Glossary

Terms are defined as they are used throughout this textbook. Definitions drawn from authoritative sources carry an APA 7 citation that resolves to the consolidated reference list.

Agent (Wazuh Agent). The lightweight software installed on a monitored endpoint that collects configured security telemetry — event logs, Sysmon events, file integrity data, and log files — and forwards it to the Wazuh Manager (Wazuh, Inc., n.d.-a).

Alert. An event, or a collection of related events, that satisfies predefined detection logic and therefore warrants human attention. An alert is a claim requiring validation, not proof of compromise (Scarfone & Mell, 2007).

Atomic Red Team. An open library of small, repeatable tests that emulate individual MITRE ATT&CK techniques so defenders can validate whether their detections fire (Red Canary, n.d.).

ATT&CK (MITRE ATT&CK®). A globally accessible knowledge base of adversary tactics (goals) and techniques (how those goals are achieved), each assigned a unique identifier such as T1046, providing a shared vocabulary for describing attacker behavior (MITRE Corporation, n.d.-a).

Caldera. MITRE's automated adversary-emulation platform, built on the ATT&CK model, used to run multi-stage campaigns in red-, blue-, and purple-team exercises (MITRE Corporation, n.d.-b).

Chain of custody. The documented, unbroken record of who collected, handled, transferred, and stored a piece of digital evidence, and when — required for evidence to be defensible (Nelson et al., 2025).

Correlation. The process of relating events from different sources, hosts, or times to reveal activity that no single event discloses on its own; correlation transforms isolated observations into investigative intelligence (Kent & Souppaya, 2006).

Decoder. A Wazuh component that parses an incoming raw log into structured fields (user, source IP, process, command line) so that rules can evaluate it (Wazuh, Inc., n.d.-a).

Detection engineering. The discipline of designing, testing, tuning, and maintaining security analytics that reliably identify malicious behavior while minimizing false positives (Knerler et al., 2022).

Detection rule. A predefined set of conditions used to identify activity of interest within collected telemetry; when conditions are satisfied, the platform generates an alert (Scarfone & Mell, 2007).

Digital forensics. The scientific process of collecting, preserving, analyzing, and presenting digital evidence in a manner that maintains its integrity and admissibility (Nelson et al., 2025).

Emerging Threats Open (ET Open). The open-source Suricata signature ruleset used throughout this laboratory to detect known malicious network behavior (Proofpoint, n.d.).

Event. Any recorded activity generated by a computer system, application, operating system, network device, or security product. An event is simply something that happened; most events are entirely normal (Cichonski et al., 2012).

False negative. Malicious activity that occurs but generates no alert — the most dangerous outcome, because the SOC has no indication anything happened.

False positive. Legitimate activity that generates an unnecessary alert. Excessive false positives erode analyst trust and consume investigative capacity (Scarfone & Mell, 2007).

File Integrity Monitoring (FIM). A capability that detects and reports changes to monitored files and directories, providing evidence of tampering, persistence, or ransomware activity (Wazuh, Inc., n.d.-a).

Hypothesis. A proposed explanation of observed activity that can be tested against evidence. Structured hypothesis testing distinguishes analysis from assumption (Heuer, 1999).

Incident. A confirmed security event that requires organizational response. The overwhelming majority of alerts investigated by analysts never become incidents (Cichonski et al., 2012).

Indicator of Attack (IOA). An observable pattern of behavior suggesting an attack in progress — for example, a document spawning a scripting engine — rather than a static artifact.

Indicator of Compromise (IOC). An artifact — file hash, IP address, domain, registry key — that suggests a system may have been compromised (Cichonski et al., 2012).

Indexer (Wazuh Indexer). The component that stores and indexes processed alert and event data so it can be searched and visualized (Wazuh, Inc., n.d.-a).

Live response. The collection of evidence from a system that is still running, capturing volatile data such as memory, active processes, and network connections that would be lost on shutdown (Nelson et al., 2025).

Manager (Wazuh Manager). The intelligence center of the platform: it receives agent telemetry, applies decoders and rules, generates alerts, and coordinates the deployment (Wazuh, Inc., n.d.-a).

Normalization. The transformation of many different log formats into a single, consistent field structure so that events from different vendors can be searched and correlated together (Kent & Souppaya, 2006).

Order of volatility. The principle that evidence should be collected from most volatile to least volatile — memory before disk — because volatile data disappears first (Nelson et al., 2025).

Playbook. A documented, repeatable procedure that guides an analyst through an investigation or response so that outcomes do not depend on which analyst is on shift (Knerler et al., 2022).

Promiscuous mode. A network interface configuration in which the interface accepts all frames on the segment, not only those addressed to it, allowing an IDS such as Suricata to inspect traffic between other hosts (Open Information Security Foundation, n.d.).

Rule level. The severity value (0–15) Wazuh assigns to a matched rule. Level 0 indicates the rule matched but was intentionally silenced; higher levels indicate greater severity (Wazuh, Inc., n.d.-a).

Security Information and Event Management (SIEM). A platform that collects, stores, analyzes, correlates, and presents security information from multiple data sources, providing a unified investigative view of an environment (Gartner, n.d.-b).

Security Onion. An open-source security monitoring platform used in this laboratory as an independent, silent network sensor for corroborating observations (Security Onion Solutions, n.d.).

Security Operations Center (SOC). A centralized organizational function responsible for continuously monitoring, detecting, investigating, and responding to cybersecurity events. A SOC combines people, processes, and technology to transform raw security data into actionable intelligence (Knerler et al., 2022).

Security Orchestration, Automation, and Response (SOAR). Technology that integrates multiple security tools into coordinated, automated workflows while leaving validation and decision-making to human analysts (Gartner, n.d.-a).

Suricata. An open-source network intrusion detection and prevention engine that inspects packets against signatures and generates alerts and flow records (Open Information Security Foundation, n.d.).

Sysmon (System Monitor). A Windows system service that records detailed, security-relevant operating system activity — process creation with command lines and parent processes, network connections, and file and registry changes — well beyond standard Windows logging (Russinovich & Garnier, n.d.).

Telemetry (security telemetry). The continuous stream of observational data generated by operating systems, applications, firewalls, intrusion detection systems, and endpoint security products. Telemetry is the raw material a SIEM uses to identify suspicious activity (Kent & Souppaya, 2006).

Threat hunting. A structured, proactive search for evidence of malicious activity that has not yet triggered an alert, driven by hypotheses rather than by the alert queue (Knerler et al., 2022).

Tier 1 / Tier 2 / Tier 3 analyst. The conventional SOC staffing model: Tier 1 triages alerts, Tier 2 conducts deeper investigation and correlation, and Tier 3 performs advanced analysis, hunting, and detection engineering (Knerler et al., 2022).

True positive. An alert that correctly identifies activity of genuine security interest.

Wazuh. The open-source security platform used throughout this textbook, integrating agent-based telemetry collection, rule-based detection, alerting, and a search-and-visualization dashboard in a single deployment (Wazuh, Inc., n.d.-a).

Wazuh Dashboard. The web interface used to search, filter, visualize, and investigate alerts and events collected by the platform (Wazuh, Inc., n.d.-a).

XDR (Extended Detection and Response). An approach that unifies detection and response telemetry across endpoints, networks, and cloud workloads within a single system (Gartner, n.d.-c).