Glossary

Glossary

Term	Meaning
SOC	Security operations centre: the team that monitors and responds to security events
SIEM	Security information and event management: a log collection and detection platform
Triage	Deciding quickly what an alert is and what to do next
IOC / indicator	An observable such as an IP address, domain or file hash
ATT&CK	MITRE's catalogue of attacker tactics and techniques
Sigma	An open format for detection rules; Prohori's format is inspired by it
ECS	Elastic Common Schema; Prohori's event schema is a smaller, similar idea
Credential stuffing	Trying leaked username/password pairs against an application
Password spraying	Trying a few common passwords across many accounts
PR-AUC	Area under the precision-recall curve; more informative than accuracy on imbalanced data
Leakage	Information from test data or the label leaking into training, inflating results
dbt	A tool for versioned, tested SQL transformations in a warehouse