Threat Detection
IOC
Indicator of Compromise
Evidence that a system has been compromised, such as a malicious file hash, IP address or domain.
Related: IOA, Threat intelligence, Threat hunting
SOC & Threat Detection
Log management
Collecting, storing and searching the logs produced by systems and applications for security, troubleshooting and compliance.
Related: SIEM, Audit trail, CERT-In directions
SOC & Threat Detection
MDR
Managed Detection and Response
A service where an external team of security analysts monitors your environment 24x7, investigates threats and responds to them on your behalf.
SOC & Threat Detection
MITRE ATT&CK
A public knowledge base that catalogues the tactics and techniques attackers use, widely used to map and test defences.
Related: Threat hunting, IOA, Lateral movement
SOC & Threat Detection
MTTD / MTTR
Mean Time to Detect / Mean Time to Respond
Mean time to detect and mean time to respond: how long, on average, it takes to spot an incident and to contain it.
SOC & Threat Detection
MXDR
Managed Extended Detection and Response
A managed service in which a provider runs XDR for you, adding 24x7 analysts who hunt, investigate and respond across your whole environment.
SOC & Threat Detection
NDR
Network Detection and Response
Technology that analyses network traffic to spot suspicious behaviour, such as an attacker moving between systems.
SOC & Threat Detection
Security playbook
A step-by-step guide that defines how to respond to a specific type of security incident.
Related: SOAR, Incident response
SOC & Threat Detection
SIEM
Security Information and Event Management
A system that collects logs and security events from across an organisation, correlates them and raises alerts on suspicious activity.
Related: SOAR, UEBA, Log management
SOC & Threat Detection
SOAR
Security Orchestration, Automation and Response
Tools that automate and coordinate security tasks, such as enriching alerts or isolating a device, using predefined playbooks.
Related: SIEM, Security automation, SOC
SOC & Threat Detection
SOC
Security Operations Center
A team, with its processes and tools, that monitors an organisation's systems around the clock to detect, investigate and respond to cyber threats.
Related: SOC analyst, SIEM, MDR
SOC & Threat Detection
SOC analyst
A security professional who monitors alerts, investigates suspicious activity and escalates or responds to incidents in a SOC.
Related: SOC, Alert fatigue, SIEM
SOC & Threat Detection
Threat detection and response
The combined practice of identifying cyber threats and acting quickly to contain and remove them.
SOC & Threat Detection
Threat hunting
Proactively searching through systems and data for attackers who have slipped past automated security controls.
Related: MDR, Threat intelligence, IOC
SOC & Threat Detection
Threat intelligence
Evidence-based information about attackers, their tools and their targets, used to detect and prevent attacks.
Related: IOC, Threat hunting, APT
SOC & Threat Detection
UEBA
User and Entity Behavior Analytics
Analytics that learn normal behaviour for users and devices and flag unusual activity that may indicate a threat.
Related: SIEM, Insider threat, ITDR
SOC & Threat Detection
XDR
Extended Detection and Response
A security platform that collects and correlates data from endpoints, network, cloud, email and identity to detect and respond to threats in one place.
SOC & Threat Detection
How NetNXT covers soc & threat detection
These terms describe the work our Managed SOC service does for clients. The service page sets out what it includes.