Cybersecurity Glossary
Master the Language of Security Operations
79+ essential definitions for SOC analysts and security professionals. Every term maps to real SOC training operations you can practice free.
What Is a Cybersecurity Glossary?
A cybersecurity glossary is a curated reference of terms, acronyms, and concepts used across Security Operations Centers (SOCs), incident response teams, and threat intelligence programs. For analysts starting their careers, mastering this vocabulary is the fastest way to decode alerts, communicate with senior staff, and navigate security tools with confidence.
This glossary focuses on operational terms: the tools you will use daily (SIEM, XDR, EDR), the threats you will triage (phishing, ransomware, lateral movement), and the frameworks that structure your work (MITRE ATT&CK®, NIST, defense in depth). Each definition includes real SOC context so you understand not just what a term means, but how it shapes your workflow.
- SOC Glossary
- A structured reference of cybersecurity terminology organized by category, with each term including a definition, extended explanation, SOC operational relevance, and links to related concepts. Designed for SOC analysts who need to understand the language of their tools, threats, and processes.
Browse by Category
Tools(15)
Security Information and Event Management (SIEM) is a platform that aggregates, normalizes, and correlates log data from…
Extended Detection and Response (XDR) is a security platform that unifies telemetry from endpoints, networks, cloud work…
EDR (endpoint detection and response) is security software that puts an agent on each laptop, server and workstation, re…
SOAR (security orchestration, automation and response) is software that runs a SOC's repeatable response steps as playbo…
An intrusion detection system (IDS) is a security tool that watches network traffic or host activity, compares it agains…
An Intrusion Prevention System (IPS) is an active network security control deployed inline that inspects traffic in real…
A Web Application Firewall (WAF) is a security control between clients and web applications that inspects HTTP/HTTPS tra…
A Next-Generation Firewall (NGFW) combines traditional stateful packet inspection with deep packet inspection, applicati…
A firewall is a network security control that inspects traffic crossing a boundary and permits or denies it against a co…
Data Loss Prevention (DLP) is a set of technologies and policies that detect and prevent unauthorized transmission, stor…
NDR (network detection and response) is security software that analyzes network traffic, as raw packets or flow metadata…
MDR (managed detection and response) is a security service in which an outside provider's analysts watch your alerts aro…
UEBA (user and entity behavior analytics) builds a baseline of normal activity for each user, host, IP address and appli…
A honeypot in cyber security is a decoy system, service or credential that no legitimate user has a reason to touch, so …
A cloud access security broker (CASB) is a control point between users and the cloud services they use. It finds the Saa…
Concepts(20)
In cyber security, an indicator of compromise (IOC) is forensic evidence, such as a file hash, IP, or domain, that links…
Indicators of attack (IOAs) are behaviors that show an attack in progress, such as Word launching PowerShell or a web se…
TTPs (tactics, techniques and procedures) describe how a threat actor operates. The tactic is the goal at a given stage,…
A false positive in cyber security is an alert that flags benign activity as malicious: the rule fired, but nothing it w…
A true positive is a security alert that correctly identifies genuine malicious activity or a real policy violation. It …
Alert triage is how a SOC sorts each alert: a Tier 1 analyst checks its context and severity, then calls it a true, fals…
Threat intelligence is analyzed, contextualized information about current and emerging cyber threats, including threat a…
The cyber kill chain is Lockheed Martin's seven-phase model of a targeted intrusion: reconnaissance, weaponization, deli…
Defense in depth in cyber security stacks independent controls so that one failed or bypassed control does not hand an a…
Zero Trust is a security architecture philosophy based on "never trust, always verify," requiring continuous authenticat…
The principle of least privilege states that users, processes, and systems should hold only the minimum access rights re…
In cyber security, the attack surface is every point where an attacker could get into your environment, affect it, or ta…
MFA (multi-factor authentication) is a sign-in check that asks for two or more different kinds of proof before granting …
MTTD (mean time to detect) is the average time from the start of malicious activity to its detection: total detection ti…
MTTR (mean time to respond) is the average time from detecting a security incident to the first action that contains it …
In cyber security, the blue team is the group that defends an organization's systems: SOC analysts, incident responders,…
Sandboxing in cyber security is running an untrusted file, link or script inside an isolated, instrumented machine to wa…
A zero-day is a software vulnerability that attackers exploit before the vendor has shipped a fix, so defenders have had…
Zero Trust Network Access (ZTNA) is an access model that grants users connectivity to specific applications only after v…
Secure Access Service Edge (SASE) is a cloud-delivered architecture that converges networking and security functions, SD…
Threats(21)
Phishing is a social engineering attack delivered via email, SMS, voice calls, or other channels that deceives recipient…
A brute force attack is password guessing at scale: a tool submits candidate passwords, or encryption keys, until one wo…
Lateral movement is the attack phase where adversaries expand access from an initial foothold to additional systems, usi…
Privilege escalation is an attacker gaining rights they were never given, after they already have a foothold. Vertical e…
Persistence is the set of techniques an adversary uses to keep access to a compromised system after whatever gave them t…
Command and Control (C2) refers to the infrastructure and communication channels adversaries use to remotely direct malw…
Data exfiltration in cyber security is the unauthorized transfer of data from an organization's systems to infrastructur…
Ransomware is malware that encrypts victim data or systems and demands payment, typically cryptocurrency, for the decryp…
An advanced persistent threat (APT) is a well-resourced adversary, often state-backed, that picks a specific organizatio…
An insider threat is a security risk originating from current or former employees, contractors, or business partners who…
A supply chain attack compromises a trusted third-party vendor, software build process, open-source component, or hardwa…
In cyber security, social engineering means manipulating a person into handing an attacker access, information or money,…
A threat actor is a person or group that carries out or sponsors malicious cyber activity, from state intelligence units…
Fileless malware is malicious code that runs in memory through tools the operating system already trusts, such as PowerS…
Living-off-the-land (LOTL) is an attack technique where an adversary carries out reconnaissance, lateral movement, or ex…
Credential stuffing is an automated attack in which an adversary takes large lists of username-and-password pairs leaked…
Password spraying is an attack that tries one common password, such as Spring2026!, against many accounts before moving …
A Distributed Denial of Service (DDoS) attack floods a target network, service, or application with traffic or requests …
A botnet is a network of compromised computers, routers or IoT devices that an attacker controls remotely through comman…
A Trojan, short for Trojan horse, is malware disguised as something the victim wants to run: a cracked game, an invoice,…
Pretexting is a social engineering technique in which an attacker invents a believable scenario, the pretext, and plays …
Frameworks(7)
MITRE ATT&CK® is a globally accessible knowledge base of adversary tactics and techniques observed in real-world cyberat…
The NIST Cybersecurity Framework (CSF) is a voluntary risk management framework developed by the US National Institute o…
The CIS Controls (CIS Critical Security Controls) are 18 prioritized groups of defensive actions published by the Center…
The Diamond Model of Intrusion Analysis is a framework for describing any intrusion event through four connected feature…
The Open Web Application Security Project (OWASP) is a nonprofit producing freely available security resources, most not…
A CVE (Common Vulnerabilities and Exposures) is a unique identifier assigned to a publicly disclosed software or hardwar…
The Common Vulnerability Scoring System (CVSS) is an open standard for rating the severity of a software vulnerability o…
Processes(16)
Incident response (IR) is how a security team detects, contains, removes and recovers from an incident, then learns from…
Threat hunting is the proactive search through security telemetry for attackers that existing controls missed. The hunte…
Digital forensics is the scientific process of collecting, preserving, analyzing, and presenting digital evidence from c…
Vulnerability management is the continuous process of discovering, assessing, prioritizing, remediating, and verifying s…
Patch management is the systematic process of acquiring, testing, approving, and deploying software updates and security…
Log management is the process of generating, collecting, storing, protecting and finally deleting the records your syste…
Alert correlation combines multiple related security events from different sources into a unified, higher-fidelity alert…
Security incident escalation is the formal handoff of an alert or incident to someone with more expertise, authority or …
In cyber security, containment is the incident response step that stops a confirmed incident from spreading while the ev…
Eradication is the incident response phase where all threat components are permanently removed: malware, backdoors, pers…
Incident recovery is the work of restoring the systems, data and services affected by a cybersecurity incident once the …
Penetration testing is an authorized, scoped simulated attack against an organization's systems, networks, or applicatio…
A SOC analyst is a cybersecurity professional who monitors, triages, investigates, and responds to security alerts and i…
A red team is a group of security professionals who simulate a determined, sustained adversary against an organization's…
In cybersecurity, an SLA (service level agreement) sets how fast a SOC or security provider must act on alerts, incident…
In cyber security, a purple team exercise puts attackers and defenders on the same call. The red team runs one ATT&CK te…
Frequently Asked Questions
- What terms should SOC analysts know first?
- Start with the core tools: SIEM, XDR, EDR, and Firewall. Then learn the processes: alert triage, incident response, escalation, and threat hunting. These terms map directly to daily SOC workflows and appear in every analyst job description.
- How is this glossary organized?
- Terms are grouped into five categories: Tools (SIEM, XDR, EDR, etc.), Concepts (defense in depth, zero trust, etc.), Threats (phishing, ransomware, APT, etc.), Frameworks (MITRE ATT&CK®, NIST, etc.), and Processes (incident response, alert triage, etc.). Each term includes a definition, extended explanation, SOC relevance context, and links to related terms.
- How often is the glossary updated?
- We review and update the glossary monthly to reflect new threats, evolving tools, and changes in industry frameworks. New terms are added as the cybersecurity landscape evolves.
- Can I practice these concepts hands-on?
- Yes. SOCSimulator provides free SOC analyst training with realistic SIEM, XDR, and Firewall interfaces. Every glossary term maps to a concept you will encounter during hands-on training operations. Start free.
- What is the difference between SIEM, XDR, and EDR?
- SIEM aggregates and correlates logs from across your environment for threat detection and compliance. EDR monitors individual endpoints (process execution, file changes, network connections). XDR extends EDR by unifying endpoint, network, cloud, and identity telemetry into a single detection and response platform. Most mature SOCs use all three together.
Put These Concepts Into Practice
SOCSimulator puts you in the analyst seat with real alerts, real tools, and real pressure. Investigate MITRE ATT&CK®-mapped scenarios across SIEM, XDR, and Firewall consoles. Start free.