Terms are defined as they are used throughout this textbook. Definitions drawn from authoritative sources carry an APA 7 citation that resolves to the consolidated reference list.
Agent (Wazuh Agent). The lightweight software installed on a monitored endpoint that collects configured security telemetry — event logs, Sysmon events, file integrity data, and log files — and forwards it to the Wazuh Manager (Wazuh, Inc., n.d.-a).
Alert. A notification generated when detection logic identifies activity of interest. An alert begins investigation; it is a claim requiring validation, not proof of compromise (Scarfone & Mell, 2007).
Atomic Red Team. An open library of small, repeatable tests that emulate individual MITRE ATT&CK® techniques so defenders can validate whether their detections fire (Red Canary, n.d.).
ATT&CK (MITRE ATT&CK®). A globally accessible knowledge base of adversary tactics (goals) and techniques (how those goals are achieved), each assigned a unique identifier such as T1046, providing a shared vocabulary for describing attacker behavior (MITRE Corporation, n.d.-a).
Caldera. MITRE's automated adversary-emulation platform, built on the ATT&CK model, used to run multi-stage campaigns in red-, blue-, and purple-team exercises (MITRE Corporation, n.d.-b).
Chain of custody. The documented, unbroken record of who collected, handled, transferred, and stored a piece of digital evidence, and when—required for evidence to be defensible (Nelson, Phillips, et al., 2025).
Correlation. The process of relating events from different sources, hosts, or times to reveal activity that no single event discloses on its own; correlation transforms isolated observations into investigative intelligence (Kent & Souppaya, 2006).
Decoder. A Wazuh component that parses an incoming raw log into structured fields (user, source IP, process, command line) so that rules can evaluate it (Wazuh, Inc., n.d.-a).
Detection engineering. The discipline of designing, testing, tuning, and maintaining security analytics that reliably identify malicious behavior while minimizing false positives (Knerler et al., 2022).
Detection rule. A predefined set of conditions used to identify activity of interest within collected telemetry; when conditions are satisfied, the platform generates an alert (Scarfone & Mell, 2007).
Digital forensics. The application of science to identifying, collecting, examining, and analyzing data while preserving its integrity and documenting its handling (Kent et al., 2006).
Emerging Threats Open (ET Open). The open-source Suricata signature ruleset used throughout this laboratory to detect known malicious network behavior (Proofpoint, n.d.).
Event. An observable occurrence in a system or network. Analysts usually encounter events as log or telemetry records, and most reflect normal activity (Cichonski et al., 2012).
False negative. Malicious activity that occurs but generates no alert — the most dangerous outcome, because the SOC has no indication anything happened.
False positive. Legitimate activity that generates an unnecessary alert. Excessive false positives erode analyst trust and consume investigative capacity (Scarfone & Mell, 2007).
File Integrity Monitoring (FIM). A capability that detects and reports changes to monitored files and directories, providing evidence of tampering, persistence, or ransomware activity (Wazuh, Inc., n.d.-a).
Hunting hypothesis. A specific, testable explanation of possible adversary behavior that identifies the scope and evidence capable of supporting, weakening, or leaving the explanation unresolved. Heuer anchors the analytic discipline of comparing plausible explanations and testing them against inconsistent as well as consistent evidence; the cybersecurity operational form used in this book is an Alerts to Answers teaching pattern (Heuer, 1999).
Hypothesis. A proposed explanation that can be tested against evidence. Analysts should compare plausible alternatives and seek evidence that can disconfirm a favored explanation rather than collect only confirming facts (Heuer, 1999).
Incident. A violation or imminent threat of violation of security policy, acceptable-use policy, or standard security practice. Investigation determines whether an alert meets the organization's incident criteria (Cichonski et al., 2012).
Indicator of Attack (IOA). An observable pattern of behavior suggesting an attack in progress — for example, a document spawning a scripting engine — rather than a static artifact.
Indicator of Compromise (IOC). A technical artifact or observable — such as a file hash, IP address, domain, or registry key — associated with possible compromise. An IOC is evidence to evaluate, not proof (Johnson et al., 2016).
Indexer (Wazuh Indexer). The component that stores and indexes processed alert and event data so it can be searched and visualized (Wazuh, Inc., n.d.-a).
Live response. The collection of evidence from a system that is still running, capturing volatile data such as memory, active processes, and network connections that would be lost on shutdown (Nelson, Phillips, et al., 2025).
Manager (Wazuh Manager). The intelligence center of the platform: it receives agent telemetry, applies decoders and rules, generates alerts, and coordinates the deployment (Wazuh, Inc., n.d.-a).
Normalization. The transformation of many different log formats into a single, consistent field structure so that events from different vendors can be searched and correlated together (Kent & Souppaya, 2006).
Order of volatility. The principle that evidence should be collected from most volatile to least volatile—memory before disk—because volatile data disappears first (Nelson, Phillips, et al., 2025).
Playbook. A documented, repeatable procedure that guides an analyst through an investigation or response so that outcomes do not depend on which analyst is on shift (Knerler et al., 2022).
Promiscuous mode. A network interface configuration in which the interface accepts all frames on the segment, not only those addressed to it, allowing an IDS such as Suricata to inspect traffic between other hosts (Open Information Security Foundation, n.d.).
Rule level. The severity value (0–15) Wazuh assigns to a matched rule. Level 0 indicates the rule matched but was intentionally silenced; higher levels indicate greater severity (Wazuh, Inc., n.d.-a).
Security Information and Event Management (SIEM). A platform that collects, stores, analyzes, correlates, and presents security information from multiple data sources, providing a unified investigative view of an environment (Gartner, n.d.-b).
Security Onion. An open-source security monitoring platform used in this laboratory as an independent, silent network sensor for corroborating observations (Security Onion Solutions, n.d.).
Security Operations Center (SOC). A centralized organizational function responsible for continuously monitoring, detecting, investigating, and responding to cybersecurity events. A SOC combines people, processes, and technology to transform raw security data into actionable intelligence (Knerler et al., 2022).
Security Orchestration, Automation, and Response (SOAR). Technology that integrates multiple security tools into coordinated, automated workflows while leaving validation and decision-making to human analysts (Gartner, n.d.-a).
Suricata. An open-source network intrusion detection and prevention engine that inspects packets against signatures and generates alerts and flow records (Open Information Security Foundation, n.d.).
Sysmon (System Monitor). A Windows system service that records detailed, security-relevant operating system activity — process creation with command lines and parent processes, network connections, and file and registry changes — well beyond standard Windows logging (Russinovich & Garnier, n.d.).
Telemetry (security telemetry). The continuous stream of observational data generated by operating systems, applications, firewalls, intrusion detection systems, and endpoint security products. Telemetry is the raw material a SIEM uses to identify suspicious activity (Kent & Souppaya, 2006).
Threat hunting. A structured, proactive search for evidence of malicious activity that has not yet triggered an alert, driven by hypotheses rather than by the alert queue (Knerler et al., 2022).
Tier 1 / Tier 2 / Tier 3 analyst. The conventional SOC staffing model: Tier 1 triages alerts, Tier 2 conducts deeper investigation and correlation, and Tier 3 performs advanced analysis, hunting, and detection engineering (Knerler et al., 2022).
True positive. An alert that correctly identifies activity of genuine security interest.
Wazuh. The open-source security platform used throughout this textbook, integrating agent-based telemetry collection, rule-based detection, alerting, and a search-and-visualization dashboard in a single deployment (Wazuh, Inc., n.d.-a).
Wazuh Dashboard. The web interface used to search, filter, visualize, and investigate alerts and events collected by the platform (Wazuh, Inc., n.d.-a).
XDR (Extended Detection and Response). An approach that unifies detection and response telemetry across endpoints, networks, and cloud workloads within a single system (Gartner, n.d.-c).
CSF Implementation Tier. A characterization of the rigor of an organization’s cybersecurity risk-governance and risk-management practices. NIST CSF 2.0 defines Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3), and Adaptive (Tier 4); the Tiers provide context and complement rather than replace an organization’s risk-management methodology (National Institute of Standards and Technology, 2024).