Glossary

How to read this glossary

Terms are listed A to Z. Each entry gives the general meaning first, then how our products use the term. Where a standard defines the term, such as NIST or MITRE ATT&CK, the entry follows it.

A

Agent

A program installed on a computer to collect data or enforce policy. The ARRTECH SIEM agent runs on Windows and Linux, buffers logs when the server is unreachable and encrypts them in transit. The ARRTECH DLP agent runs on Windows and macOS. In Cyberdroid AI Investigation, an agent is also a software worker that takes approved tasks.

Agentless collection

Collecting logs without installing software on the source system. The ARRTECH SIEM agent can collect from other systems over SSH, WMI, SQL, Kafka and Microsoft 365 without installing anything on them. ARRTECH DLP's email gateway, ICAP service and file-server discovery also work without agents.

AI layer

Our name for the Cyberdroid SOC Platform, the AI layer of the ARRTECH Security Suite. It observes, investigates and communicates, and it reads without changing your estate. Only the suite acts, on your team's rules and approvals.

AI system

NIST's AI Risk Management Framework describes an AI system as an engineered system that generates outputs such as predictions, recommendations or decisions for a given set of objectives. The EU AI Act adds that the system infers from its input how to generate outputs. Our AI System Inventory lists each one in our products.

Alert

A notification that something needs attention. In ARRTECH SIEM, an alert comes from a correlation rule and carries the rule name, message, risk level and a link to the matching search. An alert is a prompt to look, not a verdict.

Alert fatigue

The state in which analysts receive more alerts than they can review, so real ones are missed or dismissed. ARRTECH SIEM suppresses duplicate alerts, and Cyberdroid AI Detection routes a flooding detector's overflow to shadow instead of your queue.

Analytics family

One of the five groups of methods Cyberdroid AI Detection runs: time-series baselines and change detection, sequence and process novelty, a learned model of normal user and entity behavior, relationship-graph anomalies, and known-threat and intelligence detection.

Anomaly detection

Comparing observed activity with a definition of normal to find significant deviations. NIST describes it this way for intrusion detection. An anomaly is a reason to look. It does not prove intent.

API (application programming interface)

A defined way for software to exchange data or trigger actions. ARRTECH SIEM, SOAR and DLP each have a REST API, the common web style for APIs. ARRTECH SOAR reaches most of the tools it orchestrates through theirs.

ARRTECH Security Suite

ARRTECH SIEM, ARRTECH SOAR and ARRTECH DLP on one management framework and one web console. You can start with one product and add the others without a second admin stack. Only the suite acts, on your team's rules and approvals.

Artifact

In ARRTECH SOAR, an indicator taken from an incident, such as an IP address or a file hash. SOAR extracts artifacts from incident fields automatically, and their reputation updates as playbooks analyze them.

Attack chain

A sequence of related steps an attacker takes toward a goal. Cyberdroid AI Detection correlates findings from different detectors into attack chains and campaigns, with MITRE ATT&CK context.

Audit log

A time-ordered record of activity in a system. The console's audit log records logins, searches and configuration changes, and an online-user view shows who is signed in.

Autonomy level

A step on a scale of how much a system does without a person. Our scale runs from observes only, through investigates read-only, works when approved and acts by rule, to acts alone. ARRTECH SIEM alert actions, SOAR playbooks and DLP policies act by rule. Our Autonomy Levels page maps each feature.

Available now

A status tag for a product you can buy and deploy today, such as Cyberdroid AI Detection. See Early access.

B

Baseline

A learned picture of normal activity for one entity. Cyberdroid AI Detection baselines every user, host and application against its own history and its neighbors, on your hardware. A departure from the baseline becomes a finding with the evidence behind it.

Beaconing

Regular, automated contact from a compromised machine to an attacker's server. Cyberdroid AI Detection looks for DNS beaconing in its known-threat and intelligence family.

Behavioral detection

Detection that flags a change in how a user, host or application behaves, rather than a match to a known signature. On our site the word belongs to Cyberdroid AI Detection, which covers identity, network, DNS, process and firewall telemetry.

C

Case

The record of an investigation. An ARRTECH SIEM case carries its type, severity, assignee, SLA, MITRE tactic and history, and downloads as a report. An ARRTECH SOAR incident is a separate record that holds the playbook run. A Cyberdroid AI Investigation case holds a verdict, confidence, rationale, evidence references and next steps.

Chain

How ARRTECH SIEM links its signature files. Each signature file records the previous file's name and hash, so a missing or altered file breaks the chain and shows in the integrity check.

Classification

Two uses on our site. In ARRTECH SIEM, classification rules turn vendor-specific event codes into plain categories graded Informational to Critical, so one search covers every vendor. In ARRTECH DLP, classification labels content by how sensitive it is.

Command and control

The channel an attacker uses to direct compromised systems. MITRE ATT&CK lists it as tactic TA0011. DNS tunneling and generated domains are two ways attackers hide it.

Company-key encryption

An ARRTECH DLP response that encrypts a file with a key specific to your company, so the file opens only on machines that run the agent. A file can leave without its content leaving readable.

Console

The web console, served over HTTPS, that manages ARRTECH SIEM, SOAR and DLP. It holds tenants, users, roles, the credential vault, the Store and the audit log, so a second product adds no second admin stack.

Correlation

Finding relationships between log entries. The ARRTECH SIEM correlation engine runs in memory. Its rules match single events, counts in a time window, the absence of an expected event, and sequences across sources.

Credential vault

The console's store for the credentials integrations use, such as database, directory, mail, cloud storage, API, SSH and Windows host accounts. It tests each connection before saving, so a credential is entered once.

Critic step

A separate step in Cyberdroid AI Investigation that tests whether the evidence earns the conclusion. It can send the case back for another pass, and unresolved objections stay attached to the finding.

Cross-source behavioral detection

Behavioral detection that compares an entity's activity across several telemetry sources at once: identity, network, DNS, process and firewall. It is how we describe Cyberdroid AI Detection. We do not use "cross-source" on its own.

Cyber kill chain

A model of an intrusion as stages from reconnaissance to actions on objectives, published by Lockheed Martin researchers in 2011. ARRTECH SIEM stores the kill-chain phase on classified events and on cases.

Cyberdroid AI Detection

Behavioral detection on your SIEM, available now. It baselines users, hosts and applications across identity, network, DNS, process and firewall telemetry, runs near-hourly on CPUs in your environment, and never blocks or changes anything. It attaches to ARRTECH SIEM, or to a third-party SIEM that connects through a supported export format.

Cyberdroid AI Investigation

Read-only AI investigation that produces reviewable cases, in early access. It takes a Detection finding or a SIEM alert through bounded, read-only queries, challenges its own verdict and writes a case for a person to review. It requires Cyberdroid AI Detection.

Cyberdroid SOC Platform

The AI layer of the ARRTECH Security Suite: Cyberdroid AI Detection and Cyberdroid AI Investigation. It observes, investigates and communicates, read-only.

D

Daily data volume

The licensing unit for ARRTECH SIEM: the amount of log data it takes in per day. Events per second is also supported. Log sources and agents are unlimited, and no separate operating system or database license is needed.

Data at rest, in motion and in use

The three states data protection covers. At rest is stored data, in motion is data crossing a network or a device, and in use is data open in an application. ARRTECH DLP covers all three: discovery and labeling at rest; email, web, shares and removable media in motion; clipboard, screen capture and watermark in use.

Data exfiltration

The unauthorized transfer of data out of an organization. MITRE ATT&CK lists it as tactic TA0010. ARRTECH DLP controls the channels data leaves through, and Cyberdroid AI Detection flags the behavior around it.

Data residency

Where data is stored and processed. It differs from data sovereignty, which concerns whose law and control apply to the data. Self-hosted ARRTECH products keep data where you deploy them. Our Data Residency page names each path by which data can leave.

Delegated work

A module of Cyberdroid AI Investigation for tasks a person asks an AI agent to do. Each task waits for an administrator's approval, the agent works with its own key, and the result returns "in review" until a person accepts it.

Deployer

Under the EU AI Act, the organization that uses an AI system under its own authority. The provider is the organization that develops the system and places it on the market under its own name.

Detector

One of the 21 machine-learning detectors in Cyberdroid AI Detection. Each is disabled, shadow or production. A detector raises alerts only after it is measured in shadow on your data and promoted.

Device control

Allowing or blocking hardware such as USB storage, phones, Bluetooth and printers. ARRTECH DLP controls any device class or specific device by vendor, product or serial number, per user or computer, with an optional manager approval.

Discovery

Finding where sensitive data is stored. ARRTECH DLP scans endpoints with its agent, and file servers and SQL databases without one, then labels or inventories what it finds.

Disconnected environment

A network with no route, or a tightly restricted route, to the internet. Cyberdroid runs its models in your environment by default, which suits these sites. Our Disconnected Environments page covers what works without a connection.

Disposition

The decision about what to do with a finding or an alert, such as investigate or monitor. Cyberdroid AI Investigation records a disposition with a written rationale and the evidence that would disprove it.

DLP (data loss prevention)

Software that finds sensitive data and controls how it leaves. ARRTECH DLP covers endpoints, email, web, generative-AI services, network shares, removable media, printers and unmanaged devices, with kernel-level agents and agentless network components.

DNS tunneling

Hiding data or commands inside DNS queries and responses. MITRE ATT&CK lists it under technique T1071.004. Cyberdroid AI Detection looks for it in its known-threat and intelligence family.

Domain generation algorithm (DGA)

A method malware uses to create many domain names so it can find its command server. MITRE ATT&CK lists it as technique T1568.002. Cyberdroid AI Detection looks for generated domains.

E

Early access

A status tag for a product offered through design-partner evaluations with written success and stop criteria, rather than general sale. Cyberdroid AI Investigation is in early access.

EDR (endpoint detection and response)

Tools that monitor endpoints continuously and respond to threats on them. ARRTECH SIEM collects EDR logs as a source.

Emergency cap

A limit that stops one detector from flooding your queue. When a Cyberdroid AI Detection detector exceeds its cap, the overflow goes to shadow instead of raising alerts.

Entity

A user, host or application that Cyberdroid AI Detection baselines. Entity-level means each one is measured against its own history and its neighbors.

EU AI Act

Regulation (EU) 2024/1689, the European Union's law on artificial intelligence. It sets duties for providers and deployers of AI systems, including transparency and human oversight for high-risk systems. Our Safety pages name the articles each page answers.

Evaluation

A structured test of a product on your data. For Cyberdroid AI Investigation it is a design-partner evaluation with written success and stop criteria. For AI Detection it is a proof of value. Our Evaluations page publishes both methods.

Events per second (EPS)

The rate at which a system takes in log events. ARRTECH SIEM supports EPS licensing alongside daily data volume.

Evidence timeline

The ordered events behind a Cyberdroid AI Detection finding. It sits beside the observed value, baseline, score and threshold, with process lineage and threat-intelligence provenance.

Execution history

ARRTECH SOAR's record of playbook runs, with errors highlighted.

F

False positive

A benign event a security tool flags as malicious. A proof of value counts false positives and duplicates, because each one costs an analyst time.

Finding

What Cyberdroid AI Detection raises when an entity departs from its baseline. Each finding shows the observed value, baseline, score and threshold, an evidence timeline and telemetry health. A score ranks your queue and is never a verdict.

Fingerprinting

Recognizing copies or excerpts of specific documents or database records. ARRTECH DLP fingerprints files and database records with configurable similarity thresholds, so partial copies match.

Forensic analysis

Reconstructing what happened from records. The ARRTECH SIEM forensic module rebuilds the sequence of events from network, system and application logs, and maps allowed and blocked connections by protocol and application.

G

GDPR

The EU General Data Protection Regulation, Regulation (EU) 2016/679. ARRTECH SIEM includes ready reports for it, and ARRTECH DLP detects personal data.

Generative-AI services

Services, such as chat assistants, that produce text or code from a prompt. ARRTECH DLP treats them as a channel: it inspects prompts, uploads and API requests sent to them by content, not only by domain.

Graph

A model of users, hosts and applications as points joined by their relationships. ARRTECH SIEM's AI module runs on an in-memory graph with its own query language for hunting. Cyberdroid AI Detection looks for relationship-graph anomalies. A relationship does not prove intent.

Graph neural network

A machine-learning model that learns from the structure of a graph. ARRTECH SIEM's AI module runs graph neural network models to prioritize threats and detect multi-step attacks.

H

Hash

A fixed-length value computed from data. Any change to the data changes the hash. ARRTECH SIEM hashes every write before signing it.

HIPAA

The US Health Insurance Portability and Accountability Act. Its Security Rule sets safeguards for electronic health information. ARRTECH SIEM includes ready reports for HIPAA.

Human acceptance

The point at which a person accepts AI work. Delegated work finishes "in review", and a person verifies, resolves or reopens it. Cost is counted per task a person accepts.

Human oversight

People's ability to understand, monitor and overrule an AI system. The EU AI Act requires it for high-risk systems. Our Human in Command page shows where a person approves and accepts.

I

ICAP (Internet Content Adaptation Protocol)

A protocol that lets a proxy or firewall send traffic to another service for inspection. ARRTECH DLP runs as an ICAP service and returns allow or block decisions, without an agent.

In review

The finishing state of delegated work. An AI agent never marks its own task resolved; a person verifies, resolves or reopens it.

Incident

An event that actually or imminently harms the confidentiality, integrity or availability of information or systems. In ARRTECH SOAR, an incident is the record a playbook runs on, created from a SIEM alert, a monitored mailbox, the API or by hand.

Indicator of compromise (IOC)

Evidence, such as an IP address, domain or file hash, that suggests an attack is underway or has happened. ARRTECH SOAR manages indicators as artifacts, and ARRTECH SIEM checks them against threat intelligence.

Inline proxy

Inspection that sits in the path of traffic and can stop it. On Windows, the ARRTECH DLP agent inspects web, FTP and mail traffic at the kernel level as an inline proxy, including encrypted traffic, whatever the browser or application.

Insider threat

The risk that someone with authorized access harms the organization, knowingly or not. ARRTECH DLP, ARRTECH SIEM and Cyberdroid AI Detection each address part of it.

Integrity check

A test that stored data has not changed. ARRTECH SIEM checks its signature chain continuously and on demand, and its non-repudiation reports highlight any faulty file.

ISO/IEC 27001

The international standard for information security management systems. Accredited bodies certify organizations against it, not products.

ISO/IEC 42001

The international standard for AI management systems, published in 2023. Accredited bodies certify organizations against it. Our Safety pages name the clauses they answer.

L

Lateral movement

Techniques an attacker uses to move from one system to others in a network. MITRE ATT&CK lists it as tactic TA0008. On a relationship graph it can appear as unusual new connections between entities.

LDAP and Active Directory

LDAP is a protocol for reading directory services. Active Directory is Microsoft's directory for Windows networks. Console users can sign in with Active Directory or LDAP accounts, and assets sync from LDAP.

Local by default

Our phrase for where AI inference runs. Cyberdroid models run in your environment unless your team configures the online fallback, which is a policy you can see.

Log

A record of events in a system or network. A log source is any system that produces one. ARRTECH SIEM supports more than 500 log types out of the box.

M

Management Agent

The first ARRTECH agent installed on a host. It installs, updates and configures the product agents, centrally or on a schedule.

Managed service

A service in which a provider runs security tools for a client. Whole-platform ARRTECH deals run as a managed service, operated by ARRTECH or an MSSP, or under a sovereign consolidation contract.

MDR (managed detection and response)

A service that delivers security operations center functions remotely: detection, investigation and response, through disruption and containment.

Minutes per case

A proof-of-value measure: the analyst time a case takes, measured in your environment. We report it instead of promising a percentage saving.

MITRE ATT&CK

A public knowledge base of attacker tactics, the why, and techniques, the how, maintained by MITRE. ARRTECH SIEM stores tactic, technique and kill-chain phase on classified events and maps your detections to the framework.

MSSP (managed security service provider)

A company that monitors and manages security for other organizations. The console is multi-tenant, ARRTECH DLP deploys multi-tenant for MSSPs, and an MSSP can run the whole platform as a managed service.

MTTD and MTTR

Mean time to detect is the average time a problem exists before it is found. Mean time to respond is the average time from detection to resolution. NIST uses MTTR for mean time to recovery, so we spell out which we mean.

Multi-tenant

Built so several tenants share one system while each keeps its own data and settings. In the console, each tenant has its own users, data sources, policies, reports and alerts.

N

Near-hourly

How often Cyberdroid AI Detection produces findings. Activity from 13:00 to 13:59 becomes eligible at 14:01, plus processing time.

NIST AI RMF

The NIST Artificial Intelligence Risk Management Framework, AI 100-1, published in 2023. It is voluntary and organized into four functions: Govern, Map, Measure and Manage. Our Safety pages name the subcategories they answer.

NIST Cybersecurity Framework

NIST CSF 2.0, published in 2024. It organizes cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover.

NIST SP 800-61

NIST's incident response guidance. Revision 3, published in 2025, ties incident response to the Cybersecurity Framework functions. Our incident response pages use it as their primary source.

Non-repudiation

Two meanings. In NIST SP 800-53, it protects against a person falsely denying an action. In ARRTECH SIEM, it means stored logs are hashed, signed, chained and timestamped, so a third party can verify they have not changed since they were written.

Normalization

Rewriting field values into one form across sources, such as severity 1 to 4 becoming low to critical. ARRTECH SIEM normalizes values per source type.

O

Online fallback

An optional route by which Cyberdroid AI Investigation can use a model outside your environment. It is a policy your team configures and can see. Inference stays local by default.

Operator node

The ARRTECH SOAR playbook step that asks a person to decide. It emails that person with up to five color-coded options and waits. Nothing below it runs until the reply arrives.

OWASP Top 10 for LLM Applications

The Open Worldwide Application Security Project's list of the main risks in applications built on large language models, last updated in 2025. It includes prompt injection and supply-chain risks.

P

Parked incomplete

A Cyberdroid AI Investigation outcome. When the budget runs out before the evidence earns a conclusion, the case is parked incomplete instead of concluded. An incomplete case is a valid result.

Parser

Software that turns a raw log into named fields. ARRTECH SIEM supports several parser types, which can be chained so the next one tries when the first fails. ARRTECH develops parsers for unsupported sources at no charge while a support contract is active.

PCI DSS

The Payment Card Industry Data Security Standard, set by the PCI Security Standards Council for organizations that handle card data. ARRTECH SIEM includes ready reports for PCI DSS, and ARRTECH DLP checks card numbers by algorithm, not only by pattern.

Playbook

A defined sequence of response steps. In ARRTECH SOAR, playbooks take actions through integration nodes, and workflows call them. A playbook can include an Operator node where a person decides.

Precision and recall

Two measures of detection quality. Precision is the share of alerts that are real. Recall is the share of real events that are caught. Replay tooling measures both before a Cyberdroid detector is promoted.

Promotion

Moving a Cyberdroid AI Detection detector from shadow to production so it raises alerts. Promotion and rollback are recorded.

Prompt injection

An attack that hides instructions in text a model reads, such as a log line or an email, to steer it. Cyberdroid AI Investigation treats requests as claims and keeps data access in software the model does not control. Our Prompt Injection page describes the controls.

Proof of value

An evaluation that measures a product on your own data against criteria agreed before it starts. Many buyers and government guides call it a proof of concept. Ours uses labeled replay scenarios and at least one representative week of your telemetry, scored against a scorecard agreed first.

R

Read-only

Able to read data but not change it. Cyberdroid AI Detection reads the SIEM export from a read-only share, and Cyberdroid AI Investigation reads your logs through read-only queries that software compiles and checks.

Recorded outcome

How Cyberdroid AI Investigation records each request: Task, Pending approval, Refused or Rate-limited, with an operation id and a reason. A request is a claim, and policy decides the outcome.

Replay scenario

Recorded activity with a known answer, run through a product to see what it finds. Labeled replay scenarios let an evaluation count misses and false positives.

Representative week

At least one week of your own telemetry, used in a proof of value to show what your analysts would receive.

Retention

How long data is kept. ARRTECH SIEM sets retention per source or source group and archives older logs, which stay searchable.

Role-based access control (RBAC)

Granting permissions by role rather than by person. ARRTECH SIEM grants rights per log source and per feature, with predefined roles for directory users.

Routing metadata

The record that shows which model served each Cyberdroid AI Investigation request.

S

Scorecard

The written list of measures and pass criteria for an evaluation, agreed before the first case. It is the only basis for the result.

Secure Email Gateway

An ARRTECH DLP component that runs as a mail transfer agent between your mail server and the internet. It analyzes outgoing mail and can block it, quarantine it or strip attachments, without an agent.

Shadow

A detector state in Cyberdroid AI Detection. A shadow detector runs and sends its findings to a separate channel while replay tooling measures it, without raising alerts.

SIEM (security information and event management)

Software that collects, stores, correlates and reports on log data from across an organization. ARRTECH SIEM collects more than 500 log types, signs every write, correlates in memory, and adds UEBA, graph analytics and forensic analysis.

Signed export

An ARRTECH SIEM export of a log source with its signatures, the SIEM certificate and a standalone verification tool. An auditor or a court runs the tool without access to your SIEM.

Silent source

A log source that has stopped sending. ARRTECH SIEM alerts when a source goes silent, so a quiet day is not mistaken for a safe one.

SOAR (security orchestration, automation and response)

Software that automates parts of incident response across tools. ARRTECH SOAR runs incident playbooks through API integrations. It detects nothing on its own; ARRTECH SIEM alerts are a main source of its incidents.

SOC (security operations center)

The team, and its tools, that detects, analyzes, responds to and reports on security incidents.

Sovereign consolidation

Moving one organization's security operations onto the whole platform under a single contract, run under that organization's control. It is one of the two routes for whole-platform ARRTECH deals.

SOX

The US Sarbanes-Oxley Act, which requires controls over financial reporting at public companies. ARRTECH SIEM includes ready reports for SOX.

Status tag

One of three labels on Cyberdroid products: Available now, Early access, or Included with Investigation.

Store

The console's catalog of ready-made packages for ARRTECH SIEM, SOAR and DLP: modules, log parsers, correlation rules, reports, queries, dashboards, agents and classifications, installed or updated from the console.

Success and stop criteria

Written conditions, agreed before an evaluation, for calling it a success or ending it early. Cyberdroid AI Investigation evaluations carry both.

Syslog

A standard protocol and message format for sending log events across a network. ARRTECH SIEM collects syslog over TCP and UDP.

System card

A document that describes an AI system: what it is for, how it was evaluated and its limits. It extends the model card, a format proposed by Mitchell and colleagues in 2019. Our System Cards cover Cyberdroid AI Detection and Cyberdroid AI Investigation.

T

Telemetry

The data systems produce about their activity, such as logs, events and flow records. Cyberdroid AI Detection covers identity, network, DNS, process and firewall telemetry.

Telemetry health

Monitoring beside every Cyberdroid AI Detection output that shows whether the data behind it was complete. It lets you tell "nothing suspicious found" from "the telemetry was incomplete".

Tenant

One customer's or client's separate space in a multi-tenant system. In the console, each tenant has its own users, data sources, policies, reports and alerts.

Threat hunting

Searching proactively for threats that have not raised an alert. ARRTECH SIEM supports it with its query language, a graph query language and threat neighborhoods.

Threat intelligence

Information about threats, analyzed to support decisions. ARRTECH SIEM checks IP addresses, domains, URLs and mail servers against built-in, commercial, open-source and internal feeds that refresh on a schedule.

Threat neighborhood

A view in ARRTECH SIEM's graph that shows the entities around a threat, filterable to follow its reach.

Time to disposition

How long it takes from a finding to a decision about it. It is one measure in a Cyberdroid AI Detection proof of value.

Timestamp authority

A trusted third party that stamps data to show it existed at a certain time. Once a day, a timestamp authority stamps ARRTECH SIEM's signature files, so the date on the chain rests on that third party.

U

UEBA (user and entity behavior analytics)

Analytics that learn normal behavior for users and entities and flag deviations. ARRTECH SIEM includes UEBA with risk scores on a timeline. Cyberdroid AI Detection includes a learned model of normal user and entity behavior among its five families.

V

Verdict

The conclusion of an investigation. A Cyberdroid AI Investigation verdict comes with confidence, rationale and evidence references, and a person reviews it. A score is never a verdict.

W

Watermark

A visible mark on screen. ARRTECH DLP's dynamic screen watermark shows user, domain, computer name, IP address and time, so a photographed screen can be traced.

Workflow

In ARRTECH SOAR, the definition of a response process. A workflow contains no action nodes; it calls playbooks, which take the actions.

X

XDR (extended detection and response)

Detection and response that correlates telemetry from several security layers, such as endpoint, network and cloud.