Glossary: Security Operations and Incident Response

nftables

Also written: nft, policy drop, ip saddr, ip daddr

The built-in firewall framework in modern Linux, which uses rule sets to decide which network traffic a machine accepts or drops. In incident response, a rule set such as `quarantine.nft` can isolate an infected host by dropping all traffic by default and allowing it to talk only to the security console.