100 Words Every SOC Analyst Should Know

No.	Item	Definition
1.	account	User or service identity
2.	Active Directory	Microsoft identity directory service
3.	alert	Security notification needing review
4.	anomaly	Activity outside normal pattern
5.	artifact	Useful trace left by activity
6.	asset	Valuable system or resource
7.	authentication	Verifying identity
8.	authorization	Granting allowed access
9.	backdoor	Hidden method of access
10.	backup	Saved copy of data
11.	baseline	Normal activity reference point
12.	beacon	Periodic callback to attacker
13.	blocklist	Denied items list
14.	botnet	Network of compromised devices
15.	breach	Unauthorized access to data
16.	brute force	Trying many password guesses
17.	C2	Command and control
18.	certificate	Digital identity document
19.	ciphertext	Encrypted unreadable data
20.	confidentiality	Data kept from unauthorized access
21.	containment	Limiting spread of an incident
22.	correlation	Linking related events together
23.	credential	Login secret or proof
24.	DDoS	Distributed denial of service
25.	detection	Finding malicious activity
26.	DNS	Domain name lookup system
27.	domain	Administrative network realm
28.	EDR	Endpoint detection and response
29.	email	Electronic messaging system
30.	endpoint	User device on a network
31.	enumeration	Listing users, shares, services
32.	eradication	Removing threat from environment
33.	escalation	Passing issue to higher level
34.	exfiltration	Unauthorized data removal
35.	exploit	Code using a vulnerability
36.	false positive	Benign event flagged malicious
37.	firewall	Network traffic filtering system
38.	forensics	Investigation of digital evidence
39.	hardening	Reducing attack surface
40.	hash	Fixed-length data digest
41.	honeypot	Decoy system for attackers
42.	host	Network-connected computer
43.	HTTP	Web transfer protocol
44.	HTTPS	Encrypted web transfer protocol
45.	impact	Resulting harm or effect
46.	incident	A confirmed security event
47.	insider	Trusted person misusing access
48.	integrity	Data remains accurate, unchanged
49.	IOC	Indicator of compromise
50.	IP	Internet Protocol address
51.	keylogger	Tool that records keystrokes
52.	kill chain	Stages of an attack
53.	lateral movement	Attacker movement across systems
54.	least privilege	Minimum necessary access
55.	log	Recorded system or event data
56.	malware	Malicious software
57.	MFA	Multiple login verification factors
58.	misconfiguration	Unsafe or incorrect setup
59.	MITRE ATT&CK	Threat behavior knowledge base
60.	noise	Irrelevant or low-value data
61.	password	Secret used for login
62.	patch	Software fix for a flaw
63.	payload	Malicious code delivered by attack
64.	persistence	Ability to remain on system
65.	phishing	Fraudulent attempt to steal data
66.	playbook	Standard response procedure
67.	priority	Order of response importance
68.	privilege escalation	Gaining higher access rights
69.	quarantine	Isolate suspicious file or host
70.	query	Request for specific data
71.	ransomware	Malware that demands payment
72.	RDP	Remote desktop protocol
73.	reconnaissance	Information gathering before attack
74.	recovery	Restoring normal operations
75.	remediation	Fixing the root problem
76.	response	Action after detection
77.	rootkit	Malware hiding system compromise
78.	runbook	Step-by-step operational guide
79.	sandbox	Isolated environment for testing
80.	severity	Seriousness level of issue
81.	SIEM	Security information and event management
82.	signature	Known pattern for detection
83.	SMB	File sharing protocol
84.	social engineering	Manipulating people for access
85.	spoofing	Faking sender or source
86.	SSH	Secure remote shell protocol
87.	telemetry	Collected security event data
88.	threat	Potential cause of harm
89.	timeline	Ordered sequence of events
90.	TLS	Transport Layer Security
91.	token	Digital proof of identity
92.	triage	Prioritizing alerts or incidents
93.	trojan	Malware disguised as legitimate
94.	TTP	Tactics, techniques, procedures
95.	virus	Malware that infects files
96.	VPN	Encrypted remote network connection
97.	vulnerability	A weakness attackers can exploit
98.	worm	Self-spreading malware
99.	YARA	Pattern matching rule language
100.	zero-day	Unknown unpatched vulnerability