Glossary

Short definitions of terms used in this documentation. Terms are listed alphabetically.

Term	Definition
AI Search Assistant	A Records search mode that turns a question in natural language into filters. See Records.
Alert	A notification that a potential threat or condition of interest has been detected.
Anomaly detection	Identification of activity that deviates from normal behaviour.
Asset	An internal device discovered by SentriaOne xSIEM, with its role, vendor, and criticality. See Assets.
Beaconing	Regular, repeated connections from a host to the same destination — a typical sign of command-and-control.
Behaviour analytics	Analysis of user, host, and network behaviour to find suspicious deviations. See Data Processing.
C2 (command and control)	Communication between a compromised host and the attacker's controller. Also a detection category.
Case	A record used to track an incident from detection to closure. See Incident Response.
Case management	The process and capability for handling, tracking, and documenting cases.
Category	The kind of activity a detection describes: C2, UEBA, Caution, Exfiltration, or Discovery. See Detection Reference.
Compliance	Meeting audit and regulatory requirements; supported by collected and retained records.
Confidence	How certain the engine is that a detection is correct, as a percentage.
Correlation	Linking related events from different sources and times into one meaningful finding.
Criticality	How important an asset is (High, Medium, Low); used to prioritize detections.
Cyber security intelligence	Detections and context that help the security team find and stop threats.
Data source	The type of record searched in Records, for example conn, dns, http, or ssl.
Deep protocol parsing	Decoding application-layer protocols so their content and behaviour can be inspected.
Detection	A finding raised when analysis identifies potentially malicious activity.
Detection Tracking	The panel where an analyst sets the status, assignee, and notes of a detection.
East-west traffic	Network traffic between systems inside the internal network.
End device	A system where users or workloads run, such as an endpoint, server, or virtual machine.
Endpoint	A user device such as a workstation or laptop.
Enrichment	Adding context — such as asset or threat intelligence information — to collected data.
Entity IP	The internal IP address a record or detection is attributed to; available as a filter in Records.
Event	A single recorded occurrence, such as a sign-in or a blocked connection.
False positive	A detection that turns out not to be a real threat.
Fan-out	How many different peers a host communicates with, compared with its normal behaviour.
File extraction	Recovering files transferred over the network so they can be analyzed.
Incident Response (IR)	The process of analyzing, deciding on, and acting on detected threats. See Incident Response.
Ingestion	Receiving data from sources into the platform.
IT operations	Monitoring and maintaining the health and performance of IT systems.
L2–L7 analysis	Analysis of network traffic across OSI layers 2 (data link) to 7 (application).
Lateral movement	An attacker moving from one compromised internal system to another.
Log	A record written by a system when an event occurs. See Log Sources.
Log management	Collecting, storing, searching, retaining, and exporting log data.
Log source	Any system that produces logs.
Machine learning (ML)	Models that learn patterns from data, used to detect anomalies and malware.
MITRE ATT&CK	A public knowledge base of adversary tactics and techniques.
Network Detection and Response (NDR)	Threat detection and response based on network traffic analysis. See NDR.
Network device	A device that moves or filters traffic, such as a router, switch, or firewall.
Network Performance Monitoring (NPM)	Measuring the performance of the network and the applications running over it. See NPM.
Network TAP	A hardware device that copies all traffic passing through a network link.
Network Traffic Analysis (NTA)	Real-time inspection of network traffic to identify threats.
Normalization	Mapping data from different sources into a consistent set of fields and values.
North-south traffic	Network traffic between the internal network and the internet.
Packet mirroring	Sending a copy of network packets to an analysis system. See Packet Mirroring.
Peer	The other party in a detection — usually the external host the internal asset communicated with.
Raw traffic	Network packets as they crossed the network, received through packet mirroring.
Recommendation	A suggested follow-up step provided in the detection details to support the response decision.
Record	A single entry of processed data, such as one connection, DNS query, or HTTP request. See Records.
Retention	How long collected data is kept before it is removed.
Risk score	A value from 0 to 100 that expresses how urgent a detection is, calculated from its risk signals.
Risk signal	One of the engine measurements behind the risk score, such as Beaconing or ML Anomaly.
Sandbox	An isolated environment where suspicious files are executed and observed safely.
Security Information and Event Management (SIEM)	Collecting, correlating, and analyzing data from many sources to detect threats. See SIEM.
Security perimeter device	A device protecting the network boundary, such as a firewall or web application firewall.
Sensor	A component that receives mirrored network traffic for analysis.
Severity	The urgency level of a detection: High, Medium, or Low.
Signature-based detection	Detection by matching data against known patterns of malicious activity.
SNI (Server Name Indication)	The website name a client requests when opening a TLS connection; visible even when traffic is encrypted.
SOC	Security Operations Center — the team and function responsible for monitoring and responding to threats.
SPAN	Switched Port Analyzer — a switch feature that copies traffic to a monitoring port.
Syslog	A standard protocol for sending log messages over a network.
Threat hunting	Proactively searching for threats that have not triggered a detection.
Threat intelligence	Information about known threats, such as malicious addresses, domains, and file hashes.
Transformation	Converting incoming data into a structure the platform can work with.
Triage	Reviewing detections in order of risk to decide which need investigation first. See Detections.
UEBA	User and Entity Behaviour Analytics — detecting behaviour that deviates from a baseline. Also a detection category.
xSIEM	eXtended Security Intelligence & Event Management. Extends traditional SIEM beyond log correlation with network detection, performance monitoring, and incident response. SentriaOne xSIEM unifies SIEM, NDR, NPM, and IR in one platform. See Platform Overview.