Resources · Glossary

Cybersecurity glossary

Clear, technically accurate definitions of the terms that shape security decisions — with context on why each one matters.

C

CTICyber Threat Intelligence

Evidence-based knowledge about adversaries — their intent, capability, infrastructure and tradecraft — validated and contextualised for decision-making.

Why it matters: It converts raw threat data into detection content, prioritisation decisions and strategic awareness relevant to your organisation.
Example: Sector reporting identifies a campaign targeting your industry with a specific phishing pattern, prompting a tuning of mail filtering and user awareness.
Related concepts: IOC · TTP · MITRE ATT&CK

Netralink threat intelligence services

D

DLPData Loss Prevention

Controls that identify, monitor and protect sensitive data in motion, at rest and in use — preventing unauthorised disclosure.

Why it matters: Preventing exfiltration matters as much as preventing intrusion; DLP adds a data-centric control layer.
Example: A document containing customer account patterns triggers an alert when copied to personal cloud storage, and the transfer is blocked by policy.
Related concepts: Data Security · Insider Threat · NDR

Netralink detection and response

DNSDomain Name System

The system that resolves human-readable domain names to IP addresses — and, increasingly, a protocol abused for command-and-control, tunnelling and malicious redirection.

Why it matters: Nearly every connection begins with DNS. Controlling and monitoring it blocks attacks and provides valuable detection telemetry.
Example: DNS tunnelling encodes stolen data in query patterns to attacker-controlled nameservers; DNS analytics detects the anomalous query rate and volume.
Related concepts: NDR · Threat Intelligence · Network Security

Netralink DNS security

E

EDREndpoint Detection and Response

Continuous recording and behavioural analysis of endpoint activity — processes, files, registry and network connections — with investigation and response capabilities such as host isolation.

Why it matters: Most intrusions still begin on an endpoint, and fileless techniques defeat signatures. EDR detects behaviour, not just known malware.
Example: A document opens PowerShell to download a payload; EDR traces the full process lineage and isolates the host before persistence is established.
Related concepts: XDR · MDR · Ransomware · Malware

Netralink EDR solutions

I

IAMIdentity and Access Management

The policies, processes and technologies that manage digital identities and their access — authentication, authorisation and lifecycle governance.

Why it matters: Identity is the primary security boundary in cloud and remote-work environments; weak identity controls are the most common root cause in breaches.
Example: Single sign-on and conditional access ensure a departing employee loses access to every connected application automatically on their last day.
Related concepts: PAM · SSO · MFA · Zero Trust

Netralink IAM services

IDSIntrusion Detection System

A system that monitors network traffic or host activity for suspicious activity and generates alerts, typically based on signatures or anomaly rules.

Why it matters: IDS provides detection coverage where signatures exist, but modern threats require behavioural analytics that NDR and EDR add.
Example: An IDS signature fires on a known exploit pattern in inbound traffic, alerting the SOC for triage.
Related concepts: IPS · NDR · Firewall

Netralink NDR solutions

Incident ResponseIncident Response

The structured process of triaging, containing, investigating, eradicating and recovering from a security incident, followed by post-incident improvement.

Why it matters: Containment speed determines impact; structure under pressure determines decision quality.
Example: A ransomware infection is isolated to three hosts, the entry vector is identified, credentials are reset and recovery is verified before systems return.
Related concepts: SOC · Digital Forensics · MDR

Netralink incident response

IOCIndicator of Compromise

An observable artefact suggesting a potential intrusion: file hashes, IP addresses, domains, URLs, registry keys or behavioural traces.

Why it matters: IOCs enable rapid detection and blocking when enriched, scored and automated — but they age quickly as attackers rotate infrastructure.
Example: A domain observed in command-and-control traffic is added to DNS blocking and monitored across the estate for historical lookups.
Related concepts: TTP · Threat Intelligence · Threat Hunting

Netralink threat intelligence

IPSIntrusion Prevention System

An inline system that detects and blocks malicious traffic in the network path, typically using signatures and protocol inspection.

Why it matters: Prevention stops known attacks in real time, though it must be carefully tuned to avoid blocking legitimate traffic.
Example: An exploit attempt against a public web server is dropped inline before reaching the application.
Related concepts: IDS · NDR · WAF

Netralink network security

M

MDRManaged Detection and Response

A service model in which a provider operates detection and response on your behalf — monitoring, triage, investigation and, where agreed, containment.

Why it matters: Continuous detection and response requires staffing and expertise that many organisations cannot build in-house.
Example: An alert fires at 03:00; the MDR provider investigates, confirms a compromised account, disables the session and escalates to your on-call lead with a full report.
Related concepts: SOC · XDR · Incident Response

Netralink SOC services

MicrosegmentationMicrosegmentation

Fine-grained network segmentation that applies policy at the workload level, restricting lateral movement between individual systems or groups.

Why it matters: It converts a flat network — where one compromised host reaches everything — into a constrained environment where attackers are contained.
Example: A compromised web server cannot scan the database subnet because workload-level policy permits only the specific database port it legitimately needs.
Related concepts: Zero Trust · NDR · Network Security

Netralink network segmentation

MITRE ATT&CKMITRE Adversarial Tactics, Techniques & Common Knowledge

A curated knowledge base of adversary tactics and techniques based on real-world observations, used to structure detection coverage and threat understanding.

Why it matters: It provides a common language for mapping detections to adversary behaviour and identifying coverage gaps.
Example: A detection engineering programme maps rules to ATT&CK techniques and tracks which techniques in priority threat groups are covered.
Related concepts: TTP · Threat Hunting · CTI

Netralink threat intelligence

N

NDRNetwork Detection and Response

Monitoring of network traffic — flows, sessions and metadata — to detect malicious or anomalous behaviour such as lateral movement, beaconing and exfiltration, and to support investigation and response.

Why it matters: Endpoint agents cannot cover everything. NDR sees unmanaged devices, OT/IoT segments and third-party traffic that endpoint tools miss.
Example: A workstation begins connecting to dozens of internal hosts over SMB within minutes — NDR flags it as lateral movement consistent with ransomware staging.
Related concepts: IDS · IPS · SIEM · Threat Hunting

Netralink NDR solutions

P

PAMPrivileged Access Management

Controls that protect accounts with elevated rights — administrators, root users and service accounts — through vaulting, rotation, just-in-time access, session brokering and recording.

Why it matters: Privileged credentials appear in nearly every significant breach. Controlling them breaks attacker escalation chains.
Example: A database administrator checks out the root password for a change window; the session is brokered, recorded and the credential rotated automatically afterwards.
Related concepts: IAM · Zero Trust · Least Privilege

Netralink privileged access management

R

RansomwareRansomware

Malicious software that encrypts or steals data and demands payment — often with double extortion, threatening publication of exfiltrated data.

Why it matters: It is among the most disruptive threat classes, and its precursors — credential access, lateral movement, staging — are detectable before encryption begins.
Example: Detecting mass file-rename behaviour and shadow-copy deletion lets response isolate the host before encryption spreads to file shares.
Related concepts: EDR · XDR · Incident Response · Backups

Netralink endpoint protection

S

SIEMSecurity Information and Event Management

A platform that collects, normalises, stores and analyses log and event data from across an organisation, correlating events against detection rules and retaining searchable history.

Why it matters: Detection depends on centralised, reliable data — and investigations and compliance depend on retained, searchable evidence.
Example: Authentication logs, firewall events and application audit trails are correlated to alert on a service account being used from an unexpected location.
Related concepts: SOAR · XDR · Log Management

Netralink SIEM solutions

SOARSecurity Orchestration, Automation and Response

Technology that connects security tools and executes defined response workflows automatically, with case management and reporting.

Why it matters: Machine-speed attacks require machine-speed containment for known scenarios, and analysts should not spend their time on repetitive manual steps.
Example: A confirmed malicious hash triggers a playbook that isolates the host, blocks the associated domain at the firewall and opens a case with all evidence attached.
Related concepts: SIEM · Incident Response · MTTR

Netralink SOAR services

SOCSecurity Operations Center

The team and function responsible for continuously monitoring, detecting, investigating and responding to security events.

Why it matters: Telemetry without operational judgement is noise. The SOC turns data into decisions — and decisions into containment.
Example: A phishing campaign triggers alerts across multiple mailboxes; the SOC triages, confirms the campaign, purges messages tenant-wide and blocks the sender infrastructure.
Related concepts: MDR · SIEM · Threat Hunting · Incident Response

Netralink SOC services

T

Threat HuntingThreat Hunting

Proactive, hypothesis-driven search for threats that have evaded automated detection, using telemetry, intelligence and analyst expertise.

Why it matters: Automation catches known patterns; hunting finds the unknown and validates whether detection gaps are being exploited.
Example: Acting on intelligence about a new persistence technique, an analyst queries endpoint telemetry estate-wide and confirms no matching activity — or finds it.
Related concepts: SOC · CTI · EDR

Netralink SOC services

TTPTactics, Techniques and Procedures

The behavioural patterns adversaries use — how they gain initial access, escalate, move laterally and persist — as opposed to specific tools or indicators.

Why it matters: TTPs are more durable than indicators. Detecting behaviour catches adversaries even when their infrastructure changes.
Example: Rather than blocking one malicious IP, a detection rule targets the technique of credential dumping via known system utilities.
Related concepts: MITRE ATT&CK · IOC · Threat Hunting

Netralink threat intelligence

V

VPNVirtual Private Network

An encrypted tunnel that connects a user or site to a network. Traditional VPNs grant network-level access after authentication at the gateway.

Why it matters: VPNs remain useful for site connectivity and specific use cases, but broad network access and one-time authentication make them a weaker fit for Zero Trust access than ZTNA.
Example: A remote employee connects via VPN and can reach internal systems; with ZTNA, the same access is scoped to specific applications and continuously verified.
Related concepts: ZTNA · Zero Trust · Remote Access

Netralink network security

W

WAFWeb Application Firewall

A control that filters and monitors HTTP(S) traffic to protect web applications from attacks such as injection, cross-site scripting and abuse.

Why it matters: Web applications are the most exposed part of most estates; a WAF provides a protective layer that complements secure development.
Example: A credential-stuffing burst is rate-limited and blocked at the WAF before it reaches the authentication endpoint.
Related concepts: DDoS · API Security · Penetration Testing

Netralink application testing

X

XDRExtended Detection and Response

A security architecture that collects and correlates telemetry from multiple control points — endpoint, network, identity, cloud and email — into unified detection, investigation and response workflows.

Why it matters: Threats cross tool boundaries. XDR connects the signals so defenders see the whole attack rather than fragments in separate consoles.
Example: A phishing email compromises an identity; XDR links the suspicious sign-in to endpoint execution on a server and outbound command-and-control traffic — one incident instead of three unrelated alerts.
Related concepts: EDR · NDR · SIEM · SOAR

Netralink XDR solutions

Z

Zero TrustZero Trust Security

A security model in which no user, device or network is implicitly trusted; every access request is authenticated, authorised and continuously verified.

Why it matters: Perimeter trust fails in cloud and remote-work environments. Zero Trust constrains attackers who already hold valid credentials.
Example: Access to a finance application requires phishing-resistant MFA and a compliant device, and the session is revoked if behaviour becomes anomalous.
Related concepts: ZTNA · Microsegmentation · IAM · PAM

Netralink Zero Trust services

ZTNAZero Trust Network Access

Technology that grants access to specific applications — after verifying user identity and device posture — instead of placing users on the network via broad VPN connectivity.

Why it matters: It limits what a compromised credential or device can reach, and removes the internal network as a free-roaming target.
Example: A contractor accesses only the invoicing application they are authorised for, with access re-evaluated continuously — not the entire corporate network.
Related concepts: Zero Trust · VPN · Microsegmentation

Netralink Zero Trust services

Questions the glossary cannot answer?

Definitions are the start. Talk to our team about how these technologies apply to your environment.

Talk to a security expert Explore solutions