SOC ANALYST ACRONYMS

acronyms i need to know for being in a soc

SIEM

(Security Information and Event Management): The central nervous system of a SOC. It collects, logs, and analyzes data from across the network to identify potential security threats.

SOAR

(Security Orchestration, Automation, and Response): Tools that allow security teams to automate repetitive tasks and standardize incident response workflows.

MSSP

(Managed Security Service Provider): An outsourced third-party company that manages security devices and systems for an organization.

MDR

(Managed Detection and Response): An outsourced service that specifically focuses on actively detecting and responding to threats, often acting as a remote SOC

EDR

(Endpoint Detection and Response): Security software installed on individual devices (endpoints like laptops or servers) to monitor for and respond to suspicious behavior.

NDR

(Network Detection and Response): Tools that continuously monitor network traffic to detect anomalous behavior and prevent lateral movement by attackers.

XDR

(Extended Detection and Response): The evolution of EDR. It integrates data from endpoints, networks, servers, and the cloud to provide a unified view of threats.

IDS / IPS

(Intrusion Detection System / Intrusion Prevention System): Network security appliances. An IDS alerts you to suspicious traffic, while an IPS actively blocks it.

DLP

Data Loss Prevention): Software or processes designed to ensure sensitive data is not lost, misused, or accessed by unauthorized users.

IOC

(Indicator of Compromise): Forensic evidence that a breach has already occurred (e.g., a known malicious IP address, a virus signature, or a suspicious registry alteration).

IOA

(Indicator of Attack): Evidence that an attack is currently underway, focusing on the intent and behavior of the attacker regardless of the specific tools they are using.

TTP

(Tactics, Techniques, and Procedures): The behaviors and methods used by threat actors to execute attacks (heavily mapped in the MITRE ATT&CK framework).

APT

(Advanced Persistent Threat): A stealthy, prolonged cyberattack where an intruder gains access to a network and remains undetected for an extended period, usually to steal data.

CVE

(Common Vulnerabilities and Exposures): A standardized list of publicly disclosed cybersecurity vulnerabilities and exposures (e.g., CVE-2021-44228).

MTTD

Mean Time to Detect): The average amount of time it takes a SOC team to discover a security threat after it has entered the system

MTTR

(Mean Time to Respond / Resolve / Remediate): The average time it takes to neutralize a threat and recover from it once it has been detected.

IAM

(Identity and Access Management): The framework of policies and technologies ensuring that the right users have the appropriate access to technology resources.

PAM

(Privileged Access Management): Tools and strategies specifically used to secure, control, and monitor accounts with elevated permissions (like system administrators).

ZTNA

(Zero Trust Network Access): A security model based on the principle of "never trust, always verify." It requires all users to be authenticated and authorized before granting access to applications and data, regardless of whether they are inside or outside the network perimeter.

RBAC

(Role-Based Access Control): Restricting network access based on the roles of individual users within an enterprise (e.g., HR gets access to payroll, IT gets access to servers).

CASB

(Cloud Access Security Broker): A security checkpoint placed between cloud service consumers and providers to enforce security policies (like blocking the upload of sensitive data to personal Dropbox accounts).

CSPM

(Cloud Security Posture Management): Tools that automate the identification and remediation of risks and misconfigurations across cloud infrastructures (AWS, Azure, GCP).

CNAPP

(Cloud-Native Application Protection Platform): An all-in-one cloud security platform that combines CSPM, workload protection, and entitlement management into a single unified solution.

SASE

(Secure Access Service Edge): A framework that merges network routing (like SD-WAN) with network security services (like ZTNA and CASB) into a single cloud-delivered service

DFIR

(Digital Forensics and Incident Response): The specialized field within a SOC focused on identifying, investigating, and remediating cyberattacks, as well as preserving digital evidence.

SLA

(Service Level Agreement): The contracted expectations between a service provider and a client. In a SOC, this often dictates the maximum allowable time to acknowledge or resolve an alert.

IRP

(Incident Response Plan): A formalized, step-by-step document that outlines how an organization should respond to a cybersecurity breach.

RAT

(Remote Access Trojan): A type of malware that provides an attacker with remote administrative control over a target computer, often allowing them to view the screen, log keystrokes, and download files.

DDoS

(Distributed Denial of Service): An attack intended to disrupt the normal traffic of a targeted server, service, or network by overwhelming it with a flood of internet

RaaS

(Ransomware as a Service): A business model where sophisticated malware developers sell or lease ransomware variants to less-technical affiliates who carry out the actual attacks in exchange for a cut of the payout.

CTI

(Cyber Threat Intelligence): Data that has been collected, analyzed, and shared about threat actors, their motives, and their attack behaviors to help defenders make informed decisions.

OSINT

(Open-Source Intelligence): Intelligence gathered from publicly available sources (public websites, social media, public IP registries, and even dark web forums)

NIST CSF

(National Institute of Standards and Technology Cybersecurity Framework): A widely adopted set of guidelines and best practices to help organizations manage and reduce cybersecurity risk (organized around: Identify, Protect, Detect, Respond, Recover).

Zero-Day

A vulnerability that is unknown to the software creator or the public, meaning there

is "zero days" of warning before it can be exploited.

Exploit

Program/code designed to take advantage of a vulnerability.

Bots & Botnets

Programs performing automated tasks without human interaction. A Botnet

is a collection of these compromised bots.

Scareware:

Makes false claims about a device infection, requesting payment to "solve" the

issue.

Extortionware / Leakware (Double Extortion)

(Targets Confidentiality) Like ransomware, but

also involves exfiltrating encrypted data and threatening public release if the ransom is not

paid.

ZTA / ZTNA

(Zero Trust Architecture and Network Access

PAM

(Privileged Access Management): Tools to secure and monitor accounts with elevated

permissions.

DMZ

(Demilitarized Zone): A subnetwork exposing external-facing services while keeping

them separated from the internal network.

VLAN

(Virtual Local Area Network): Logical grouping of network devices that acts as an

independent network.

BGP

(Border Gateway Protocol): The internet's routing protocol. "BGP Hijacking" routes traffic

maliciously.

PKI

(Public Key Infrastructure): Framework protecting client-server communications via digital

certificates and a two-key system (public/private).

DevSecOps:

Integrating security testing directly into the software development process.

OWASP

(Open Worldwide Application Security Project): Nonprofit foundation. Famous for the

"OWASP Top 10" critical web app risks.

SQLi

(SQL Injection): Injecting malicious SQL code into input fields to manipulate backend

databases.

XSS

(Cross-Site Scripting): Injecting malicious scripts into trusted websites to execute in

visitors' browsers.

Watering Hole Attack:

Infecting a website the target is known to frequently visit, rather than

attacking the target directly.