Glossary of Security Terms and Definitions

Objective: To standardize technical terminology within the Security Operations Center (SOC) and ensure accurate communication during endpoint investigations.

1. MD5 Hash (Message Digest Algorithm 5)

A unique 32-character cryptographic string used to represent a file’s digital identity. It serves as a fixed-length “fingerprint” that remains constant regardless of file name changes. It is the primary data point used to identify specific malicious binaries across the enterprise.

2. Endpoint (Managed Asset)

Any workstation, laptop, server, or mobile device that is managed and monitored within the organization’s infrastructure. In the context of investigations, an endpoint refers to any asset reachable by the centralized management console.

3. Remediation Actions: Quarantine Types

• Endpoint Protection (AV) Quarantine: A localized security action where a specific file is isolated and prevented from executing. This is non-disruptive to the host’s network connectivity or the user’s workflow.
• Network/Host Quarantine: A restrictive action that logically isolates the entire host from the enterprise network to prevent lateral movement.
  • Standard Protocol: This action is reserved for high-severity incidents and requires authorization from a Senior Analyst or Incident Response Lead.

4. False Positive

A security event where a benign or authorized file is incorrectly identified as a threat by detection systems. Analysts should correlate global incidence counts with detection ratios to validate these occurrences before concluding an investigation.

5. Security Signature / Detection Name

A standardized naming convention assigned by security vendors (e.g., Microsoft, CrowdStrike) to identify known threat families or behaviors. Signatures allow for cross-platform log correlation between endpoint tools and the SIEM.

6. Tiered Escalation

The formal process of transferring an investigation to the appropriate team (e.g., Level 2 Analysis or Incident Response) when a threat is validated or exceeds the standard investigative scope of a Level 1 Analyst.