| Microsoft Defender XDR | A comprehensive security solution that integrates various Microsoft Defender products to deliver extended detection and response capabilities across endpoints, identities, email, applications, and cloud environments. |
| Extended Detection and Response (XDR) | A security technology that combines data from multiple security solutions, such as endpoints, networks, servers, and cloud workloads, to detect, investigate, and respond to security threats more effectively. |
| Microsoft 365 Defender | A unified pre- and post-breach enterprise defense suite that coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications. |
| Microsoft Defender for Endpoint | A platform designed to help enterprises prevent, detect, investigate, and respond to advanced threats on endpoints. |
| Microsoft Defender for Identity | A cloud-based security solution that leverages on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. |
| Microsoft Defender for Office 365 | A security solution that protects organizations from threats in email and collaboration tools, such as phishing, malware, and business email compromise. |
| Microsoft Defender for Cloud | A comprehensive cloud security solution that provides visibility, governance, and advanced threat protection across hybrid cloud workloads. |
| Incident Response (IR) | The process of identifying, investigating, and responding to security incidents, aiming to minimize damage and recover quickly. |
| Threat Intelligence | Information about threats and threat actors that helps organizations understand risks and respond to attacks more effectively. |
| Security Information and Event Management (SIEM) | A technology that provides real-time analysis of security alerts generated by hardware and software within an organization’s IT infrastructure. |
| Security Orchestration, Automation, and Response (SOAR) | A set of tools that allows organizations to collect security data and alerts from different sources, and respond to low-level security events without human assistance. |
| Endpoint Detection and Response (EDR) | A security solution focused on detecting, investigating, and responding to threats on endpoints like desktops, laptops, and servers. |
| Azure Sentinel | A scalable, cloud-native SIEM solution that delivers intelligent security analytics and threat intelligence across the enterprise. |
| Zero Trust Architecture | A security model that assumes no entity, whether inside or outside the network, can be trusted by default, and therefore requires continuous verification. |
| Active Directory (AD) | A directory service developed by Microsoft for Windows domain networks that is used for user and resource management. |
| Malware | Malicious software designed to disrupt, damage, or gain unauthorized access to a computer system. |
| Phishing | A form of cyber attack in which an attacker disguises as a legitimate entity to steal sensitive information such as usernames, passwords, or credit card details. |
| Multi-Factor Authentication (MFA) | A security system that requires more than one method of authentication from independent categories of credentials to verify a user’s identity for a login or other transaction. |
| Advanced Persistent Threat (APT) | A long-term targeted attack in which a malicious actor gains access to a network and remains undetected for an extended period to steal data. |
| Security Posture | The overall security status of an organization’s software, networks, services, and information, based on its resources and capabilities to manage cyber risks. |
| Threat Hunting | The proactive practice of searching through networks and datasets to detect and isolate advanced threats that evade existing security solutions. |
| Behavioral Analytics | The use of data analytics to detect unusual behavior patterns that may indicate a security threat. |
| Vulnerability Management | The process of identifying, assessing, and addressing vulnerabilities within an organization’s IT environment to reduce the risk of a cyber attack. |
| SOC (Security Operations Center) | A centralized unit that deals with security issues on an organizational and technical level, responsible for monitoring, detecting, and responding to cybersecurity threats. |
| MITRE ATT&CK Framework | A globally accessible knowledge base of adversary tactics and techniques based on real-world observations that is used to develop threat models and methodologies. |
| Playbooks | Predefined sets of instructions or procedures that guide how to respond to different types of security incidents or breaches. |
| Compliance | The act of conforming to established guidelines or specifications, or the process of making sure that an organization meets required legal, industry, and regulatory standards. |
| Cloud Workloads | The computing resources and applications that run in a cloud environment, which need to be secured as part of an organization’s cybersecurity strategy. |
| Ransomware | A type of malware that encrypts a victim’s files and demands payment (usually in cryptocurrency) for the decryption key. |
| Data Loss Prevention (DLP) | A strategy for ensuring that sensitive data is not lost, misused, or accessed by unauthorized users. |
| Kill Chain | A military concept that is adapted to cybersecurity, describing the stages of a cyber attack from reconnaissance to data exfiltration. |
| Encryption | The process of converting data into a coded format to prevent unauthorized access. |
| Artificial Intelligence for IT Operations (AIOps) | The use of AI to analyze big data from various IT operations tools and devices to automatically detect and respond to issues in real-time. |
| Automated Investigation and Response (AIR) | A feature within security tools that automatically investigates alerts, determines if they represent real threats, and responds to them without manual intervention. |
| Endpoint Security | The practice of securing endpoints, or end-user devices like desktops, laptops, and mobile devices, from cybersecurity threats. |
| Security Policy | A set of security rules and practices that specify how an organization manages, protects, and distributes its information resources. |
| False Positive | A security alert that incorrectly indicates the presence of a threat. |
| Attack Surface | The total number of points where an unauthorized user can try to enter data to or extract data from an environment. |
| Credential Theft | The act of stealing user credentials, such as usernames and passwords, often used to gain unauthorized access to systems and data. |
