| Intrusion Detection System (IDS) | A device or software application that monitors a network or systems for malicious activity or policy violations. Any detected activity or violation is typically reported to an administrator or collected centrally using a security information and event management (SIEM) system. |
| Intrusion Prevention System (IPS) | An extension of IDS that not only detects potentially malicious activity but also takes action to prevent the breach by blocking traffic or terminating sessions. |
| False Positive | Incorrectly identifying benign activity as malicious. This can lead to unnecessary actions that could disrupt legitimate user activity. |
| False Negative | Failing to detect actual malicious activity, allowing attackers to continue their actions without detection. |
| Signature-based Detection | A method of detecting known threats by comparing observed activity against a database of unique identifiers or patterns (signatures) associated with specific threats. |
| Anomaly-based Detection | A method that identifies suspicious activity based on deviations from a baseline of normal network or system behavior, aiming to detect previously unknown threats. |
| Heuristic-based Detection | Using algorithms to determine the likelihood that an activity is malicious based on various characteristics, rather than relying on known signatures or anomalies. |
| Behavior-based Detection | A technique that analyzes the behavior of network traffic or applications to identify unusual actions that might indicate a threat. |
| Network-based IDS/IPS | Systems that monitor and analyze network traffic for signs of malicious activity, typically deployed at strategic points within the network to cover all inbound and outbound traffic. |
| Host-based IDS/IPS | Systems installed on individual computers or devices to monitor and analyze their operations for signs of compromise. |
| Security Information and Event Management (SIEM) | A solution that aggregates and analyzes activity from many different resources across your IT infrastructure to identify potential security incidents. |
| Deep Packet Inspection (DPI) | A form of computer network packet filtering that examines the data part (and possibly also the header) of a packet as it passes an inspection point, searching for protocol non-compliance, viruses, spam, intrusions, or defined criteria to decide whether the packet may pass or if it needs to be routed to a different destination. |
| Snort | An open-source network intrusion detection system (NIDS) capable of performing real-time traffic analysis and packet logging on IP networks. |
| Suricata | An open-source network IDS, IPS, and network security monitoring engine. |
| Log Analysis | The process of examining logs to identify security incidents, operational problems, policy violations, and fraudulent activity. |
| Policy Violation | An occurrence where observed activity does not comply with the organization’s stated security policy, which may or may not be malicious in nature. |
| Security Policy | A set of defined rules and criteria for how to manage, protect, and distribute sensitive information within an organization. |
| Alert Threshold | The criteria or level of activity at which an IDS or IPS will generate a notification or alert about potential security issues. |
| Encrypted Traffic Analysis | The process of inspecting encrypted data to identify potential threats while maintaining the confidentiality of the information. |
| Zero-day Attack | An attack that exploits a previously unknown vulnerability in a computer application or operating system, before the software vendor has released a patch. |
| Sandboxing | A security technique that isolates potentially malicious programs within a confined environment to prevent them from affecting the host system or network. |
| Threat Intelligence | Information used to understand the threats that have, will, or are currently targeting the organization. This information is used to prepare, prevent, and identify potential threats. |
| Whitelisting | A security strategy that allows only pre-approved software, email addresses, users, or other entities to perform actions or access a system. |
| Blacklisting | A security strategy that blocks certain software, email addresses, users, or other entities from accessing a system based on a predefined list of banned entities. |
