Security Operations and Incident Response

Glossary

200 terms from Security Operations and Incident Response, in plain words, each with the chapter that teaches it.

Search the glossary

#

.env file: A file where many web applications keep passwords and keys. Attackers' scripts ask every website for /.env, so a request for it in a web log is a probe, and a 200 reply would mean the secrets leaked.

A

AAA (authentication, authorization, and accounting): Three security functions. Authentication proves who you are, authorization decides what you may do, and accounting records what you actually did.
Access and accounting logs: Records of who reached which systems or places, what they did and for how long. They come in two kinds: logical (systems and data) and physical (doors and rooms).
Access log: A web server log with one line for every request: client address, time, request, status code, size, referrer and user agent. It records successful requests too, so a data theft shows up there as a 200.
Accounting: The part of AAA that records what an account actually did: which resources it used, when, for how long and how much data moved. Example: Priya's 45-minute VPN session that downloaded about 400 MB.
Advisory: A notice that warns people about a threat or vulnerability and says what to do. It can be internal (from your own team) or external (from outside).
Alert: A notice a monitoring tool raises when activity matches a rule or looks unusual, such as the EDR's 'Ransomware behavior' alert on office-pc-07.
Alert fatigue: What happens when so many false alerts arrive that tired analysts start ignoring them, and the real ones get buried.
API (application programming interface): A documented way for one program to ask another for data or an action. A web API takes requests at an address such as /api/tickets, usually over HTTPS, and usually answers in JSON.
API key: A long secret string that proves which program is calling an API. Each integration should get its own least-privilege key, and any key an attacker could have seen must be reset after an incident.
ARP cache: A system's in-memory table, kept by the Address Resolution Protocol, that matches nearby devices' IP addresses to their hardware (MAC) addresses. It is volatile evidence and sits near the top of the order of volatility.
ARP poisoning: An attack that sends fake ARP replies to machines on the same local segment, so traffic meant for another device goes to the attacker. It never crosses a router, so an edge firewall's log does not show it.
Artifact: Something left behind on a system that investigators can use, such as a file or a registry entry.
Assume breach: The mindset behind threat hunting: start from the belief that defenses may already have missed an attacker who is inside.

B

Badge cloning: Copying an access badge so that two cards open doors. It shows up as the same badge granted at two doors too far apart to walk between in the time.
Bandit: A free SAST tool for Python. In Kettle & Crane's pipeline it flagged shell=True in Dana's label code as HIGH and returned exit code 1, which stopped the change.
Blameless: The rule for a lessons learned meeting: fix processes and tools rather than punish people, so that mistakes are not hidden.
Blue team: In an exercise, the group that defends and responds while the red team plays the attackers.
Brute force: A password attack that makes many guesses against one account from one source. If the failures end in a success from the same address, as with the 212 failures for admin on the shop server, the attack worked.
Build: The automatic step that turns code into something that runs. In CI it happens after every merge.

C

CAM table (content addressable memory table): A switch's table of which MAC address sits on which port. MAC flooding fills it up so the switch starts sending frames out every port.
Chain of custody: A written record of every person who handled a piece of evidence, with signed and timed handoffs from collection to court. A gap, such as a laptop left on a desk overnight with no record, can lead a court to reject the evidence.
CI/CD (continuous integration and continuous deployment): The most common way to build a pipeline that automatically merges, builds, tests and deploys every code change, such as Dana's weekly changes to the shop.
CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act): A US law that will require critical infrastructure companies to report major cyber incidents to CISA within 72 hours and ransom payments within 24 hours. These duties begin only once its final rule takes effect, and in October 2026 that rule was still under White House review.
CISA (Cybersecurity and Infrastructure Security Agency): The US government agency that publishes cybersecurity advisories with attackers' methods and indicators, often jointly with the FBI.
Combined log format: A standard layout for a web access log line: client address, identity fields, time, request, status code, size, referrer (the linking page) and user agent. The shop's nginx server uses it.
Command injection: An attack where someone adds their own operating system command to input that a program passes to the command shell. Example: an attacker who can choose the order number in Dana's label code.
Communications (role): The incident response role that writes messages to staff, customers and the press, so that one consistent message goes out. Legal reviews those messages, and management approves them.
Containment: The fast, temporary step that stops an incident spreading or causing more damage before it is removed. It weighs ongoing damage against business impact and lost evidence, and it comes before eradication.
Continuous delivery: Every change that passes the checks is ready to go live, but a person approves the final step to production.
Continuous deployment (CD): Every change that passes all checks goes live automatically, with no person pressing a button.
Continuous integration (CI): Developers' changes are merged into the shared code often, usually many times a day, and each merge starts an automatic build and tests.
Contributing factors: Conditions that made an incident worse without causing it, such as the three days Sam's compromised account went unnoticed.
Correlation: Lining up separate records by time to see what really happened. Examples: Sam's badge exit beside a later remote sign-in, or a SIEM rule that links several events.
Credential stuffing: A password attack that tries many username and password pairs taken from another site's breach, often from many addresses.
CSIRT (computer security incident response team): The group that handles incidents. In a big company it is a full-time team in the SOC; in a small company like Kettle & Crane, people take roles alongside their normal jobs.
ct state: An nftables match on a connection's tracking state. In the quarantine rules it lets replies to allowed connections through.
Cyber range: A training lab with a realistic practice network where responders can run simulations safely.

D

DAST (dynamic application security testing): Testing that attacks the running app on a test or staging copy, as an outsider would.
Deadman switch: Malware that wipes a machine when it loses contact with the attacker. RFC 3227 warns that unplugging the network can trigger one.
Dependencies: Libraries written by others that your code uses. Dependency scanning checks them for known vulnerabilities.
Deprovisioning: Disabling every account of a person who leaves, on their end date. Dev's account opening the order spreadsheet after Dev left shows that deprovisioning failed.
Detection: Noticing a possible incident through monitoring tools or reports from people, and reacting to that alert or report.
Device logs: Records kept by network and security hardware such as firewalls, switches, routers and access points: rule hits, interfaces going up or down, configuration changes and admin sign-ins. They are usually sent to a collector by syslog.
DHCP (Dynamic Host Configuration Protocol): The service that assigns network addresses to devices. Its lease log records which device got which address, and when.
DHCP starvation: An attack where fake requests use up every address in the DHCP pool, so new devices get no address. The evidence is 'no free leases' on the DHCP server.
Digital forensics: Collecting, preserving and analyzing digital evidence in a way that would hold up in court. The steps are identify, collect, preserve, analyze a copy and report.
DLP (data loss prevention): Tools that alert when sensitive data leaves the organization.
DNS (Domain Name System): The service that looks up names and turns them into addresses. A DNS server's query log is one of the server logs.
DNS tunneling: Hiding data inside name lookups. It shows up on port 53 as long, odd names sent to one domain.
Door forced open alarm: Badge-system alarms for a door opened without a badge (forced) or left open too long (held). A held-open alarm can reveal tailgating.
Double extortion: A ransomware tactic where the attacker encrypts the data and also threatens to leak a stolen copy, as the group did with Kettle & Crane's customer list.

E

E-discovery (electronic discovery): The legal process of finding, preserving, collecting, reviewing and handing over electronically stored information for a lawsuit, inquiry or audit. Lawyers drive it, with IT's help.
EDR (endpoint detection and response): An agent on each computer that watches for malware behavior, raises alerts and can isolate the machine with one click.
EICAR test file: A harmless file that antivirus products flag on purpose. Detection tests use it to check that alerts arrive.
Eradication: Removing the cause of an incident (the malware, the persistence and the way in) and resetting exposed credentials. It comes after containment and before recovery.
Error log: A web server log that explains failed requests, such as 'access forbidden by rule' for /admin/. It records failures only, so a successful theft does not appear there.
ESI (electronically stored information): Any information kept in digital form, such as emails, documents, chats, database records, logs and backups. It is what e-discovery collects.
Event: Anything that happens on a system and can be observed, such as a sign-in or a blocked connection. Most events are harmless; a single failed sign-in is an event, not an incident.
Event Viewer: The Windows tool for viewing the System, Application and Security event logs.
Exit code: A number every program returns when it ends: 0 means success, anything else means a problem. A non-zero code fails a pipeline gate.
External advisory: A warning from outside the organization, such as from CISA, a vendor, an ISAC, a threat feed or law enforcement.

F

Facilitator: The person who runs a tabletop exercise: they describe the scenario and add injects.
Facility (syslog): The part of a syslog priority that says which kind of program sent the message, such as local7. It equals the priority divided by 8, ignoring the remainder.
False negative: A real attack with no alert, the most dangerous detection outcome. Its opposite, a true negative, is harmless activity correctly left without an alert.
False positive: An alert on harmless activity, which wastes time. A true positive is an alert on a real attack.
FBI (Federal Bureau of Investigation): The US law enforcement agency that victims report ransomware and extortion to. It advises against paying ransoms.
Federal Rules of Civil Procedure, Rule 37(e): The US court rule that lets a judge penalize a party that lost ESI it should have kept because it failed to take reasonable steps. If the loss was meant to deprive the other side, the court can assume the lost information was harmful to the party that lost it.
Five whys: A root cause method: ask 'why?' about five times until you reach something you can fix for good. Alex's chain ended at 'no owner for email security settings'.
Forensic image: An exact copy of a disk or of memory that analysts examine instead of the original. A hash confirms that the copy matches the original.
FreeRADIUS: A free RADIUS server. Kettle & Crane's VPN sends it accounting records, which it writes to a 'detail' file.

G

GDPR (General Data Protection Regulation): The European Union law on personal data. Article 33 requires notifying the supervisory authority within 72 hours of becoming aware of a breach, where feasible.

H

Hash: A short fingerprint calculated from a file's contents; changing one byte changes it completely. If the hash taken at collection matches a later one, the evidence is unchanged.
HIPAA (Health Insurance Portability and Accountability Act): The US law covering health information. Its breach rule requires notice without unreasonable delay, and within 60 days.
HTTP status codes: The three-digit number a web server returns for each request. 200 OK means success, 201 Created means a new item was made (such as ticket 1041), 403 Forbidden means access was refused, 404 Not Found means the item does not exist, and 500 means a server error.
HTTPS: The encrypted form of web traffic. Every API and webhook call between tools should use it.
Hub and spoke: An integration design that connects each tool once to a central hub, usually the SIEM or SOAR, instead of every tool to every other.

I

IC3 (Internet Crime Complaint Center): The FBI's website, ic3.gov, where US victims report cybercrime.
Identification: The incident response stage where the team notices something may be wrong, confirms it is a real incident, and rates its type and severity.
IDS and IPS (intrusion detection and prevention systems): Systems that watch network traffic and alert on attacks; a prevention system can also block them.
Incident manager: The one person who runs the response: sets priorities, assigns tasks and keeps the timeline. Alex plays this role at Kettle & Crane.
Incident response: The organized way a team handles an incident: prepare, find it, limit the damage, remove the cause, recover and learn.
Incident response plan: The single written guide for the whole response program: the team, contacts, what counts as an incident, severity levels and who must be told.
Infrastructure as code: Building servers from templates written as code. A pipeline scanner can check the templates for unsafe settings, such as a storage bucket open to the world.
Inject: A new development the facilitator adds during a tabletop, such as 'the note says customer data will be published in three days'.
Integration: A connection that lets two tools share data or trigger each other, usually through APIs, by polling or by webhooks.
Internal advisory: A warning written by the organization's own security team for its own people, such as Alex's chat message about 'Invoice 0417'.
Investigation: The stage of working out what happened (how the attacker got in, what they did and touched, and whether they are still there) while protecting the evidence.
IoC (indicator of compromise): A piece of evidence that an attack happened, such as a known bad file hash, a connection to a bad address, or an administrator account nobody created.
ISAC (information sharing and analysis center): An industry group that shares threat warnings among its members, such as the retail and hospitality ISAC.
Isolation: Cutting a running system off from the network so it can't spread malware or talk to the attacker, while its memory survives for forensics. Example: the EDR's one-click isolation of office-pc-07.

J

journalctl: The Linux command for reading the system journal, where the system writes its logs.
JSON (JavaScript Object Notation): A plain-text data format made of names and values, such as `"severity": "high"`, that almost every security tool can read and send. Security alerts and API requests and responses are often written in JSON so tools can pass data to each other.

K

Known Exploited Vulnerabilities catalog: CISA's list of flaws that attackers are using now.

L

Lateral movement: An attacker hopping from one compromised machine to others on the network. Isolating the host prevents it.
Least privilege: Giving each person, job or program only the access it needs. For example, the mail playbook's key can only search and delete messages.
Legal hold: A written instruction that stops normal deletion of information relevant to expected legal action. Because of one, Alex turned off the 30-day automatic email deletion.
Lessons learned: A blameless meeting soon after an incident where everyone involved reviews what happened and agrees on changes, each with an owner and a date. The changes feed back into preparation.
Log: A record of events, one timed entry per event.
Log rotation: Logs being automatically overwritten to save space. Copy logs to safe storage before they rotate.
logger: A standard Linux tool that sends a syslog message. In the lab it played the firewall fw-office.
Logical access: Access to systems and data through software, such as a VPN, file shares, databases and cloud resources. Its logs show who reached what, for how long and how much.

M

MAC (media access control) address: A device's hardware address on the local network. Switches use it to decide which port to send each frame to.
MAC flooding: Sending thousands of frames from fake MAC addresses to fill a switch's CAM table, so the switch floods traffic out every port. Example: hundreds of new MAC addresses on port 7 of the office switch.
Mail forwarding rule: A mailbox setting that automatically sends copies of email to another address. Attackers set one up on a phished account to keep reading its mail, as with Sam's rule that forwarded invoices to an outside address.
Managed security service: An outside company that watches alerts and helps respond for an organization, for example at night. Kettle & Crane's provides its technical responders and forensic analyst.
Management (executive sponsor): The incident response role that makes business decisions, such as shutting down the shop, spending money or hiring outside help. It is separate from the incident manager, who coordinates the response.
Mandatory notification: Notice that a law, regulation or contract requires, often within a fixed deadline, such as Oregon's 45 days. Missing it can bring fines and lawsuits on top of the incident's harm.
Metrics: Measurements in the incident report, such as time to detect, contain and recover, used to compare responses over time. At Kettle & Crane they were two minutes, eight minutes and two days.
MITRE ATT&CK: A public catalog of attacker techniques that threat hunters use to organize their hypotheses.

N

NAC (network access control): A system that checks a device's health before letting it on the network, and can put a failing device into a quarantine network.
NAS (network access server): In RADIUS records, the device that let the user in, such as the VPN server at 10.0.10.1.
Negotiation: Communicating with an attacker, usually in a ransomware or extortion case, to gain time, proof, intelligence or better terms. Trained negotiators do it, and it is separate from any decision to pay.
nftables: The built-in firewall framework in modern Linux, which uses rule sets to decide which network traffic a machine accepts or drops. In incident response, a rule set such as `quarantine.nft` can isolate an infected host by dropping all traffic by default and allowing it to talk only to the security console.
nginx: A common web server, used for the shop. It writes an access log and an error log.
NIST Cybersecurity Framework 2.0: A NIST framework with six functions: govern, identify, protect, detect, respond and recover. SP 800-61 Revision 3 maps incident response to them.
NIST SP 800-61: The incident response guide from the US National Institute of Standards and Technology. Revision 2 (2012) used four phases; Revision 3 (April 2025) maps incident response to Cybersecurity Framework 2.0.
Notification: Telling the right people about an incident (stakeholders, customers, law enforcement and anyone the law requires), saying only what is known to be true.
NTP (Network Time Protocol): The protocol devices use to set their clocks from one shared time source, so events from different logs line up in the right order.

O

OFAC (Office of Foreign Assets Control): The US Treasury office that warns that paying a ransom to a party on its sanctions list can break US law. Timely reporting to law enforcement counts in the victim's favor if a payment later turns out to have reached such a party.
Order of volatility: The rule to collect the most short-lived evidence first: registers and cache, then memory and network tables, temporary files, disk, remote logs, physical layout, and finally archival media such as backups.
Out-of-band communication: A separate way for the response team to talk, such as a phone group, outside the systems the attacker may control.

P

Password spraying: Trying one common password, such as Autumn2026!, once against many accounts, slowly, to avoid lockouts.
PCI DSS (Payment Card Industry Data Security Standard): A contract standard for companies that accept cards. Requirement 12.10 demands an incident response plan that includes notifying the card brands.
Penetration testing: Hired testers attacking your systems to find weaknesses. It is different from testing your response plan.
Persistence: Ways an attacker leaves to come back, such as new accounts, scheduled tasks, mail forwarding rules or remote access tools. Eradication must remove all of them.
Phishing: A fake message that tricks people into opening an attachment, clicking a link or giving a password, like Jo's 'Invoice 0417 overdue' email.
Phishing simulation: Sending staff a harmless fake phishing email to measure who clicks and who reports it.
Physical access: Entering a place. Its logs (badge readers, visitor sheets, key logs) show who entered where and when, and can confirm or rule out a suspect such as Sam.
Piggybacking: A badge holder knowingly letting someone in behind them. The badge log shows only the holder's swipe.
ping: A network command that sends small test messages to an address and reports whether replies come back. Analysts use it to test connectivity, for example to confirm that an isolated PC can still reach the security console but no other machine.
Pipeline: A chain of automated steps that takes a code change from a developer to the live system. A security check placed in it runs on every change.
Playbook: A step-by-step guide for one kind of incident, with its trigger, steps, decision points, roles, evidence to keep and who to tell. In a SOAR platform, stored workflows are also called playbooks.
Polling: An integration that calls a tool's API on a schedule to ask 'anything new?'. It is simple but slower than a webhook.
Port security: A switch setting that allows only a few MAC addresses per port, which blocks MAC flooding.
Post-incident reporting (PIR): The formal written report of an incident: executive summary, timeline, scope and impact, root cause, actions, recommendations and metrics.
Preparation: Everything done before an incident so the team can respond well: the plan, contacts, tools, logging, training, tests, exercises and outside help on retainer.
Preservation: Protecting evidence from being changed or lost, using hashes, write blockers, the order of volatility and legal holds, and by leaving machines powered on.
Priority (syslog): The number in angle brackets at the start of a syslog message, equal to facility × 8 + severity. For example, <188> means facility 23 (local7) and severity 4 (Warning).

Q

Quarantine: Moving something suspicious, such as a file, email or device, into a restricted holding area where it can't do harm but is kept for study.

R

RADIUS (Remote Authentication Dial-In User Service): A protocol for central sign-in checking and accounting. VPN servers and Wi-Fi controllers check users against a RADIUS server and send it a start and a stop record for each session.
RADIUS accounting record: A Start, Stop or Interim-Update record for a session, giving the user, where they connected from, how long the session lasted and the bytes (octets) moved. 'Output' means sent to the user, from the server's point of view.
Ransomware: Malware that encrypts files and demands payment, like the attack that started on Jo's PC, office-pc-07.
Recovery: Restoring systems and data from clean backups taken before the compromise, hardening them, bringing them back in stages, then verifying and watching them closely.
Red team: In an exercise, the group that plays the attackers against the blue team.
Reimage: Wiping a computer's disk and reinstalling from a known good image, the safe way to remove malware.
Remote Desktop (port 3389): A Windows remote-control service on TCP port 3389 and a favorite target for attackers. It appeared in fw-office's drop message.
Retainer: A contract signed in advance with an incident response firm, so help arrives in hours, not days.
Retention: Keeping logs long enough to look back, because many attacks are found weeks after they begin.
RFC 3227 (Request for Comments 3227): The Internet Engineering Task Force's published guide to collecting evidence. It gives the order of volatility and warns about deadman switches.
Root cause analysis (RCA): Finding the deepest reason an incident happened, the one that stops it recurring once fixed, rather than the symptom you saw (an encrypted laptop).
Runbook: Detailed technical steps for one routine task, such as isolating a laptop in the EDR console. Runbooks are often automated.

S

Sandbox: A safe, separate test machine for opening suspicious links and attachments to see what they do.
SAST (static application security testing): Scanning that reads code without running it, looking for unsafe patterns. Bandit is a SAST tool.
SBOM (software bill of materials): A list of every component in a build. Software composition analysis can produce one.
SCA (software composition analysis): Checking third-party libraries (dependencies) against lists of known vulnerabilities at build time.
SEC Form 8-K, Item 1.05: The US Securities and Exchange Commission rule that public companies disclose a material cyber incident within four business days of deciding it is material. It does not apply to private companies such as Kettle & Crane.
SecOps (security operations): The day-to-day work of keeping systems safe, watching for attacks and responding to them.
Secret scanning: A pipeline check at commit that looks for passwords, keys and tokens typed into code, like the API_KEY that Bandit missed.
Secrets vault: Protected storage for keys and passwords, so they are never kept in scripts or code. Keys stored there should be rotated on a schedule.
Security gate: A pipeline step that stops a change from going live if its check fails, such as secret, dependency, code or configuration scanning.
Security incident: An event or group of events that harms or threatens the confidentiality, integrity or availability of systems or data, or breaks a security policy.
Server logs: Records kept by servers: the operating system's logs (Windows event logs, Linux journal and /var/log files) and the logs of services such as web, mail, DNS and DHCP.
Severity: A rating of how serious an alert or incident is (low, medium, high or critical), based on what is affected, the data at risk and whether the attack is spreading.
SHA-256 (Secure Hash Algorithm 256-bit): A hash algorithm that turns a file's contents into a 256-bit fingerprint, written as 64 hexadecimal characters, which changes completely if even one byte changes. Investigators record the SHA-256 hash of evidence, such as the phishing email `invoice-0417.eml`, when they collect it, so they can later show the evidence is unchanged.
sha256sum: A Linux command that calculates a SHA-256 hash. With -c it checks a file against a saved hash and prints OK or FAILED.
shell=True: A Python subprocess option that hands text to the operating system's command shell. It makes command injection possible, and Bandit flagged it HIGH.
Shift left: Moving security checks earlier in the process, toward the developer, where a flaw is cheaper to fix.
SIEM (security information and event management): A system that collects logs from everywhere, correlates them and alerts on rules. It often acts as the integration hub.
Simulation: A hands-on exercise where people actually perform the response on lab systems, or carefully on real ones, measuring timing and performance.
SMB (Server Message Block, port 445): Windows file sharing on TCP port 445. One host rapidly trying it on many addresses is the classic sign of worm scanning.
SOAR (security orchestration, automation, and response): A platform with ready-made connectors and an editor for automated trigger, condition and action workflows, which it stores as playbooks.
SOC (Security Operations Center): A team, and often a room, that watches alerts day and night and starts the response.
SSO (single sign-on): One sign-in that gives access to many systems. Disabling a badge does not stop an SSO sign-in from home.
Stakeholders: People and groups with an interest in an incident, such as leaders, staff, the insurer, partners like the 40 cafés, and the payment processor. Each needs its own message.
sudo: A Linux command that runs another command as administrator. Every use is logged with the user and the command.
Syslog: The standard message format for sending log events over the network to a collector. It traditionally uses UDP port 514, which is cleartext; TLS on TCP port 6514 protects the messages.
Syslog severity levels: Eight levels from 0 (Emergency, the most urgent) through Alert, Critical, Error, Warning, Notice and Informational to 7 (Debug). The severity is the remainder when you divide the priority by 8.

T

Tabletop exercise: A discussion-based exercise where the team talks through a made-up incident step by step without touching real systems. It is cheap and good at finding gaps in the plan.
Tailgating: An intruder slipping in behind someone who badged. The badge log shows only one swipe, so the proof comes from cameras, a guard or a door-held-open alarm.
TCP (Transmission Control Protocol): A network protocol that sets up a connection and delivers data reliably and in order. Services such as Remote Desktop (3389) and SMB (445) use TCP ports.
Testing: Checking, with a clear pass or fail, that one part of the response works, such as a backup restore, an alert, the call tree or tool access.
Threat hunting: A proactive search, starting from a testable hypothesis, for attackers that no alert has caught. Alex's hunt found Sam's forwarding rule and turned it into a new SIEM rule.
Threat intelligence feed: A stream of indicators and reports on attack groups, published by security companies.
Timeline: The events of an incident in time order (first email, first click, first suspicious process, first connection out), built from the logs and evidence. It shows what happened, gives the date for choosing a clean backup, and supplies the report's metrics.
TLS (Transport Layer Security): Encryption for network connections. Sending syslog over TLS protects its integrity and confidentiality.
Trace: A record that follows one action, such as a checkout request, through every system it passed, tied together by a shared ID.
Training: Teaching each group the knowledge and skills for its part in a response, such as Alex's course on the new EDR console.
Triage: Sorting alerts: throwing out the false ones and giving the real ones a severity.
Trigger, condition and action: The three parts of an automated workflow: the event that starts it, the test that picks a path, and what it does, such as opening ticket 1041.

U

UDP (User Datagram Protocol): A connectionless network protocol that sends messages without confirming delivery. Syslog traditionally uses UDP port 514, where messages can be read, dropped or spoofed in transit.
User agent: The field in a web log naming the program that made the request, as it describes itself. 'python-requests' means a script, not a browser.

V

Volatile data: Evidence lost when a device loses power, such as memory holding running malware, network connections and encryption keys.
VPN (virtual private network): An encrypted connection that lets users reach the company network remotely. Kettle & Crane's VPN server sends accounting records to RADIUS.

W

Webhook: A web address that one tool calls the moment something happens, to tell another tool about it. It gives real-time notice, unlike polling.
Windows event IDs: Numbers for Windows log entries: 4624 successful sign-in, 4625 failed sign-in, 4663 object access, 4720 account created, 4732 member added to a security-enabled local group, 1102 audit log cleared, 7045 new service installed.
Workflow: A set of steps that always happen in the same order to finish one job, such as handling a phishing report.
Workflow automation: Software running a workflow's steps by itself whenever the job comes up, recording what it did and leaving big decisions to people.
Worm: Malware that spreads by itself. An infected PC rapidly tries many addresses on one port, such as SMB 445, which shows up in firewall or IDS logs.
Write blocker: A device or setting that lets you read a disk with no chance of writing to it, so the evidence is preserved.