IDS and IPS (intrusion detection and prevention)

Microsoft Sentinel

Microsoft Sentinel is Microsoft's cloud platform for SIEM (security information and event management) and SOAR (security orchestration, automation and response). It collects logs from Microsoft 365, Azure, firewalls and other sources, detects threats with analytics rules and behavior analysis, and automates responses. It was formerly called Azure Sentinel, and its queries use KQL (Kusto Query Language).

View term →

Incident containment and eradication

Containment and eradication are two phases of incident response. Containment limits the damage and keeps the attack from spreading, for example by isolating a device from the network or disabling a compromised account. Eradication removes the root cause: it deletes the malware, fixes the exploited vulnerability and removes the attacker's access before the team moves on to recovery.

View term →

Alert fatigue

Alert fatigue is the exhaustion security analysts experience when they receive more alerts than they can review, many of them false positives. The volume erodes attention and raises the odds of missing a real incident in the noise. It is reduced by tuning detection rules, correlating events, removing duplicate alerts and automating part of the triage process.

View term →

Alert triage

Alert triage is the process of reviewing, classifying and prioritizing security alerts to decide which ones are real incidents and in what order they are handled. The analyst validates the alert, enriches it with device, user and threat intelligence context, and either closes it as a false positive or escalates it. It is the first task of Tier 1 in a security operations center (SOC).

View term →

SOC tiers (Tier 1, 2 and 3)

SOC tiers are the way a security operations center (SOC) divides the work of its analysts. Tier 1 reviews each alert and decides whether it is real; Tier 2 investigates confirmed cases and contains them; Tier 3 hunts for threats the rules missed and improves detection. Each tier escalates to the next one whatever it cannot resolve on its own.

View term →

Breach and attack simulation (BAS)

Breach and attack simulation (BAS) is a technology that automatically and continuously runs real attack techniques, without harming systems, to check whether security controls block or detect them. Unlike a point-in-time penetration test, it repeats tests frequently and shows which controls need tuning, such as an endpoint agent that misses credential theft or a firewall rule that allows data exfiltration.

View term →