Detection Glossary

Browse 66 detection terms defined in plain English, from the cultural dictionary of computing.

66 Detection Terms

Active Defense
A defensive approach that goes beyond passive monitoring by actively disrupting, detecting, misleading, or containing attackers during an intrusion attempt....
Adversary Emulation
A security testing method that recreates the behaviors, tools, and tactics of a real threat actor to evaluate defenses under realistic conditions. It differs...
AI Detection
The practice of identifying whether content, behavior, or system output is likely associated with AI generation or AI-driven activity. AI detection can be...
AI-Powered Security
Security tooling or workflows that use machine learning or AI techniques for tasks such as anomaly detection, triage, or automated analysis. The phrase is...
Anomaly Detection
Anomaly Detection is a detection approach that flags events, users, or systems that deviate from a learned baseline of normal behavior. Security teams use it...
Anti-Virus
Software that detects, blocks, or removes malicious code on endpoints, traditionally through signature matching and increasingly through heuristic or...
Automated Threat Detection
Security detection performed automatically through rules, analytics, or machine-assisted logic rather than solely by human review. It is essential for scale,...
Behavioral Analysis
Behavioral Analysis is the inspection of user, process, or network behavior patterns to identify suspicious deviations and abuse. Security teams use it to...
Behavioral Detection
Security detection based on what software or users do rather than only on static signatures or known hashes. Behavioral detection helps identify novel threats...
Canary
A deliberately placed marker or value used to detect tampering, exploitation, or unexpected access, such as a stack canary, token canary, or canary document....
Canary Token
A digital tripwire — a fake file, URL, or credential planted in a system that triggers an alert when accessed, indicating unauthorized activity. Named after...
Continuous Monitoring
An ongoing process of collecting and reviewing security-relevant signals so issues can be detected, assessed, and acted on as environments change. Continuous...
Cyber Deception
Cyber Deception is the use of controlled false artifacts, lures, and narratives to mislead attackers and collect high-signal telemetry. Security teams use it...
Deception Technology
Deception Technology is security tooling that deploys decoys, lures, and controlled artifacts to detect attacker interaction early. Security teams use it to...
Decoy System
Decoy System is a controlled host or service that appears valuable so attacker interaction can be observed safely. Security teams use it to enforce trust,...
Detection Engineering
The practice of designing, testing, tuning, and maintaining detection logic so security tools can reliably identify malicious behavior. It treats detections...
Detection Rule
A concrete rule in a SIEM, EDR, IDS, or similar tool that triggers an alert when defined conditions are met. Detection rules can be signature-based,...
DNS Sinkhole
DNS Sinkhole is a defensive DNS response that redirects malicious domain requests to controlled infrastructure for blocking or observation. Security teams use...
Dwell Time
Dwell Time is the amount of time an adversary remains in an environment before detection or containment. Security teams use it to enforce trust, reduce...
EDR
EDR is endpoint detection and response tooling that records endpoint telemetry and supports investigation and containment. Security teams use it to enforce...
Endpoint Detection and Response
Endpoint Detection and Response is technology and workflows that collect endpoint telemetry and support investigation, hunting, and containment. Security teams...
Endpoint Monitoring
The continuous collection and review of device-level events such as process launches, file changes, network connections, and user activity for security...
Entropy Analysis
Entropy Analysis is the measurement of randomness or predictability in data to spot weak secrets, packed code, or anomalous content. Security teams use it to...
Extended Detection and Response
Extended Detection and Response is a security operations capability that correlates endpoint, identity, email, cloud, and network telemetry for response....
False Negative
A case where a malicious or noncompliant condition exists but the security control fails to detect or flag it. False negatives are dangerous because they...
False Positive
A case where a security control incorrectly flags benign behavior, data, or software as malicious or noncompliant. Too many false positives waste analyst time...
HIDS
HIDS is a host-based intrusion detection capability that inspects activity on an individual system for malicious indicators. Security teams use it to enforce...
Honeytoken
A fake secret, credential, record, or other attractive data item planted so any use or access attempt is a high-confidence signal of compromise or misuse....
Host-Based Intrusion Detection
Host-Based Intrusion Detection is intrusion detection performed on a single host by watching processes, files, logins, or configuration changes. Security teams...
IDS
IDS is technology that detects suspicious behavior or signatures on hosts or networks and alerts defenders. Security teams use it to enforce trust, reduce...
IDS Evasion
IDS Evasion is an attack technique in which an adversary modifies traffic or payloads so detection logic misses malicious behavior. Defenders analyze it to...
Incident Detection
The discovery of signs that a real security incident may be occurring or has occurred, through alerts, user reports, anomaly analysis, or other sources....
Indicator
A specific observable sign associated with suspicious or malicious activity, such as an IP address, domain, file hash, mutex, or process path. Indicators are...
Indicator of Attack
Indicator of Attack is behavioral evidence that an attack is occurring, often reflecting tactics or sequences rather than static artifacts. Security teams use...
Indicator of Compromise
Indicator of Compromise is an observed artifact such as a hash, domain, or registry key associated with malicious activity. Security teams use it to enforce...
Intrusion Detection System
Intrusion Detection System is a system that observes activity and alerts when patterns suggest malicious behavior or policy violations. Security teams use it...
Intrusion Prevention System
Intrusion Prevention System is a control that not only detects suspicious traffic or behavior but can also block or reset it in line. Security teams use it to...
IOA
Short for indicator of attack, a behavioral sign that an adversarial technique or stage of intrusion is occurring, even if the exact malware or infrastructure...
IOC
Short for indicator of compromise, an observable artifact such as a file hash, IP address, registry key, or domain associated with known malicious activity....
IPS
Short for intrusion prevention system, a security control that inspects traffic or activity and actively blocks behavior matching malicious patterns or policy...
Log Analysis
The examination of system, application, network, or cloud logs to identify anomalies, reconstruct events, or confirm suspicious behavior. Log analysis is...
Log Correlation
Log Correlation is the linking of related events across multiple log sources to reveal attacks or operational context. Security teams use it to enforce trust,...
Mean Time to Detect
A security operations metric measuring the average time between the start of malicious activity and when defenders detect it. Mean time to detect helps...
MITRE ATT&CK
MITRE ATT&CK is a knowledge base that organizes adversary behaviors into tactics, techniques, and procedures for detection and defense mapping. Security teams...
Monitoring Rule
A defined condition that tells a monitoring system when to raise an alert, create a case, or record a notable event. Monitoring rules may be based on...
NDR
NDR is network detection and response tooling that analyzes network activity to detect intrusions and support response. Security teams use it to enforce trust,...
Network Detection and Response
Network Detection and Response is the collection and analysis of network telemetry to detect malicious behavior and support investigation. Security teams use...
Network Intrusion Detection
Network Intrusion Detection is monitoring of network traffic for malicious signatures, anomalies, or policy violations. Security teams use it to enforce trust,...
Network Traffic Analysis
The study of packets, flows, timing, volumes, and communication patterns to understand normal behavior, detect anomalies, and investigate attacks. Network...
NIDS
NIDS is a network-based intrusion detection capability that inspects traffic for malicious patterns or suspicious behavior. Security teams use it to enforce...
Passive Scanning
The observation and analysis of existing traffic or broadcasts to identify devices, services, or vulnerabilities without actively probing targets. Passive...
Pattern Detection
The identification of recurring structures, sequences, or anomalies in data that indicate suspicious or meaningful behavior. In security, pattern detection is...
Phishing Detection
The identification of phishing messages, domains, pages, or behaviors through content analysis, sender validation, threat intelligence, user reports, or...
Predictive Security
The use of historical data, threat intelligence, behavioral patterns, and models to estimate where attacks or failures are likely to occur before they happen....
Real-Time Alerting
The immediate generation and delivery of alerts as suspicious or important security events occur rather than through delayed batch review. Real-time alerting...
Retro Hunt
A search across stored historical telemetry to find indicators or behavioral patterns that were not recognized or queried at the time the data was first...
Ruleset
A collection of related rules used by a security control, monitoring platform, firewall, or policy system to decide how to handle activity. Rulesets must be...
Runtime Protection
Security controls that monitor or block suspicious behavior while software is actively running rather than only during build or deployment. Runtime protection...
Security Information and Event Management
A platform that collects, normalizes, correlates, and searches security logs for detection and investigation. It shows up in application security, identity,...
Silent Failure
A failure mode where something stops working correctly but does not clearly announce that it failed. In engineering slang, silent failures are usually treated...
Snort
An open-source intrusion detection and prevention system that matches network traffic against protocol and attack rules. It shows up in application security,...
User and Entity Behavior Analytics
A detection approach that models normal user or device behavior and alerts on meaningful deviations. It shows up in application security, identity,...
Watermark Detection
Techniques for identifying whether content carries a watermark or signal indicating it may have been generated by a model or processed by a specific system....
Watermarking AI
Embedding detectable signals in model outputs or generated media so AI-produced content can later be identified.
XDR
Extended detection and response, an approach that correlates telemetry across endpoints, email, identity, and network tools. It shows up in application...
YARA Rule
A pattern-matching rule used to identify malware, files, or memory artifacts by strings and conditions. It shows up in application security, identity,...

Related Topics