6.1. Terms A–Z

Action center — Single view of pending and completed response actions from AIR, attack disruption, and analysts; approve, reject, or undo (2.4.2, 3.4.2). · Advanced features (MDE) — Tenant-wide Defender for Endpoint toggles such as live response, tamper protection, and allow or block file (2.3.1). · Advanced hunting — KQL hunting over 30 days of Defender XDR data plus connected Sentinel tables (4.1). · Alert — One detection about one suspicious event or pattern (1.2.1). · Alert grouping — Analytics rule setting that combines related alerts into one incident (2.5.2). · Alert tuning — Rules that hide, resolve, or convert known-benign Defender alerts to behaviors; formerly alert suppression (2.4.1). · Analytics tier — Hot Sentinel storage supporting real-time rules and hunting (2.1.2). · Anomaly rule — Machine learning baseline that writes to the Anomalies table without raising alerts (2.5.3). · Attack disruption — Automatic containment of attacker-controlled users, devices, and apps during high-confidence attacks (2.4.3, 3.4.3). · Attack surface reduction (ASR) rules — Endpoint rules blocking risky behaviors, deployed audit first (2.3.2). · Automated investigation and response (AIR) — Defender XDR self-healing that investigates and remediates within automation levels (2.4.2). · Automation level — Device group setting deciding whether remediation is automatic or needs approval (2.3.3). · Automation rule — Ordered Sentinel triage rule with trigger, conditions, and actions (2.6.1). · Azure Monitor Agent (AMA) — Current collection agent, configured by data collection rules (2.2).

Blast radius — Everything an attacker could reach from a compromised entity (4.2). · Bookmark — Saved hunting result row with notes and entity mappings, stored in HuntingBookmark (4.3.1).

Case — Defender portal work item that groups incidents, indicators, tasks, and comments (3.1.1). · CEF via AMA — Connector collecting Common Event Format messages through a Linux forwarder into CommonSecurityLog (2.2.3). · Choke point — Node appearing on many attack paths; the highest-value remediation target (4.2.1). · Collect investigation package — Device action that downloads a forensic snapshot (3.4.2). · Contain device / contain user — Disruption and response actions that block a device's or account's communication and authentication (2.4.3, 3.4.2). · Content search — Purview eDiscovery search of mailbox, site, and chat content by keywords and conditions (3.5.2). · Correlation — Grouping related alerts into incidents by shared entities, time, and attack stage (1.2.2, 2.4.1). · Custom data collection — MDE rules sending extra endpoint events to DeviceCustom* tables in Sentinel (2.3.1). · Custom detection rule — Scheduled advanced hunting query that raises alerts and can take response actions (2.5.1). · Custom log table — DCR-based _CL workspace table for data without a built-in schema (2.2.5).

Data collection rule (DCR) — Definition of what a collector gathers, how it's transformed, and where it's sent (2.2). · Data lake tier — Low-cost long-term Sentinel storage queried by KQL jobs, notebooks, and search (2.1.2). · Defender for Cloud — Workload protection plans for servers, storage, databases, containers, and more across clouds (3.3.1). · Defender for Cloud Apps — SaaS activity monitoring, governance actions, and app governance for OAuth apps (3.2.3). · Defender for Endpoint (MDE) — Endpoint sensor and enforcer: EDR, ASR, response actions (1.3.1, 2.3, 3.4). · Defender for Identity (MDI) — Sensors on domain controllers detecting on-premises AD attacks (3.2.2). · Defender for Office 365 (MDO) — Email and collaboration protection with Threat Explorer remediation (3.2.1). · Device group — Ranked set of devices with its own access and automation level; a device joins only the highest-ranked match (2.3.3). · Device timeline — Chronological event view on a device page (3.4.1). · Dwell time — How long an attacker operates before detection (1.1).

Entity — Object an alert is about (user, device, IP, file, mailbox, URL) and the glue of correlation (1.2.2). · Entity mapping — Analytics rule configuration turning query columns into entities (2.5.2, 3.3.2).

False positive — Detection logic fired on activity that doesn't match its intent (1.2.2).

Hunting graph — Advanced hunting visualization of entities and relationships through predefined scenarios (4.2.1). · Hunting query — Saved, reusable hunting hypothesis run on demand (4.3.1).

Incident — Correlated container of related alerts, entities, and evidence describing one attack (1.2.2). · Informational, expected activity — Classification for correct detections of authorized activity (benign positive) (1.2.2).

KQL (Kusto Query Language) — Pipeline query language for Microsoft security data (1.5). · KQL job — One-time or scheduled query over data lake tables that promotes results to a table (4.3.2).

Live response — Remote shell on a device with basic and advanced command sets (3.4.2).

MailItemsAccessed — Audit event recording which mail items were accessed (3.5.1). · Microsoft Graph activity logs — Records of every Graph API request, exported via diagnostic settings (3.5.3). · Microsoft Sentinel — Cloud-native SIEM and security data platform with SOAR (1.3.2). · MITRE ATT&CK — Matrix of attacker tactics and techniques used for mapping and coverage (1.4.1, 2.5.3). · Model Context Protocol (MCP) — Open standard for AI applications to use tools and data; implemented by the Sentinel MCP server (4.3.3).

NRT rule — Near-real-time analytics rule running every minute over the last minute of ingested data, with a 50-rule limit (2.5.2).

Phishing Triage Agent — Security Copilot agent that triages user-reported phishing under its own identity (3.1.3). · Playbook — Azure Logic Apps workflow triggered by an incident, alert, or entity (2.6.2). · Purview Audit — Unified audit log; Standard keeps 180 days, Premium a year by default (3.5.1).

Restrict app execution — Device action allowing only Microsoft-signed binaries to run (3.4.2). · Revoke sessions — Invalidating a user's refresh tokens to end stolen-token access (3.2.2).

Search and Purge — Role required to approve email remediation and content purges (3.2.1, 3.5.2). · Security Copilot — Generative AI assistant embedded in Defender for summaries, guided response, script analysis, and KQL (3.1.3). · Selective isolation — Isolation that still allows Outlook and Teams (3.4.2). · Sentinel graph — Environment-wide model of entities and relationships built on the data lake (4.2.2). · Sentinel service account — Identity that runs playbooks for automation rules; needs permission on the playbook resource group (2.1.1, 2.6.1). · SOC optimization — Recommendations on data value and detection coverage (2.1.3). · Summary rule — Scheduled aggregation of high-volume data into a compact Analytics _CL table (4.3.2). · Syslog via AMA — Connector collecting plain syslog through a Linux forwarder into the Syslog table (2.2.3).

Tenant Allow/Block List — Defender for Office 365 list for blocking senders, URLs, and files (3.2.1). · Threat analytics — Microsoft threat reports joined to your incidents, assets, and exposure (4.1.3). · Threat Explorer — Defender for Office 365 tool for hunting and remediating email (3.2.1). · True positive — Real malicious or unauthorized activity (1.2.2).

UEBA — User and Entity Behavior Analytics, building behavioral baselines that enrich entity pages (2.5.3, 3.3.2).

Windows Event Forwarding (WEF) — Built-in Windows mechanism forwarding events to a collector, ingested into WindowsEvent (2.2.2). · Workbook — KQL-driven dashboard in Sentinel (2.1.3). · Workflow automation — Defender for Cloud feature running Logic Apps on alerts or recommendations (3.3.1).

Zero-hour auto purge (ZAP) — Automatic post-delivery removal of messages later found malicious (3.2.1).