How to read this glossary
Each entry gives the general meaning first, then how ARRTECH products use the term. Where a standard such as NIST or MITRE ATT&CK defines a term, we follow it. The same definitions apply to any vendor, ARRTECH included.
A
Agent
A program installed on a computer to collect data or enforce policy, such as the ARRTECH SIEM or DLP agent. In Cyberdroid AI Investigation, an AI agent is software that carries out assigned tasks.
Agentless collection
Collecting logs without installing software on the source system, as ARRTECH SIEM does over SSH, WMI, SQL and Microsoft 365.
AI layer
Our name for the Cyberdroid SOC Platform, the part of the ARRTECH Security Suite that detects and investigates threats with AI.
AI system
An engineered system that generates outputs such as predictions, recommendations or decisions for a given set of objectives, in NIST’s words. The EU AI Act adds that it infers from its input how to generate them.
Alert
A notification that something needs review. In ARRTECH SIEM, alerts come from correlation rules.
Alert fatigue
The strain of receiving more alerts than a team can investigate effectively. Duplicate and noisy findings consume attention that useful cases need.
Analytics family
One of the five groups of methods in Cyberdroid AI Detection. They cover change over time, new sequences and processes, normal user and entity behavior, unusual graph relationships and known-threat intelligence.
Anomaly detection
Comparing activity with a definition of normal to find significant deviations, as NIST describes it. Cyberdroid AI Detection raises each one as a finding for an analyst to review.
API (application programming interface)
A defined way for software to exchange data or trigger actions. ARRTECH SIEM, DLP and SOAR each have a REST API.
ARRTECH Security Suite
ARRTECH SIEM, DLP and SOAR, run from one console with one management agent. An organization can start with one and add the others.
Artifact
In ARRTECH SOAR, an indicator taken from an incident, such as an IP address or file hash. Its reputation updates as playbooks check it.
Attack chain
A sequence of related steps an attacker takes toward a goal. Cyberdroid AI Detection links findings from different detectors into attack chains.
Audit log
A time-ordered record of activity in a system. The console’s audit log records logins, searches and configuration changes.
Autonomy level
A step on ARRTECH’s five-level scale of how much work a system does without a person, from observing activity to running a whole process.
Available now
A status tag for a product on general sale today, such as ARRTECH SIEM, DLP or SOAR. Cyberdroid AI Detection is available now to select organizations.
B
Baseline
A learned picture of normal activity for one user, host or application. Cyberdroid AI Detection raises a finding when behavior departs from it.
Beaconing
Regular, automated contact from a compromised machine to an attacker's server. Cyberdroid AI Detection looks for DNS beaconing in its known-threat and intelligence family.
Behavioral detection
Detection that flags a change in how a user, host or application behaves, without needing a known signature. On this site it means Cyberdroid AI Detection.
C
Case
The record of an investigation. A Cyberdroid AI Investigation case holds a verdict, rationale, evidence and next steps for an analyst to review and accept.
Chain
How ARRTECH SIEM links its signature files: each records the previous file’s name and hash, so a missing or altered file breaks the chain.
Classification
In ARRTECH SIEM, sorting vendor event codes into common categories, so one search covers every vendor. In ARRTECH DLP, labeling content by how sensitive it is.
Command and control
The channel an attacker uses to direct compromised systems, listed in MITRE ATT&CK as tactic TA0011. Attackers can hide it with DNS tunneling or generated domains.
Company-key encryption
An ARRTECH DLP response that encrypts a file with the company’s own key, so it opens only on machines that run the agent.
Console
The web console that manages ARRTECH SIEM, DLP and SOAR, with tenants, users, roles and the audit log in one place. A second product adds no second console.
Correlation
Finding relationships between log entries. ARRTECH SIEM’s rules can match counts in a time window, a missing expected event or a sequence across sources.
Credential vault
The console’s store for the accounts integrations use. It tests each connection before saving, so a credential is entered once.
Critic step
A separate step in Cyberdroid AI Investigation that tests whether the evidence supports the conclusion. Unresolved objections stay on the case.
Cross-source behavioral detection
Behavioral detection that compares an entity’s activity across identity, network, DNS, process and firewall telemetry at once. It is how we describe Cyberdroid AI Detection.
Cyber kill chain
A model of an intrusion as stages, from reconnaissance to actions on objectives, published by Lockheed Martin researchers in 2011. ARRTECH SIEM records the stage on classified events.
Cyberdroid AI Detection
Behavioral detection, available now to select organizations, that runs near-hourly on the organization’s own CPUs. It reads ARRTECH SIEM, or a third-party SIEM through a supported export.
Cyberdroid AI Investigation
AI investigation, in early access, that takes a Cyberdroid AI Detection finding or an alert from ARRTECH SIEM or a supported third-party SIEM. It gathers the evidence and writes a case for an analyst to accept.
Cyberdroid SOC Platform
The AI layer of the ARRTECH Security Suite: Cyberdroid AI Detection, available now to select organizations, and Cyberdroid AI Investigation, in early access.
D
Daily data volume
The licensing unit for ARRTECH SIEM, alongside events per second: how much log data it takes in per day. Sources and agents are unlimited.
Data at rest, in motion and in use
The three states data protection covers: stored (at rest), moving across a network or device (in motion) and open in an application (in use). ARRTECH DLP covers all three.
Data exfiltration
The unauthorized transfer of data out of an organization, MITRE ATT&CK tactic TA0010. ARRTECH DLP controls the channels data leaves through.
Data residency
Where data is stored and processed. Data sovereignty is a different question: whose law applies. Self-hosted ARRTECH products keep data where the organization deploys them.
Delegated work
A module of Cyberdroid AI Investigation (early access) in which people assign tasks to an AI agent. Each task runs under the agent’s own key, and a person reviews and accepts the result.
Deployer
Under the EU AI Act, the organization that uses an AI system in its professional activity. The provider is the one that develops it and places it on the market.
Detector
One of the 21 detectors in Cyberdroid AI Detection. Each is tested in shadow on the organization’s own data before it goes live.
Device control
Allowing or blocking hardware such as USB storage, phones and printers. ARRTECH DLP can do it down to the serial number, and can ask a manager first.
Discovery
Finding where sensitive data is stored. ARRTECH DLP scans endpoints, file servers and databases, then labels what it finds.
Disconnected environment
A network with no connection, or only a limited one, to the internet. Cyberdroid products run their models on premises by default.
Disposition
The next step for a finding or alert, such as investigate or monitor. Cyberdroid AI Investigation records one with a written rationale and what evidence would disprove it.
DLP (data loss prevention)
Software that finds sensitive data and controls how it leaves. ARRTECH DLP covers endpoints, email, web, removable media and generative-AI services.
DNS tunneling
Hiding data or commands inside DNS queries and responses, MITRE ATT&CK technique T1071.004. Cyberdroid AI Detection looks for it in its known-threat and intelligence family.
Domain generation algorithm (DGA)
A method malware uses to create many domain names so it can find its command server, MITRE ATT&CK technique T1568.002. Cyberdroid AI Detection looks for generated domains.
E
Early access
A status tag for a product offered only through design-partner evaluations. Cyberdroid AI Investigation is in early access.
EDR (endpoint detection and response)
Tools that monitor endpoints continuously and respond to threats on them. ARRTECH SIEM collects EDR logs as a source.
Emergency cap
A configurable output limit that helps prevent one detector from flooding the queue. Overflow remains available for review in shadow.
Entity
A user, host or application that Cyberdroid AI Detection baselines. Entity-level means each one is measured against its own history and its neighbors.
EU AI Act
Regulation (EU) 2024/1689, the European Union’s law on artificial intelligence. It sets duties for providers and deployers, including human oversight for high-risk systems.
Evaluation
A structured test of a product on the customer’s own data. Cyberdroid AI Detection uses a proof of value and Cyberdroid AI Investigation a design-partner evaluation, and both methods are published.
Events per second (EPS)
The rate at which a system takes in log events. ARRTECH SIEM supports EPS licensing alongside daily data volume.
Evidence timeline
The ordered events behind a Cyberdroid AI Detection finding, shown beside its baseline, score and threshold.
Execution history
ARRTECH SOAR's record of playbook runs, with errors highlighted.
F
False positive
A benign event a security tool flags as malicious. A proof of value counts false positives and duplicates, because each one costs an analyst time.
Finding
What Cyberdroid AI Detection raises when an entity departs from its baseline, with the evidence behind it. A score ranks the queue and is never a verdict.
Fingerprinting
Recognizing copies or excerpts of specific documents or database records. ARRTECH DLP fingerprints files and database records with configurable similarity thresholds, so partial copies match.
Forensic analysis
Reconstructing what happened from records. ARRTECH SIEM’s forensic module rebuilds the sequence of events from network, system and application logs.
G
GDPR
The EU General Data Protection Regulation, Regulation (EU) 2016/679. ARRTECH SIEM includes ready reports for it, and ARRTECH DLP detects personal data.
Generative-AI services
Services, such as chat assistants, that produce text or code from a prompt. ARRTECH DLP inspects prompts and uploads to these services by content.
Graph
A model of users, hosts and applications as points joined by their relationships. A relationship alone does not prove intent.
Graph neural network
A machine-learning model that learns from the structure of a graph. ARRTECH SIEM's AI module runs graph neural network models to prioritize threats and detect multi-step attacks.
H
Hash
A fixed-length value computed from data. A cryptographic hash helps detect changes when compared with a trusted reference.
HIPAA
The US Health Insurance Portability and Accountability Act, whose Security Rule sets safeguards for electronic health information. ARRTECH SIEM includes ready reports for it.
Human acceptance
A person’s recorded decision to accept AI work after review. Accepting an assessment is separate from authorizing a response.
Human oversight
The ability of people to understand, monitor and correct an AI system while it is in use. The EU AI Act requires it for high-risk systems.
I
ICAP (Internet Content Adaptation Protocol)
A protocol that lets a proxy or firewall send traffic to another service for inspection. ARRTECH DLP can be that service, with no agent.
In review
The state delegated work ends in, ready for a person to verify, resolve or reopen it.
Incident
An event that harms, or is about to harm, the confidentiality, integrity or availability of information or systems. In ARRTECH SOAR, it is the record a playbook runs on.
Indicator of compromise (IOC)
Evidence, such as an IP address, domain or file hash, that suggests an attack is underway or has happened. ARRTECH SOAR tracks them as artifacts.
Inline proxy
Inspection that sits in the path of traffic and can stop it. On Windows, the ARRTECH DLP agent does this at the kernel level for web, FTP and mail, including encrypted traffic.
Insider threat
The risk that someone with authorized access harms the organization, knowingly or not. ARRTECH SIEM, ARRTECH DLP and Cyberdroid AI Detection each address part of it.
Integrity check
A test that stored data has not changed. ARRTECH SIEM checks its signature chain continuously and on demand.
ISO/IEC 27001
The international standard for information security management systems. Accredited bodies certify organizations against it.
ISO/IEC 42001
The international standard for AI management systems, published in 2023. Accredited bodies certify organizations against it.
L
Lateral movement
Techniques an attacker uses to move from one system to others, MITRE ATT&CK tactic TA0008. On a graph it can show up as unusual new connections.
LDAP and Active Directory
LDAP is a protocol for reading directory services, and Active Directory is Microsoft’s directory for Windows networks. Console users can sign in with either.
Local by default
Our phrase for where AI inference runs. Cyberdroid models run in the organization’s environment unless the team turns on the online fallback.
Log
A record of events in a system or network, and a log source is any system that produces one. ARRTECH SIEM reads more than 500 log types out of the box.
M
Management agent
The ARRTECH agent installed on a host before any other. It installs, updates and configures the product agents, centrally or on a schedule.
Managed service
A service in which a provider runs security tools for a client. ARRTECH or an MSSP can run the whole platform this way.
MDR (managed detection and response)
A service that delivers security operations remotely: detection, investigation and response, up to disrupting and containing a threat.
Minutes per case
A proof-of-value measure of the analyst time each case takes, measured in the customer’s own environment.
MITRE ATT&CK
A public knowledge base of attacker tactics (the why) and techniques (the how), maintained by MITRE. ARRTECH SIEM maps events and detections to it.
MSSP (managed security service provider)
A company that monitors and manages security for other organizations. With ARRTECH, each client is its own tenant on one console.
MTTD and MTTR
Mean time to detect is the average time before a problem is found, and mean time to respond runs from detection to resolution. NIST uses MTTR for recovery, so we spell it out.
Multi-tenant
Built so several tenants share one system while each keeps its own data and settings.
N
Near-hourly
Analysis on approximately hourly cycles, with collection and processing affecting when a finding becomes available. It complements controls that need to act immediately.
NIST AI RMF
The NIST Artificial Intelligence Risk Management Framework, AI 100-1, a voluntary framework published in 2023 with four functions: Govern, Map, Measure and Manage.
NIST Cybersecurity Framework
NIST CSF 2.0, published in 2024. It organizes cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
NIST SP 800-61
NIST’s incident response guidance. Revision 3, published in 2025, ties incident response to the Cybersecurity Framework functions.
Non-repudiation
In NIST SP 800-53, protection against a person falsely denying an action. In ARRTECH SIEM, it means logs are signed and chained, so a third party can check they have not changed.
Normalization
Rewriting field values into one form across sources, such as severity 1 to 4 becoming low to critical. ARRTECH SIEM normalizes values per source type.
O
Online fallback
An optional route by which Cyberdroid AI Investigation can use a model outside the organization’s environment. Inference stays local unless the team turns it on as a visible policy.
Operator node
The ARRTECH SOAR playbook step the team marks for approval. It emails the approver the options and waits for the reply before the playbook goes on.
OWASP Top 10 for LLM Applications
The Open Worldwide Application Security Project's list of the main risks in applications built on large language models, last updated in 2025. It includes prompt injection and supply-chain risks.
P
Parked incomplete
A Cyberdroid AI Investigation outcome. When the budget runs out before the evidence supports a conclusion, the case is parked as incomplete and the gap is reported.
Parser
Software that turns a raw log into named fields. If ARRTECH does not read a log source yet, we add a parser at no charge during the contract.
PCI DSS
The Payment Card Industry Data Security Standard, set by the PCI Security Standards Council for anyone handling card data. ARRTECH SIEM includes ready reports for it, and ARRTECH DLP validates card numbers.
Playbook
A defined sequence of response steps. In ARRTECH SOAR, a playbook acts through the organization’s integrations and pauses at each step the team marks for approval.
Precision and recall
Precision is the share of alerts that are real, and recall the share of real events caught. Replay measures both before a Cyberdroid detector is promoted.
Promotion
Moving a Cyberdroid AI Detection detector from shadow to production so it raises alerts. Promotion and rollback are recorded.
Prompt injection
An attempt to redirect a model through instructions placed in content it reads, such as a log or email. Protection includes treating that material as untrusted and limiting the system’s permissions and tools.
Proof of value
A test of a product on the customer’s own data, against criteria agreed before it starts, often called a proof of concept. ARRTECH’s uses labeled replays and at least one representative week of telemetry.
R
Read-only
Access that lets a user or program view data without changing it.
Recorded outcome
The status Cyberdroid AI Investigation records for each request, such as Task, Pending approval, Refused or Rate-limited, with the reason.
Replay scenario
Recorded activity with a known answer, run through a product to see what it finds. Labeled replay scenarios let an evaluation count misses and false positives.
Representative week
At least one week of the customer’s own telemetry, used in a proof of value to show what its analysts would receive.
Retention
How long data is kept. ARRTECH SIEM sets retention per source or source group and archives older logs, which stay searchable.
Role-based access control (RBAC)
Granting permissions by a person’s role. ARRTECH SIEM grants rights per log source and per feature, with predefined roles for directory users.
Routing metadata
The record that shows which model served each Cyberdroid AI Investigation request.
S
Scorecard
The written list of measures and pass criteria for an evaluation, agreed before any case runs. It is the only basis for the result.
Secure email gateway
An ARRTECH DLP component between the mail server and the internet. It checks outgoing mail and can block it, quarantine it or strip attachments.
Shadow
A detector state in Cyberdroid AI Detection. A shadow detector runs and is measured, but its findings go to a separate channel and raise no alerts.
SIEM (security information and event management)
Software that collects, stores, correlates and reports on log data from across an organization. ARRTECH SIEM reads more than 500 log types and signs every log as it is written.
Signed export
An ARRTECH SIEM export of a log source with its signatures, certificate and a standalone verifier, so an auditor can check it without ARRTECH. A signature cannot show the source told the truth.
Silent source
A log source that has stopped sending. ARRTECH SIEM alerts when a source goes silent.
SOAR (security orchestration, automation and response)
Software that automates parts of incident response across security tools. ARRTECH SOAR runs the team’s own playbooks on incidents, such as those raised from ARRTECH SIEM alerts.
SOC (security operations center)
The team, and its tools, that detects, analyzes, responds to and reports on security incidents.
Sovereign consolidation
Moving one organization’s security operations onto the whole ARRTECH platform under a single contract, under that organization’s control.
SOX
The US Sarbanes-Oxley Act, which requires controls over financial reporting at public companies. ARRTECH SIEM includes ready reports for SOX.
Status tag
One of three labels on Cyberdroid products: Available now to select organizations, Early access or Included with Investigation.
Store
The console’s catalog of ready-made parsers, rules, reports and dashboards for ARRTECH SIEM, DLP and SOAR.
Success and stop criteria
Written conditions, agreed before an evaluation, for calling it a success or ending it early. Cyberdroid AI Investigation evaluations carry both.
Syslog
A standard protocol and message format for sending log events across a network. ARRTECH SIEM collects syslog over TCP and UDP.
System card
A document that describes an AI system: what it is for, how it was evaluated and its limits. It extends the model card, proposed by Mitchell and colleagues in 2019. Ours cover Cyberdroid AI Detection and Investigation.
T
Telemetry
The data systems produce about their activity, such as logs, events and flow records. Cyberdroid AI Detection covers identity, network, DNS, process and firewall telemetry.
Telemetry health
Monitoring beside every Cyberdroid AI Detection output that shows whether the data behind it was complete. It separates "nothing suspicious found" from "the telemetry was incomplete".
Tenant
One customer's or client's separate space in a multi-tenant system. In the console, each tenant has its own users, data sources, policies, reports and alerts.
Threat hunting
Searching proactively for threats that have not raised an alert. ARRTECH SIEM supports it with its query language, a graph query language and threat neighborhoods.
Threat intelligence
Information about threats, analyzed to support decisions. ARRTECH SIEM checks IP addresses, domains and URLs against built-in, commercial and internal feeds.
Threat neighborhood
A view in ARRTECH SIEM's graph that shows the entities around a threat, filterable to follow its reach.
Time to disposition
How long it takes from a finding to a decision about it. It is one measure in a Cyberdroid AI Detection proof of value.
Timestamp authority
A trusted third party that stamps data to show it existed at a certain time. One stamps ARRTECH SIEM’s signature files once a day.
U
UEBA (user and entity behavior analytics)
Analytics that learn normal behavior for users and entities and flag deviations. ARRTECH SIEM includes UEBA, with risk scores on a timeline.
V
Verdict
The conclusion of an investigation. A Cyberdroid AI Investigation verdict comes with its confidence, rationale and evidence, and an analyst reviews and accepts it.
W
Watermark
A visible mark on screen. ARRTECH DLP’s dynamic watermark shows the user, computer and time, so a photographed screen can be traced.
Workflow
In ARRTECH SOAR, the definition of a response process. A workflow calls playbooks, which carry out the response steps.
X
XDR (extended detection and response)
Detection and response that correlates telemetry from several security layers, such as endpoint, network and cloud.
