SOC WORDS

SOC words: security operations terms explained

The short answer

Short definitions of the words that come up when choosing how to run a SOC, grouped by theme. Where a term is a vendor's own product name, we say so. Each entry has an anchor link you can share.

Which words describe the operating models?

AI SOC analyst

Software agents that triage and investigate alerts, reach a verdict with evidence and, in some products, act within limits you set. One of the four operating models on this site.

SOAR

Security orchestration, automation and response. A workflow engine that runs playbooks written in advance across integrated tools.

MDR

Managed detection and response. A service in which a provider's analysts monitor, investigate and respond to or advise on your alerts, usually around the clock.

SIEM copilot

An AI assistant inside a SIEM or security console that answers questions, summarizes incidents and drafts queries when an analyst asks.

MSSP

Managed security service provider: a company that runs security services for many customers. Some AI SOC products offer multi-tenant editions built for MSSPs.

Operating model

Who carries each stage of the alert queue: your analysts, rules you write, software agents or a provider. This site's main question.

Split model

Running two operating models at once, for example an AI SOC platform by day and a provider at night, or SOAR for fixed responses and agents for the rest.

Which words describe the alert queue?

SIEM

Security information and event management: the system that collects logs and events and raises alerts from detection rules. Most SOC queues start here.

EDR

Endpoint detection and response: software on laptops and servers that detects threats and can isolate a host or kill a process.

Alert

A signal from a detection rule or security tool that something may need attention. The unit the SOC queue is made of.

Alert queue

The list of alerts waiting for triage or investigation. Its length and the share closed unread are the first things to measure.

Triage

The first sort of an alert: real, noise, or needs a closer look. The first stage of the work strip.

Investigation

Gathering evidence across tools to reach a verdict on an alert. The second stage of the work strip.

Verdict

The conclusion on an alert, such as benign, suspicious or malicious, ideally with the evidence and steps that led to it.

False positive

An alert that fired on benign activity. Most of a noisy queue.

Escalation

Handing an alert to someone with more authority or context, such as from an agent to an analyst, or from a provider to your team.

Case record

The single place where everything about an alert or incident is written: verdicts, evidence, actions and notes.

MTTR

Mean time to respond (or to remediate): the average time from alert to response. Vendors often quote reductions in MTTR; treat these as the vendor's figures.

Which words describe automation and AI?

Playbook

A predefined workflow in a SOAR that runs a fixed sequence of enrichment and response steps for a type of alert.

Deterministic workflow

A workflow that takes the same steps every time for the same input. The opposite of an agent deciding its steps at run time.

Agentic workflow

A workflow in which an AI agent chooses its next steps at run time based on what it finds.

Autonomy level

How far software may act without a person: suggest only, act after approval, or act alone on trusted categories.

Human in the loop

A person approves an action before it runs. Human on the loop means the action runs and a person monitors and can intervene.

Guardrail

A rule that limits what an agent may do, such as which actions it may take or which systems it may touch. Some vendors enforce guardrails outside the model's reasoning.

Response action

A containment or fix step, such as disabling an account, isolating a host or quarantining an email.

Response action catalog

A list of every response action with its blast radius and the approval it needs by day and by night.

Enrichment

Adding context to an alert automatically, such as user details, asset owner or threat intelligence on an IP address.

Gamebooks

Mate Security's name for its workflow format, which it describes as deterministic where it can be and intelligent where needed. A vendor term.

Cortex AgentiX

Palo Alto Networks' name for what it describes as the next generation of Cortex XSOAR, adding AI agents and prompts inside playbooks. A vendor term.