DefinitionThe three main goals of information security: keep information private, keep it correct and unchanged, and keep it available when people need it.

ExampleA hospital keeps patient files away from strangers, makes sure no one changes a test result, and keeps its systems working during an emergency.

Why it matters to a SOC analystAnalysts ask which of the three goals an alert threatens, to judge how serious it is.

DefinitionAnything that could harm an organization's information or computers: a criminal, a careless employee, or even a fire or flood.

ExampleA group that sends fake emails to steal passwords is a threat to every company whose employees receive those emails.

Why it matters to a SOC analystAnalysts must know which threats are active today to recognize them quickly in alerts.

DefinitionA weakness that someone could use to cause harm, such as outdated software, a weak password, or a door that does not lock.

ExampleAn office computer that has not received updates for two years has known weaknesses that attackers can easily find.

Why it matters to a SOC analystAnalysts help find and report weaknesses before attackers use them.

DefinitionThe chance that a threat will use a vulnerability, combined with how much damage that would cause. It is often described as likelihood times impact.

ExampleA laptop left unlocked in a busy café is high risk: theft is likely, and exposed customer data would cause serious damage.

Why it matters to a SOC analystRisk helps analysts decide which alerts to handle first when many arrive together.

DefinitionThe person or group behind an attack. Threat actors range from curious beginners to criminal gangs and government-backed teams, each with different goals.

ExampleA criminal group wants money, an activist wants attention for a cause, and a government team may want secret information.

Why it matters to a SOC analystKnowing who is likely behind an attack helps analysts predict what the attacker will do next.

DefinitionAny measure that reduces risk. Controls can be rules (a password policy), technology (antivirus software), or physical (a locked door).

ExampleAn office uses badge readers at the entrance, requires strong passwords, and trains staff to spot fake emails. Each one is a security control.

Why it matters to a SOC analystAnalysts check whether controls worked or failed each time they investigate an alert.

DefinitionA strategy of using several layers of protection, so if one layer fails, the next one can still stop or slow the attacker.

ExampleA bank uses guards, cameras, locked doors, and a safe. A thief who gets past the guard still faces the safe.

Why it matters to a SOC analystWhen one defense misses an attack, analysts often spot it through another layer.

DefinitionA team, and the place where it works, that watches an organization's computers and systems, often around the clock, to find and respond to security problems.

ExampleLike an airport control room: people and screens follow everything that happens and react quickly when something looks wrong.

Why it matters to a SOC analystThe SOC is the workplace of a SOC analyst, the role this training program prepares you for.

DefinitionThe main software that runs a computer. It manages the hardware, runs programs, and lets people use the computer. Windows, Linux, and macOS are examples.

ExampleWhen you open a file, the operating system finds it on the disk, loads it into memory, and shows it on the screen.

Why it matters to a SOC analystMany alerts come from events on an operating system, so analysts must understand how it works.

DefinitionThe core of an operating system, with full control of the computer. It sits between programs and the hardware and decides what each program may use.

ExampleWhen a game and a web browser both want memory at the same moment, the kernel decides how much each one gets.

Why it matters to a SOC analystAttackers who reach the kernel control the whole computer, so alerts about it are treated as serious.

DefinitionA program while it is running. One program can start several processes, and each one uses part of the computer's memory and processing power.

ExampleOpening three browser windows can create several processes. You can see all of them in the Windows Task Manager.

Why it matters to a SOC analystHarmful programs also run as processes, so analysts look for unknown or strange ones.

DefinitionA computer created in software that runs inside a real computer. It behaves like a separate machine, with its own operating system and files.

ExampleOn one laptop you can run a Windows virtual machine and a Linux virtual machine side by side, each in its own window.

Why it matters to a SOC analystAnalysts open suspicious files safely inside virtual machines, and many labs in the training program use them.

DefinitionChecking that someone really is who they say they are, usually with something they know (a password), have (a phone), or are (a fingerprint).

ExampleWhen you unlock your phone with your face, the phone is authenticating you.

Why it matters to a SOC analystMany attacks start with stolen logins, so analysts watch for strange or failed authentication attempts.

DefinitionDeciding what an authenticated person is allowed to do, such as which files they may open or change.

ExampleEvery employee can log in to the company system, but only the finance team is authorized to see salary files.

Why it matters to a SOC analystWhen a user suddenly opens data outside their role, analysts check whether authorization was abused.

DefinitionA Microsoft service that stores the users, computers, and groups of an organization in one place, and controls who can log in and what they can reach.

ExampleWhen a new employee joins, IT creates one account in Active Directory, and it works on every company computer.

Why it matters to a SOC analystAttackers often target Active Directory, because controlling it means controlling the whole organization.

DefinitionMaking a system harder to attack by removing what is not needed, closing unused ways into it, and turning on strong security settings.

ExampleLike locking every window of a house, removing spare keys, and turning on the alarm before a long trip.

Why it matters to a SOC analystHardened systems give attackers fewer ways in, which means fewer successful attacks for analysts to handle.

DefinitionA complete operating system built around the Linux kernel, packaged with tools and programs. Ubuntu, Debian, and Fedora are popular distributions.

ExampleUbuntu and Fedora look different and install software differently, but both use the same Linux kernel underneath.

Why it matters to a SOC analystMost computers that run websites and many security tools use Linux, so analysts work with it daily.

DefinitionA program that reads the commands you type in a text window and tells the operating system to carry them out, without using a mouse.

ExampleInstead of opening folders one by one, you type one short command and the shell lists every file in a folder.

Why it matters to a SOC analystMany security tasks are faster in the shell, and attackers use it too, so analysts must read commands.

DefinitionThe special Linux account with unlimited power over the system. It can read, change, or delete anything, including other users' files and security settings.

ExampleA normal user cannot install software for everyone, but the root user can, and can also break the whole system by mistake.

Why it matters to a SOC analystAn attacker who gains root access controls the machine, so analysts treat root activity with extra care.

DefinitionRules attached to every file that decide who may read it, change it, or run it as a program.

ExampleA salary file can be set so the owner may read and edit it, the team may only read it, and everyone else sees nothing.

Why it matters to a SOC analystWrong permissions can expose private data, so analysts check them when a file is leaked or changed.

DefinitionA method for safely controlling another computer from a distance through a text window. Everything sent is protected, so outsiders cannot read it.

ExampleAn IT worker at home uses SSH to fix a company computer in another city, as if sitting in front of it.

Why it matters to a SOC analystAttackers try to guess SSH passwords, so analysts watch for many failed SSH logins.

DefinitionA security control that sits between a computer or network and the outside world and decides, based on rules, which connections are allowed in or out.

ExampleLike a building guard with a list: visitors on the list enter, and everyone else is stopped at the door.

Why it matters to a SOC analystFirewall records show analysts who tried to connect, when, and whether the connection was blocked.

DefinitionA record that a computer or program writes automatically, describing what happened, when it happened, and often who did it.

ExampleEvery time someone enters a wrong password, the system writes a log line with the time, the username, and the result.

Why it matters to a SOC analystLogs are the main evidence analysts read; without them, most attacks would go unseen.

DefinitionA short text file with a list of commands that a computer runs one after another, so a task can be done automatically.

ExampleInstead of checking fifty log files by hand every morning, a script checks them in seconds and reports anything unusual.

Why it matters to a SOC analystScripts save analysts hours of repetitive work and let them focus on real problems.

DefinitionTurning readable information into scrambled code using a key, so only someone with the right key can turn it back.

ExampleWhen you pay online, your card number is encrypted, so anyone who steals it on the way sees only meaningless characters.

Why it matters to a SOC analystEncryption protects data, but attackers also use it to hide their activity from analysts.

DefinitionTurning any data into a short code of fixed length, like a fingerprint. The same data always gives the same hash, and it cannot be reversed.

ExampleWell-run websites store the hash of your password, not the password itself. When you log in, they hash what you typed and compare.

Why it matters to a SOC analystAnalysts compare file hashes with lists of known harmful files to identify them in seconds.

DefinitionAn electronic ID card for a website or person, issued by a trusted organization. PKI is the system that creates, signs, and checks these certificates.

ExampleThe lock icon in your browser means the website showed a valid certificate, proving it really is your bank.

Why it matters to a SOC analystFake or expired certificates can reveal fake websites, so analysts check them during investigations.

DefinitionA protocol that encrypts the connection between your device and a website. HTTPS is normal web browsing protected by TLS.

ExampleAn address that starts with https:// means your passwords and messages travel encrypted, even on public café Wi-Fi.

Why it matters to a SOC analystMost web activity is encrypted with TLS, so analysts learn to find clues without reading the content.

DefinitionAuthentication that requires two or more different types of proof, such as a password plus a code on your phone, before allowing access.

ExampleYou enter your password, and then your bank sends a code to your phone. Without the code, the password alone is useless.

Why it matters to a SOC analystMFA blocks most stolen-password attacks, so analysts notice when someone keeps failing the second step.

DefinitionSystems that watch network activity for signs of attack. An IDS raises an alert; an IPS can also block the attack automatically.

ExampleLike a smoke detector (IDS) that only sounds the alarm, versus a sprinkler system (IPS) that also puts out the fire.

Why it matters to a SOC analystIDS and IPS alerts are a regular part of a SOC analyst's daily work.

DefinitionA protected, encrypted tunnel across the internet that connects a device to a private network, as if it were plugged in locally.

ExampleAn employee working from home connects through the company VPN and reaches internal files safely.

Why it matters to a SOC analystVPN logins from strange countries or at strange hours are a common warning sign analysts investigate.

DefinitionA security approach that trusts no user or device automatically, even inside the organization. Every request must prove it is allowed, every time.

ExampleEven an employee sitting in the office must confirm their identity again before opening a sensitive system.

Why it matters to a SOC analystZero Trust checks every access request, which gives analysts a clear record of who reached what.

DefinitionA fake message, usually an email, that looks like it comes from a trusted source and tries to make you click a link, open a file, or share details.

ExampleAn email that looks like it is from your bank says your account is locked and asks you to log in through a link.

Why it matters to a SOC analystPhishing is one of the most common ways real attacks start, and analysts review reported emails daily.

DefinitionA fake video, image, or voice recording that shows a real person saying or doing something they never did. It is made by software that learns from real recordings.

ExampleAn employee gets a video call from a 'manager' asking for an urgent money transfer, but the face and voice are fake.

Why it matters to a SOC analystDeepfakes make social engineering more convincing, so unusual requests must be verified through a second channel.

DefinitionAn attack where someone types database commands into a website's input box, tricking the site into revealing or changing the stored data behind it.

ExampleInstead of a name, an attacker types special code into a login box, and the website shows every customer's details.

Why it matters to a SOC analystAnalysts spot SQL injection by finding strange code inside website requests in the logs.

DefinitionA list of the ten most critical security risks in web applications, published by the OWASP community and updated every few years.

ExampleDevelopers use the list as a checklist, making sure their online shop is protected against each of the ten risk types.

Why it matters to a SOC analystThe list gives analysts a shared language for describing web attacks in reports.

DefinitionComputer systems that perform tasks that normally need human thinking, such as understanding language, recognizing images, or making decisions.

ExampleWhen your phone recognizes your face, or your email app suggests a reply, AI is doing the work.

Why it matters to a SOC analystAI helps analysts sort alerts faster, but attackers use it too, so analysts must understand both sides.

DefinitionA type of AI where a computer learns patterns from many examples, instead of following rules written by a person.

ExampleAfter seeing millions of labeled emails, a spam filter learns by itself to recognize new spam it has never seen.

Why it matters to a SOC analystMany security tools use machine learning to spot unusual behavior that fixed rules would miss.

DefinitionAn AI model trained on huge amounts of text that can understand and write human language. The request you give it is called a prompt.

ExampleAI chat assistants are LLMs: you type a question in everyday words and get a written answer in seconds.

Why it matters to a SOC analystAnalysts use LLMs to summarize long logs and draft reports, then check the results carefully.

DefinitionAn AI answer that sounds confident and correct but is actually false or invented.

ExampleAsked about a security report, an AI assistant describes a detailed attack that never happened, with fake dates and names.

Why it matters to a SOC analystAnalysts never trust AI output blindly; every fact must be checked before acting on it.

DefinitionA way of working where AI suggests or prepares actions, but a person reviews and approves them before anything important happens.

ExampleAI recommends blocking a user's account, and the analyst checks the evidence and decides whether to block it.

Why it matters to a SOC analystIn the SOC, the analyst stays responsible for decisions, even when AI does most of the work.

DefinitionAn attack that hides instructions inside text given to an AI, tricking it into ignoring its rules or doing something harmful.

ExampleA web page contains hidden text telling an AI assistant to ignore its rules and reveal the user's private data.

Why it matters to a SOC analystAs companies connect AI to their data, analysts must learn to detect and investigate prompt injection.

DefinitionAn attack that adds false or harmful examples to the data an AI learns from, so the AI learns the wrong behavior.

ExampleAttackers feed a spam filter thousands of spam emails labeled 'safe', until it starts letting real spam through.

Why it matters to a SOC analystPoisoned AI tools can quietly miss attacks, so their results must be monitored over time.

DefinitionThe rules, responsibilities, and checks an organization uses to make sure AI is used safely, legally, and fairly.

ExampleA company policy says employees may not paste customer data into public AI tools, and every AI system has an owner.

Why it matters to a SOC analystAnalysts follow governance rules when they use AI, and report when others break them.

DefinitionThe way an attacker works: their goals (tactics), their methods (techniques), and the exact steps they follow (procedures).

ExampleAn attacker can change their IP address easily, but their habit of stealing passwords in the same way stays the same.

Why it matters to a SOC analystIOCs change quickly but TTPs rarely do, so detecting TTPs catches attackers even after they change tools.

DefinitionThe way an attacker moves from the first computer they broke into to other computers in the same network, to reach more valuable systems.

ExampleAn attacker breaks into a receptionist's laptop, then uses it to reach the computers of the finance department.

Why it matters to a SOC analystCatching lateral movement early can stop a small break-in from becoming a full company takeover.

DefinitionThe hidden communication channel that attackers use to send instructions to infected computers and receive stolen data back.

ExampleMalware on a laptop quietly contacts the attacker's computer every ten minutes, asking for new orders.

Why it matters to a SOC analystRegular, repeated connections to unknown addresses may be C2, a key sign analysts hunt for.

DefinitionThe defenders: the security team responsible for protecting an organization, detecting attacks, and responding to them. SOC analysts are part of the Blue Team.

ExampleDuring a training exercise, the Blue Team watches the alerts and blocks the pretend attackers in real time.

Why it matters to a SOC analystAs a SOC analyst, you will be a member of the Blue Team.

DefinitionA plan that explains how an organization keeps its most important work running during and after a crisis, such as an attack or a disaster.

ExampleWhen the main system is down, a hospital's plan says staff switch to paper forms, so patients are still treated.

Why it matters to a SOC analystAnalysts need to know which systems are most critical to the business when deciding priorities.

DefinitionThe maximum time a system may stay down after a disruption before the damage becomes unacceptable.

ExampleAn online shop decides its website must be back within two hours, because every hour offline loses too many sales.

Why it matters to a SOC analystRTO tells the response team how urgently each system must be restored.

DefinitionThree ways to rent computing over the internet (the cloud): basic machines to manage yourself (IaaS), a ready platform to build on (PaaS), or finished software (SaaS).

ExampleLike renting a car (IaaS), taking a taxi (PaaS), or riding a bus (SaaS): at each step, you manage less yourself.

Why it matters to a SOC analystThe model in use decides which logs analysts can see and which security tasks are theirs.

DefinitionThe division of security duties in the cloud: the provider protects its buildings, hardware, and core services; the customer protects their data, accounts, and settings.

ExampleThe cloud provider keeps its buildings secure, but if a customer leaves a storage folder open to everyone, that is the customer's mistake.

Why it matters to a SOC analystMany cloud breaches come from customer mistakes, so analysts check the customer side first.

DefinitionAn authorized, planned attack on an organization's systems by security experts, to find weaknesses before real attackers do and to report how to fix them.

ExampleA bank hires a team to try breaking into its mobile app. The team reports three weaknesses, which the bank then fixes.

Why it matters to a SOC analystPenetration test reports show analysts which attacks their alerts must be able to catch.

DefinitionThe written agreement that sets the limits of a penetration test: what may be tested, when, how, and what is forbidden. Testing without written permission is illegal.

ExampleThe agreement allows testing the website on weekends only, and forbids touching the payment system.

Why it matters to a SOC analystKnowing the rules helps analysts tell an approved test apart from a real attack.

DefinitionThe first stage of an attack or a test: collecting information about the target, such as its employees, technologies, and possible ways in.

ExampleBefore a break-in, a thief studies the building: guard shifts, cameras, and which doors are left open.

Why it matters to a SOC analystSpotting reconnaissance early gives defenders a warning before the actual attack begins.

DefinitionInformation collected from public sources, such as websites, social media, news, and public records, without breaking into anything.

ExampleAn employee's public profile shows their job title and email format, which an attacker could use for phishing.

Why it matters to a SOC analystAnalysts use OSINT to learn about attackers and to see what the organization reveals publicly.

DefinitionChecking a computer's ports one by one to find which are open and which services are running behind them.

ExampleLike walking along a street and trying every door, to see which ones are unlocked.

Why it matters to a SOC analystMany connection attempts to different ports from one address are a classic sign analysts detect.

DefinitionSecurity experts who play the role of real attackers, with permission, to test how well an organization detects and stops attacks.

ExampleOver several weeks, a Red Team secretly tries to reach the CEO's email, while the SOC does not know about the test.

Why it matters to a SOC analystRed Team exercises show analysts which attacks they missed and where detection must improve.

DefinitionThe Red Team and the Blue Team working together openly: attackers share each step, and defenders improve their detection at the same time.

ExampleThe Red Team tries one attack method, the Blue Team checks whether an alert appeared, and together they fix the gap.

Why it matters to a SOC analystPurple teaming turns every attack technique into better detection for the SOC.

DefinitionCollecting and examining digital evidence, from computers, phones, and logs, in a careful way, to find out what happened and to prove it.

ExampleAfter a data leak, investigators examine a laptop and discover which files were copied, when, and to which USB drive.

Why it matters to a SOC analystForensics answers the final questions about an incident and supports legal action if needed.

DefinitionA written record of who collected each piece of evidence, when, and every person who handled it afterward.

ExampleA seized laptop gets a signed form each time it moves: from the investigator, to the lab, to the lawyer.

Why it matters to a SOC analystWithout a clean chain of custody, evidence may be rejected in court.

DefinitionAn exact, bit-by-bit copy of a storage device, such as a hard drive, made so investigators can study the copy and never change the original.

ExampleInstead of examining a suspect's laptop directly, the investigator creates a forensic image and works only on the copy.

Why it matters to a SOC analystWorking on an image protects the original evidence and lets analysts repeat their examination.

DefinitionInformation that disappears when a computer is turned off, such as the contents of memory, running processes, and current connections.

ExampleMalware that lives only in memory leaves no trace on the disk, so pulling the plug erases the evidence.

Why it matters to a SOC analystAnalysts collect volatile data first, before shutting a computer down, or it is lost forever.

DefinitionA trace that activity leaves on a system, such as a recently opened file, a browser history entry, or a record of a USB drive.

ExampleEven after a user deletes a document, artifacts can show that it was opened, when, and from which folder.

Why it matters to a SOC analystArtifacts help analysts rebuild what a user or an attacker actually did on a computer.

DefinitionPutting all the events and artifacts from an investigation in time order, to see the full story of what happened, step by step.

Example09:02 phishing email opened. 09:04 file downloaded. 09:15 new account created. The timeline shows the attack's path.

Why it matters to a SOC analystA clear timeline is often the heart of the final incident report an analyst presents.