Glossary
SOC and AI SIEM Glossary
ClaireChains ·
Security operations has its own vocabulary. This glossary explains the terms used on this site and in AI SIEM buying decisions, in plain English, from agentic SOC and L1/L2 triage to MTTD, NIS2 and DORA.
- Agentic SOC
- A security operations centre where AI agents carry out multi-step investigation and response tasks, such as gathering evidence and drafting a verdict, with analysts supervising and approving.
- AI SIEM
- A SIEM that uses AI models to investigate alerts, not only to collect and correlate events. It aims to reduce false positives and speed up triage. AI SIEM vs traditional SIEM
- Air-gapped network
- A network with no connection to the internet or to other untrusted networks, used for the most sensitive systems. Software running there must work fully offline.
- Alert fatigue
- The overload analysts face when a large share of alerts are harmless. Real threats are more likely to be missed and staff burn out.
- APT (advanced persistent threat)
- A skilled, well-resourced attacker, often state-backed, who gains access and stays hidden in a network for a long time.
- Audit trail
- A complete record of what happened and why. In an AI SIEM it includes the reasoning behind each automated decision, so it can be reviewed later.
- CSIRT
- Computer Security Incident Response Team. Under NIS2, national CSIRTs receive incident reports from essential and important entities.
- DORA
- The EU Digital Operational Resilience Act, Regulation (EU) 2022/2554. It sets ICT risk, incident reporting, testing and supplier rules for financial entities and has applied since 17 January 2025. NIS2 and DORA guide
- EDR (endpoint detection and response)
- Software on laptops, servers and other endpoints that detects suspicious activity and can isolate a device. A SIEM uses EDR data as one of its main sources.
- False positive
- An alert that looks like a threat but turns out to be harmless. Reducing false positives is one of the main goals of an AI SIEM.
- Hybrid deployment
- A set-up where sensitive data and investigation stay on-premise while selected functions, such as long-term storage, run in the cloud. On-premise vs cloud SIEM
- Incident response
- The process of containing, investigating and recovering from a security incident, and reporting it where the law requires.
- L1/L2 triage
- The first and second lines of alert handling in a SOC. Level 1 sorts and enriches alerts; Level 2 investigates the ones that need deeper analysis. Claire Security automates much of this work.
- Lateral movement
- How an attacker moves from the first compromised system to others in the network, often using stolen credentials.
- MSSP
- Managed Security Service Provider. A company that runs security monitoring and response for other organisations. Partner programme
- MTTD (mean time to detection)
- The average time between a malicious event and the moment it is detected. How we measure MTTD
- MTTR (mean time to response)
- The average time between detecting an incident and containing it.
- NCII
- National Critical Information Infrastructure. In Malaysia, entities designated as NCII have duties under the Cyber Security Act 2024 (Act 854). Act 854 guide
- NIS2
- The EU directive on a high common level of cybersecurity, Directive (EU) 2022/2555. It covers essential and important entities in 18 sectors and sets incident reporting deadlines of 24 hours, 72 hours and one month. NIS2 and DORA guide
- On-premise
- Software that runs on servers you own or control, rather than in a provider’s cloud. On-premise AI SIEM
- SIEM
- Security Information and Event Management. A system that collects logs and events from across an organisation, correlates them and raises alerts.
- SOAR
- Security Orchestration, Automation and Response. Tools that run playbooks to respond to alerts automatically, such as blocking an address or isolating a device.
- SOC
- Security Operations Centre. The team, and its tools, that monitors an organisation for threats and responds to incidents.
- Threat hunting
- Actively searching for attackers who have evaded existing detection, rather than waiting for an alert.
- Threat intelligence
- Information about attackers, their tools and their methods, used to improve detection and prioritise response.
- Zero-day
- A vulnerability that is exploited before the vendor has released a fix.
See Claire Security on your own data
Book a demo and we will show you triage, audit trails and reporting in your environment.
Request a demo