Defense & Operations
SIEM
Also known as: Security Information and Event Management
Definition
A platform that aggregates, normalizes and correlates security telemetry from across the enterprise to enable detection, investigation, compliance and reporting.
Examples
- Microsoft Sentinel correlating Azure AD sign-in failures with EDR alerts to detect password spraying.
- A Splunk correlation search that fires when a service account logs in from an unusual country.
Related terms
Security Operations Center (SOC)
A centralized team and facility that continuously monitors, detects, investigates and responds to cybersecurity incidents across an organization's IT estate.
SOAR
A platform that automates and orchestrates SOC workflows by chaining detections, enrichments and response actions into playbooks executed across security tools.
UEBA (User and Entity Behavior Analytics)
A security analytics approach that profiles normal behaviour of users and entities, then flags statistical deviations that may indicate compromise or insider misuse.
Log Analysis
Log Analysis — definition coming soon.
Threat Intelligence
Evidence-based knowledge about threats and threat actors — including indicators, TTPs and context — used to guide security decisions and detection.
Indicator of Compromise (IoC)
Indicator of Compromise (IoC) — definition coming soon.