Glossary

36 terms used on this site. Each has a short definition and one example taken from a named vendor's documentation, with the page and the read date.

• ATT&CK coverage. ATT&CK coverage is the share of MITRE ATT&CK techniques a set of detections maps to.
• Backtest. A backtest is a replay with a report: the rule runs over a stated period of past data and the result is kept as a record of alerts, matches and timing.
• CI pipeline. A CI pipeline is the automated sequence that runs on each change to the rule repository: lint, validate, test and, on merge, deploy.
• Community rules. Community rules are detections written and shared by users, not by the product vendor.
• Content library. A content library is a vendor- or community-maintained set of ready-made detections.
• Coverage gap. A coverage gap is an ATT&CK technique, or a part of the estate, with no detection or no working detection.
• Data source coverage. Data source coverage is which log sources are onboarded, and whether the rules that need them can run.
• Deprecation. Deprecation is retiring a rule on purpose: marking it, warning its users and turning it off on a date.
• Detection as code. Detection as code means detection rules live in a version-controlled repository, change through reviewed pull requests, and reach the SIEM through a pipeline instead of console edits.
• Detection engineering. Detection engineering is the work of designing, writing, testing, deploying and maintaining the rules that raise alerts, and of measuring whether they still work.
• Detection repository. A detection repository is the git repository that holds rules, tests and pipeline files.
• Detection rule. A detection rule is a stored query or logic that runs over security data and raises an alert when it matches.
• EQL. EQL, the Event Query Language, is a query language in Elastic for ordered sequences of events, such as a process start followed by a network connection from the same host.
• ES|QL. ES|QL is Elastic's piped query language for filtering, transforming and analysing data.
• ESCU. ESCU is the Enterprise Security Content Update, the detection content Splunk ships for Enterprise Security.
• False positive rate. False positive rate is the share of a rule's alerts that turn out to be benign.
• Field drift. Field drift is when the fields a rule depends on change name, type or meaning, or stop appearing, so the rule quietly stops matching.
• KQL. KQL, the Kusto Query Language, is the query language of Microsoft Sentinel analytics rules and hunting.
• Log source health. Log source health is whether each log source is sending data on time and in the expected shape.
• Noisy rule. A noisy rule fires far more often than it finds anything real, burying analysts in alerts.
• Prebuilt rules. Prebuilt rules are detections a platform ships and updates for you, which you can enable, tune or clone.
• Pull request workflow. A pull request workflow is how a rule change is proposed, reviewed and approved before it ships.
• pySigma. pySigma is the Python library that parses Sigma rules and converts them into queries through installable backend and pipeline plugins.
• Replay. Replay runs a rule over historical data to see what it would have alerted on.
• Rollback. Rollback is returning a rule to an earlier version after a change causes harm, such as a flood of alerts or a missed detection.
• Rule health. Rule health is whether a detection still runs, still sees its data and still earns its alerts.
• Rule lifecycle. Rule lifecycle is the set of states a rule moves through, from draft and test to production, scheduled for deprecation and retired.
• Rule unit test. A rule unit test runs a detection against a small set of sample events and checks whether it alerts on the ones it should and stays quiet on the others.
• Rule versioning. Rule versioning keeps every revision of a rule so you can see what changed, who changed it and when.
• Schema change. A schema change is an edit to how log fields are named, typed or nested, whether in the source system, the parser or the normalisation layer.
• Sigma. Sigma is an open YAML format for describing log-based detections once, so converters can turn them into queries for different SIEMs.
• Silent rule. A silent rule is a detection that stops producing alerts because it is failing, disabled or starved of data, not because there is nothing to find.
• SPL. SPL, the Search Processing Language, is Splunk's query language.
• Synthetic event. A synthetic event is a log record generated to look like the result of a specific attack behaviour, used to test whether a detection fires.
• Tuning. Tuning is adjusting a rule so it keeps its true positives and drops its false ones: tighter conditions, exclusions or thresholds.
• YARA-L. YARA-L is the rule language of Google Security Operations.