Glossary of containment and response terms
35 terms as this site uses them, each with a plain definition and an example from a named vendor's own documentation.
35terms
All terms
- Account disablement
- Account disablement turns off a user or service account in the identity provider so no new sign-in succeeds.
- Action catalogue
- An action catalogue is the list of actions a platform can take on connected tools, such as isolate a host or disable a user.
- Approval gate
- An approval gate holds an automated action until a named person approves it.
- Audit trail
- An audit trail records who or what did what, when, on what evidence and with what result.
- Autonomy tier
- An autonomy tier is a level of independence a platform is allowed for a class of action, from recommend only to act alone.
- Blast radius
- Blast radius is how much an automated action can affect if it is wrong: one host or the whole estate, one session or every user.
- Case management
- Case management groups alerts, evidence, tasks and decisions for one incident in a record that analysts share.
- Chain of custody
- Chain of custody is the record of who handled a piece of evidence and when, so it can be shown to be unaltered.
- Change freeze
- A change freeze is a period when changes to production are held, such as a quarter close or a major sale.
- Containment
- Containment is the set of actions that stop an attacker from spreading or acting while the incident is investigated: isolate a host, revoke a session, disable an account, pull a message, rotate a key, block an address.
- Decision trace
- A decision trace records why a decision was made, not only what was done: the evidence considered, the rule or model used and any override by a person.
- Detection to response coupling
- Detection to response coupling is how directly a response platform receives detections from EDR, identity, email and cloud tools, without a SIEM in front.
- DNS sinkhole
- A DNS sinkhole answers requests for a bad domain with a controlled address, so infected machines that call home reach a safe server instead.
- EDR
- EDR is endpoint detection and response: an agent on each endpoint that records activity and can isolate the host, kill a process, quarantine a file or run a script.
- Eradication
- Eradication removes the attacker's foothold from the estate: malware deleted, persistence removed, credentials rotated and vulnerable systems fixed.
- Firewall block
- A firewall block adds an IP address, domain or URL to a deny list or address group on a firewall, so traffic to or from it stops.
- Host isolation
- Host isolation cuts a managed endpoint off from the network while keeping the sensor channel to the EDR console open, so analysts can still investigate.
- Human in the loop
- Human in the loop means a person approves or decides before an action takes effect.
- Integration pack
- An integration pack is a bundle of connectors, actions and sometimes playbooks for one product or use case, delivered through a vendor marketplace.
- Key rotation
- Key rotation replaces a credential, such as an access key, token or secret, so a leaked copy stops working.
- Mean time to contain
- Mean time to contain is the average time to contain across a set of incidents.
- Message purge
- Message purge removes a delivered phishing message from user mailboxes, from one mailbox or from many, by message ID, sender or search.
- MSSP multitenancy
- MSSP multitenancy is the ability to run response for many customers on one platform with each customer's data, playbooks and approvals kept apart.
- Playbook
- A playbook is an automated workflow that runs steps against tools when a trigger fires: enrich, decide, notify, act.
- Regulator-ready export
- A regulator-ready export is a record of an incident and the actions taken, in a form a reviewer can read without the vendor's tool.
- Rollback
- Rollback undoes an action that was wrong: release an isolated host, re-enable an account, restore a message.
- Runbook
- A runbook is a written procedure for handling a type of incident, followed by a person.
- Session revocation
- Session revocation ends a user's active sessions and invalidates refresh or access tokens, so a stolen session stops working.
- Shadow mode
- Shadow mode runs a platform on real alerts without letting it act, so its verdicts and proposed actions can be compared with what analysts did.
- SIEM
- A SIEM collects and searches security logs and runs detection rules over them.
- SOAR
- SOAR stands for security orchestration, automation and response.
- Time to contain
- Time to contain is the elapsed time from the first detection signal on an incident to the first action that stops the attacker spreading or acting.
- Time to resolve
- Time to resolve runs from detection to the incident being closed, after containment, eradication and recovery.
- Time to respond
- Time to respond is the time from detection to the first response step.
- XDR
- XDR is extended detection and response: detection and response that spans endpoints plus other sources such as identity, email and cloud, in one product.