Platform / Glossary
Glossary
The words we use, and the ones we deliberately don't.
Security vocabulary is mostly borrowed and mostly imprecise. These are the terms that carry weight in this platform, defined the way the product actually behaves — including the distinctions that look pedantic until an incident depends on one.
The one distinction worth reading first
Absent is not zero, and zero is not fine. A machine reporting no alerts and a machine reporting nothing at all are different facts, and almost every misread of a security dashboard is those two being drawn the same way. Everything below inherits that rule: where the platform does not know something, it says so rather than showing you a confident number.
Evidence and the record
Event
One thing that happened, in the platform's own shape. Not a log line — a log line is a sentence somebody's software wrote for its own purposes. An event is that sentence turned into a fact the whole platform can reason about.
Normalising
Giving events from different products the same field names, so one question can span all of them. It is the difference between what else touched this address being a query and being a project.
Sealing
Fingerprinting an event so later alteration is detectable, including by us. It proves integrity, not truthfulness — if a compromised host lies to us, we can prove nobody altered the lie in transit.
Two timestamps
When it happened on the machine, and when we first saw it. They differ whenever a network was slow or a host was offline, and a platform keeping only one cannot tell a late event from a quiet hour.
Evidence link
The record behind a sentence in a report. No uncited claim ships — if a report states a number, the number is reachable.
Bounded scan
A query that hit its ceiling, returned the newest results, and said so. Counts from one are floors, labelled as floors — never presented as totals.
Judgement
Detection
A rule describing a pattern worth noticing, with its logic and its tests published rather than hidden. General knowledge — true everywhere, and the easy half.
Baseline
What normal looks like for one machine or person, learned from their own history rather than a global average. Needs time before it means anything, and says which it is showing you.
Severity
A property of the pattern, not of your estate. A rule cannot know whether something is routine for you, so disagreeing with a severity is a legitimate outcome of triage rather than a fault.
Unjudged
Something nobody stamped a severity on. It is not below a threshold — an unjudged artifact passes a severity floor rather than failing it, because absence of a rating is not a low rating.
Triage
Deciding whether a true pattern matters here. A person's job, not a threshold's — and the platform never closes an alert on your behalf for looking routine.
The graph
Events joined by what caused what, so a moment can be read with its lead-up and aftermath attached. A gap in coverage becomes a visible break in the chain, never a plausible guess.
Acting
The gate
The one place every world-changing action must pass, and therefore the one place to ask why one happened. There is no quiet path around it, including for us.
Guard
One independent check with one concern — standing, reversibility, importance, blast radius. Guards do not negotiate with each other and do not vote.
Hold
Stopped, waiting for a named person to release it. A single hold is a hold — three guards passing and one holding is not mostly fine.
Refusal
Already decided. No approver can release it and no button exists that would — a refusal is not a stronger hold. Changing one means changing the policy behind it, deliberately, elsewhere.
Canary
Trying an action on one machine and verifying before the rest. It is why an allow is permission to begin, never permission to finish.
Blast radius
What else an action touches. A radius of zero is the dangerous reading — where owners and dependencies are unmapped, the number is unknown rather than small.
Identity and policy
Standing
Whether an identity may do a particular thing right now — not whether it signed in successfully. A valid session is not a standing permission.
Step-up
Proving who you are again at the moment of a consequential act, not at the start of the day. It is what stops a stolen session approving anything.
Second person
Someone other than the requester approving. Enforced where the action passes rather than checked afterwards in a report — the requester can never be their own approver.
Governed
A machine whose feed was narrowed by a named policy document. Its short feed is somebody's intent — as distinct from a short feed nobody chose.
Withheld
Content a policy deliberately removed from a machine, attributable to the document and the setting that did it. Reversible, and never drawn as an error.
Unfiltered
A policy failed to resolve, so everything shipped and nobody's intent is in force. It looks identical to a healthy machine on any tile that counts rules, which is why it is named separately.
Unmeasured
Nothing could judge this, so nothing claims to have. Drawn faintly and labelled, outside the healthy-to-failing ramp, so it can never be mistaken for a passing grade.
Silent
A machine that has reported nothing. Unobserved, not compliant — the platform never infers safety from silence, and coverage is reported as a count rather than a flattering percentage.
Words we avoid
Compliant as a percentage, because it averages over machines that were never measured. Threat as a noun for an alert, because most alerts are not threats and the word spends credibility you need later. Auto-remediated, because it hides whether a person was involved. Single pane of glass, because everyone claims it and it describes a window rather than a capability. And AI-powered on its own — if a model did something, the page says what it did and shows the evidence.