Incident Response and DFIR Glossary: Plain Definitions for Responders and Investigators

During an incident, people who use the same words to mean different things, such as "contained", "incident" or "IOC", make slower and worse decisions. This glossary gives short, precise definitions of the terms responders, forensic investigators, SOC analysts, incident commanders, lawyers and executives meet when handling a security incident: the response process (triage, containment, eradication, recovery), evidence handling (chain of custody, order of volatility, write blockers), forensic artefacts and tools, attacker behaviour mapped to MITRE ATT&CK, threat intelligence sharing, and the metrics used to measure response. Where a standard defines a term, the entry follows the standard, for example NIST SP 800-61 Rev. 3, RFC 3227 and FIRST TLP 2.0. Each entry links the NHI Mgmt Group guide that covers the topic in depth. Identity and non-human identity terms are covered in the NHI and IAM Glossary.

A

After action review

A structured meeting held soon after an incident or exercise to record what was expected, what happened, what worked and what to change. Its output is a short report with owned, dated actions. See the Tabletop Exercise After Action Report Template.

Alert

A notification raised by a detection tool (SIEM, EDR, cloud service or identity provider) that an event matched a rule or model. An alert is a lead to triage, not yet an incident. See the Alert Triage Guide.

Alert fatigue

The loss of attention that follows when analysts receive more alerts, or more false positives, than they can properly investigate. It is a common reason real intrusions are missed, and is reduced by tuning, enrichment and suppression rather than by hiring alone.

Amcache

A Windows registry hive (Amcache.hve) that records details of executables that were present or run on a host, including file path and SHA-1 hash. Investigators use it as evidence of execution, alongside Prefetch and Shimcache, while bearing in mind that presence in Amcache does not by itself prove a program ran.

Anti-forensics

Actions taken to destroy, hide or falsify evidence, such as clearing event logs, timestomping files, wiping disks or running tools only in memory. Detection depends on noticing gaps and inconsistencies. See the Anti-Forensics Detection Guide.

Attribution

The process of linking an intrusion to a specific threat actor or group, based on infrastructure, tooling, tradecraft and intelligence. Attribution is rarely needed to contain an incident, takes time, and is best left to government agencies and specialist intelligence teams; responders should report confidence levels rather than certainties.

B to C

Beaconing

Regular outbound connections from compromised software to its command and control server to check for instructions. Fixed intervals with small random variation (jitter) are a classic network signal. See the Beaconing and C2 Detection Guide.

Blast radius

The set of systems, data and identities an attacker could reach from a compromised starting point. Scoping work estimates the blast radius to decide how wide containment must be; overprivileged service accounts and tokens widen it sharply.

Business email compromise (BEC)

Fraud in which an attacker takes over or impersonates a business mailbox to redirect payments or obtain data. Response combines mailbox forensics, revoking sessions and mailbox rules, and contacting banks fast. See the Business Email Compromise Response Playbook.

Chain of custody

The documented record of who collected, handled, transferred and stored an item of evidence, when, where and how. RFC 3227 asks responders to record where, when and by whom evidence was discovered, collected, handled and examined, who held custody for what period, and how each transfer happened. See the Evidence Handling and Chain of Custody Guide and the Chain of Custody Form Template.

Command and control (C2)

The channel an attacker uses to send instructions to, and receive data from, compromised systems. MITRE ATT&CK tracks it as tactic TA0011. C2 increasingly runs over trusted cloud services and common protocols such as HTTPS and DNS. See the Command and Control (C2) Guide.

Compromise assessment

A proactive investigation that looks for evidence of a past or current intrusion across an estate where none has yet been confirmed, often before an acquisition or after a sector-wide campaign. See the Compromise Assessment Guide.

Containment

Actions that stop an incident spreading or causing more damage while evidence is preserved: isolating hosts, disabling accounts, revoking tokens, blocking domains. NIST CSF 2.0 expresses the outcome as RS.MI-01, incidents are contained. See Containment vs Eradication.

Credential dumping

Extracting passwords, hashes, Kerberos tickets or tokens from memory, the registry or directory databases, tracked in ATT&CK as T1003 OS Credential Dumping. Its discovery during an investigation usually means every credential on the affected hosts must be treated as exposed. See the Credential Dumping Guide.

CSIRT

Computer security incident response team: the group, permanent or virtual, that is authorised to handle incidents for an organisation or community. It differs from a SOC, which monitors and triages continuously. See CSIRT vs SOC.

Cyber Kill Chain

A model, published by Lockheed Martin, that breaks an intrusion into seven stages from reconnaissance to actions on objectives. It helps responders ask which stages they have evidence for and where the attack could have been broken. See the Cyber Kill Chain and Diamond Model Guide.

D to E

DFIR

Digital forensics and incident response: the combined discipline of investigating what happened (forensics) and stopping and recovering from it (response). Many teams and providers deliver both, but the skills and evidence standards differ. See the DFIR Analyst Career Guide.

Diamond Model

An intrusion analysis model that relates four features of every event: adversary, capability, infrastructure and victim. Pivoting from one feature to the others (for example from a C2 domain to other victims) structures investigation and intelligence work.

Digital forensics

The collection, examination, analysis and reporting of digital evidence in a way that preserves its integrity, so findings can withstand scrutiny. NIST SP 800-86 describes how to integrate forensic techniques into incident response. See the Digital Forensics (DFIR) Guide.

Disk image

A bit-for-bit copy of a storage device or volume, including unallocated space, normally taken through a write blocker and verified with a cryptographic hash. Cloud equivalents are volume snapshots. See the Disk Imaging and Forensic Acquisition Guide.

Double extortion

A ransomware model in which attackers both encrypt systems and steal data, then threaten to publish it if the ransom is not paid. It means that restoring from backup does not end the incident: data exposure scoping and notification analysis are still required.

Dwell time

The time between an attacker's first access and detection of the intrusion. It is measured after the fact, from forensic evidence, and is a programme-level measure of detection capability rather than a live metric.

EDR

Endpoint detection and response: agents that record process, file, registry and network activity on endpoints and servers, detect suspicious behaviour and allow remote response such as host isolation. EDR telemetry is often the main evidence source in modern investigations. See the EDR Guide.

Eradication

Removing the attacker and their footholds: malware, persistence mechanisms, rogue accounts, backdoored images and stolen credentials. NIST CSF 2.0 states it as RS.MI-02, incidents are eradicated. Eradication that misses one persistence mechanism or one stolen secret leads to reinfection.

Event

Any observable occurrence in a system or network, such as a log-on, a file write or a connection. Most events are benign; analysis decides which are adverse and which, together, amount to an incident. NIST CSF 2.0 covers this as DE.AE-02, potentially adverse events are analysed.

Evidence integrity

Assurance that evidence has not changed since collection, usually shown by recording a cryptographic hash (for example SHA-256) at acquisition and verifying it before analysis and on every transfer.

Evidence preservation

Steps that stop evidence being lost or changed before it can be collected: suspending log rotation and automatic reimaging, snapshotting cloud volumes, extending log retention and placing a legal hold on mailboxes and files.

Exfiltration

Unauthorised transfer of data out of an environment, tracked as ATT&CK tactic TA0010. Proving or ruling out exfiltration is often the question that decides whether breach notification is required.

F to I

False positive

An alert that fires on benign activity. A true positive is an alert on real malicious activity; a benign true positive matches the rule correctly but is authorised, such as an approved penetration test.

Forensic readiness

Preparing in advance so that evidence will exist and can be collected quickly when an incident happens: logging the right sources, retaining them long enough, synchronising clocks and pre-approving collection tools. See the Forensic Readiness Guide.

Host isolation

Cutting a device off from the network, except for the management channel to the EDR console, so investigation can continue without the attacker reaching it. It preserves memory and running state better than powering off.

Incident

NIST's glossary records several definitions. The one used across SP 800-53 Rev. 5 and SP 800-37 Rev. 2 follows 44 U.S.C. 3552: an occurrence that actually or imminently jeopardises, without lawful authority, the integrity, confidentiality or availability of information or a system, or a violation or imminent violation of law or security policy. A FIPS 200-based definition also covers potential jeopardy. Write your own definition into the incident response plan so declaration is consistent.

Incident commander

The person who leads an incident: sets priorities, assigns work, makes or escalates decisions and owns the timeline, without doing the hands-on technical work. See the Incident Commander Role Guide.

Incident response

The organised approach to preparing for, detecting, containing, eradicating and recovering from incidents and learning from them. NIST SP 800-61 Rev. 3 (April 2025), a CSF 2.0 Community Profile, replaced the four-phase life cycle in Rev. 2 with recommendations mapped to CSF 2.0 functions. See the Incident Response Guide.

Incident response plan

The approved document that defines scope, roles, authority to act, severity levels, escalation, communications and notification duties for incidents. SP 800-53 Rev. 5 requires it as IR-8. See the Incident Response Plan Template.

Incident severity

A level (for example SEV1 to SEV4) assigned from impact and urgency that sets who is called, how fast and with what authority. Severity is reassessed as facts emerge. See the Incident Severity Classification Matrix Template.

Indicator of attack (IOA)

A behavioural signal of attacker activity in progress, such as a process reading LSASS memory or a new mailbox forwarding rule, independent of the specific file or address used. IOAs survive attacker tool changes better than IOCs.

Indicator of compromise (IOC)

NIST SP 800-61 Rev. 3, adapting SP 800-150, defines indicators as technical artefacts or observables that suggest an attack is imminent or under way, or that a compromise may already have occurred. Examples are file hashes, IP addresses, domains, registry keys and mutex names. See Indicators of Compromise vs Indicators of Attack Guide.

Initial access

The way an attacker first gets in, tracked as ATT&CK tactic TA0001: phishing, exploitation of public-facing applications, valid accounts (T1078) or a compromised supplier. Finding the initial access vector is central to root cause analysis. See the Initial Access Techniques Guide.

K to M

KAPE

Kroll Artifact Parser and Extractor, a widely used Windows triage tool that collects targeted forensic artefacts (registry hives, event logs, Prefetch, browser data) and can run parsers over them. See the KAPE and Triage Collection Guide.

Lateral movement

Techniques an attacker uses to move from one system to others, tracked as ATT&CK tactic TA0008, commonly through remote services (T1021) with stolen credentials. Mapping it shows how far the incident extends. See the Lateral Movement Guide.

Legal hold

An instruction to preserve information relevant to actual or anticipated legal proceedings, suspending normal deletion. Incidents that may lead to litigation or regulatory action usually trigger one. See the eDiscovery and Legal Hold Guide.

Legal privilege

Protection that may shield certain communications and documents from disclosure, for example when an investigation is directed by counsel to give legal advice. Its scope varies by jurisdiction and is decided by lawyers, not responders. See the Legal Privilege in Incident Response Guide.

Lessons learned

The review step that turns an incident into improvements. It works when actions are specific, owned and tracked to closure, and when findings feed back into detection, controls and the plan.

Live response

Collecting volatile data and artefacts from a running system, usually remotely through an EDR or DFIR agent, rather than taking it offline. It trades some forensic purity for speed and for data that would be lost on shutdown.

Living off the land

Attacker use of tools already present on a system, such as PowerShell, WMI or remote administration software, to blend in with legitimate administration. Detection relies on behaviour and context, not file reputation. See the Living off the Land Guide.

Major incident

An incident at the top severity level, defined in the plan, that triggers executive involvement, a dedicated incident commander and often regulatory analysis. Regulation may define its own threshold, as with major ICT-related incidents under DORA. See the DORA Major ICT Incident Reporting Guide.

Memory forensics

Analysis of a capture of a system's RAM to find running processes, network connections, injected code, loaded drivers and credentials that never touch disk. See the Memory Forensics Guide.

MITRE ATT&CK

A public knowledge base of adversary tactics and techniques based on real-world observation. Responders use technique IDs to describe what happened in a consistent way and to check detection coverage. See MITRE ATT&CK vs MITRE D3FEND.

MTTD and MTTR

Mean time to detect and mean time to respond (or recover, or remediate: define which). Common incident response metrics; their value depends on consistent start and stop points and on reporting medians alongside means. See MTTD vs MTTR.

O to P

Order of volatility

The principle of collecting the most short-lived evidence first. RFC 3227 (BCP 55) lists registers and cache; then routing table, ARP cache, process table, kernel statistics and memory; temporary file systems; disk; remote logging and monitoring data; physical configuration and network topology; and finally archival media.

Out-of-band communications

Communication channels independent of the possibly compromised environment, such as a separate chat tenant or phones, used when attackers may be reading email or collaboration tools. See the Out-of-Band Communications for Incident Response Guide.

Patient zero

The first system or account compromised in an incident. Identifying it, through timeline analysis, usually reveals the initial access vector.

Persistence

Mechanisms an attacker uses to keep access across reboots and credential changes, tracked as ATT&CK tactic TA0003: scheduled tasks, services, web shells (T1505.003), new accounts, OAuth grants or added keys on service principals. See the Persistence Techniques Guide.

Plaso

An open-source engine (log2timeline) that extracts timestamps from many artefact types into a single super timeline for analysis. See the Plaso Guide.

Playbook

A documented response procedure for a type of incident (ransomware, BEC, credential leak) that lists decision points, roles, actions and evidence to collect. A runbook is the lower-level, step-by-step technical procedure. See Incident Response Playbook vs Runbook.

Post-incident review

A blameless review held after an incident closes to establish the timeline, root cause, contributing factors and improvements. See the Post-Incident Review and Root Cause Analysis Template.

Prefetch

Windows files (.pf) created to speed up application start-up, which record an executable's name, run count and recent run times. They are strong evidence of execution on workstations, where Prefetch is typically enabled.

Pyramid of Pain

A model ranking indicator types by how much it costs an attacker when defenders detect them: hash values at the bottom, then IP addresses, domains, network and host artefacts, tools, and TTPs at the top. See the Pyramid of Pain Guide.

R to S

Ransomware

Malware that encrypts data or systems (ATT&CK T1486 Data Encrypted for Impact) to demand payment, now usually combined with data theft. Response decisions involve containment, recovery from isolated backups, legal and sanctions checks and notification. See the Ransomware Response and Recovery Guide.

Recovery

Restoring systems and services to normal operation from known-good sources, with monitoring for signs of return. CSF 2.0 places it in the Recover function, starting with RC.RP-01, the recovery portion of the plan is executed.

Recovery time and recovery point objectives (RTO, RPO)

RTO is the target time to restore a service; RPO is the maximum acceptable data loss, measured in time. Incidents test whether backups and rebuild processes actually meet them. See the RTO and RPO Guide.

Root cause analysis

Working back from the impact to the underlying conditions that allowed the incident, such as an unpatched service, a leaked key or a missing control, rather than stopping at the attacker's first action. CSF 2.0 includes root cause in RS.AN-03.

Runbook

A precise, step-by-step technical procedure, such as how to isolate a host in the EDR console or rotate a database credential, that a playbook calls on.

Scoping

Determining which systems, accounts, data and time window an incident affects. Scoping drives containment breadth and notification analysis. See the Data Security Incident Scoping Playbook.

SIEM

Security information and event management: a platform that collects, normalises, correlates and retains logs for detection and investigation. Its retention period often decides how far back an investigation can see. See the SIEM Guide.

Sigma rule

A vendor-neutral detection rule written in YAML, with logsource, detection and condition sections, which a converter translates into a specific SIEM's query language. See the Sigma Rules Guide.

SOAR

Security orchestration, automation and response: platforms that run playbooks automatically across tools, such as enriching an alert or disabling an account. See the SOAR and Security Automation Guide.

STIX and TAXII

STIX is a JSON language for exchanging cyber threat intelligence; version 2.1 defines 18 domain objects, including Indicator, Malware, Attack Pattern, Observed Data and Threat Actor, plus Relationship and Sighting objects. TAXII is the protocol for transporting STIX over HTTPS. See the STIX and TAXII Guide.

Super timeline

A single chronological view combining timestamps from file systems, logs, registry, browser history and other artefacts, used to reconstruct the sequence of an intrusion.

Sysmon

Microsoft System Monitor, a Windows service that logs detailed process, network, file and registry events (for example Event ID 1 process creation) to the event log under a configurable policy. See the Sysmon Guide.

T to Z

Tabletop exercise

A discussion-based exercise in which responders and decision-makers walk through a scenario to test the plan, roles and decisions without touching systems. See the Tabletop Exercise Guide.

Threat hunting

Proactive, hypothesis-driven searching for attacker activity that existing detections have missed. Findings become new detections. See the Threat Hunting Guide.

Timeline analysis

Ordering events from many sources in time to establish what happened, in what sequence and how long it took. It needs synchronised clocks and consistent time zones (normally UTC).

TLP

The Traffic Light Protocol, maintained by FIRST, labels shared information with its permitted audience. TLP 2.0 (authoritative from August 2022) uses TLP:RED, TLP:AMBER+STRICT, TLP:AMBER, TLP:GREEN and TLP:CLEAR. See the Traffic Light Protocol Guide.

Token revocation

Invalidating issued session, access or refresh tokens so a stolen token stops working. Password resets alone often do not end existing sessions, so identity incident response must revoke sessions and tokens explicitly. See the OAuth Token Introspection and Revocation Guide.

Triage

The rapid assessment that decides whether an alert or report is real, how severe it is and who handles it. Triage collection is the targeted gathering of the most useful artefacts from a host, faster than a full image.

TTPs

Tactics, techniques and procedures: how an attacker operates, from goals (tactics) to methods (techniques) to specific implementations (procedures). TTPs sit at the top of the Pyramid of Pain because they are hardest for an attacker to change.

Velociraptor

An open-source endpoint visibility and DFIR tool that uses a query language (VQL) to collect artefacts and hunt across many hosts at once. See the Velociraptor Guide.

Volatility

An open-source memory forensics framework; Volatility 3 is the current major version. It parses RAM captures to list processes, connections, injected code and more. See the Volatility 3 Guide.

Web shell

A script placed on a web server that gives an attacker remote command execution through HTTP requests, tracked as ATT&CK T1505.003. See the Web Shell Response Playbook.

Write blocker

Hardware or software that allows read access to a storage device while preventing any writes, so acquisition does not alter the evidence.

YARA rule

A pattern-matching rule made of a set of text or binary strings and a boolean condition, used to identify and classify malware samples and other files of interest. See Sigma vs YARA vs Snort Rules.

For identity, IAM and non-human identity terms, see the NHI and IAM Glossary. Related NHI Mgmt Group resources: Incident Response Guide · Digital Forensics (DFIR) Guide · Identity Incident Response Playbook · Incident Response Plan Template