EDR (endpoint detection and response)

SIEM (security information and event management)

A SIEM (security information and event management) is the platform that collects the logs from every system in a company and correlates them, raising an alert when a sequence matches the way an attack behaves. It's the central screen of a SOC.

View term →

MSSP (managed security service provider)

An MSSP (managed security service provider) is a company that runs other companies' security under contract, managing firewalls, endpoint protection, email security and monitoring with its own team and tools. It gives a business enterprise-grade security without building an in-house security team.

View term →

MDR (managed detection and response)

MDR (managed detection and response) is a service in which a provider watches a company's devices around the clock and handles its alerts, from investigation to containment. It pairs EDR technology with human analysts and is usually priced per protected device.

View term →

Digital forensics

Digital forensics is the technical investigation of an incident to reconstruct what happened: how the attackers got in, what they touched and when. It preserves evidence so it holds up in an audit, an insurance claim or a legal process.

View term →

SOC (security operations center)

A SOC (security operations center) is the team of analysts, processes and tools that watches a company's systems around the clock and handles every alert, from investigation to containment. As a service (SOCaaS), an outside provider runs it under a subscription.

View term →

XDR (extended detection and response)

XDR (extended detection and response) widens the reach of EDR: beyond devices, it correlates what happens in email, the network, identities and the cloud on a single platform. That way it detects attacks that move across several fronts, which each tool on its own would miss.

View term →