-

Dictionary

Sycope dictionary

We understand how important it is to build the knowledge around the solution we offer - we provide you with extra insights that can help in using the Sycope solution more effectively.

Newest additions

Zero-Day Exploit

Code or technique that abuses a flaw the vendor does not know about, with no patch yet — the attack happens before the flaw is disclosed and fixed.

VLAN

Logical Layer 2 split of a network into separate broadcast domains, regardless of where devices physically sit; frames are tagged per IEEE 802.1Q, and traffic between VLANs needs Layer 3 routing.

TTPs

Tactics, Techniques, and Procedures — a description of how an attacker operates across three levels (goal, method, execution), used in MITRE ATT&CK, threat hunting, and attribution.

Top Talkers

Hosts, applications, or conversations that generate the most network traffic; identified from flow data such as NetFlow, IPFIX, and sFlow.

Check our vocabulary

Active directory

Microsoft's proprietary directory service. It runs on Windows Server and enables administrators to manage permissions.

Amplification Attack

A DDoS attack in which an adversary spoofs the victim's IP and abuses UDP services (DNS, NTP, Memcached) to reflect traffic many times larger than the requests sent.

Anomaly Detection

A method that monitors data to identify unusual patterns or behavior. It helps detect possible threats, faults, or fraud early so they can be investigated.

API

An agreed set of rules that lets programs exchange data and run each other's functions through requests and responses, most often via HTTP-based web APIs.

API Security

Practices and controls protecting APIs against unauthorized access, business logic abuse, and data exposure: authentication, authorization, encryption, and monitoring.

Application Layer Attack (L7)

Attacks targeting web applications and APIs by exploiting software vulnerabilities to disrupt services, steal data, or prevent legitimate user access.

APT (Advanced Persistent Threat)

APT is a targeted cyberattack in which attackers keep covert access to a system for a long time to steal data, disrupt operations, or conduct espionage.

ARP Spoofing / Poisoning

ARP spoofing is a network attack where a hacker sends forged ARP messages to redirect traffic through themselves, enabling data interception and manipulation.

Asset Discovery

Automatically finding and listing all IT assets — hardware, software, services, and cloud resources — as the basis for visibility and vulnerability management.

Bandwidth

The maximum, theoretical rate at which a network link can carry data over time, given in bits per second (Mbps, Gbps). It describes channel capacity, not the throughput actually achieved.

Baseline (Baselining)

A statistical picture of normal network, server, and user behavior, used as a reference point for detecting anomalies (NDR/NPM).

Beaconing

Malware's periodic communication with a remote attacker-controlled server to receive commands or exfiltrate data while evading detection.

BGP (Border Gateway Protocol)

A routing protocol that directs data between different networks on the internet. It helps choose paths for traffic so networks can exchange information efficiently.

Blackholing / RTBH

Sending selected traffic to a Null0 interface where packets are quietly dropped; RTBH automates this over BGP to quickly put out volumetric DDoS attacks.

Botnet

A botnet is a network of infected devices controlled remotely by an attacker. It is used to carry out automated attacks such as spam, DDoS, and data theft.

Brute Force

Automated attack method that systematically tests numerous password combinations until gaining unauthorized access to an account or system.

BYOD (Bring Your Own Device)

A model in which employees use personal devices for work and to reach company data. Needs controls (MDM/MAM, NAC) and a policy to limit risks and shadow IT.

C2 / C&C (Command and Control)

Infrastructure allowing attackers to remotely command infected devices, steal data, and launch coordinated cyberattacks across networks.

Cloud Access Security Broker (CASB)

A control layer between users and cloud services (SaaS/PaaS/IaaS) that gives insight into cloud usage, protects data and helps respond to threats.

Cloud Security Posture Management (CSPM)

Tools that agentlessly and continuously check cloud configuration (IaaS, PaaS, SaaS), catch setup errors and gaps against standards, and help fix them.

CMDB

A repository storing IT configuration items (CIs) with their attributes and links; it supports impact analysis, change management and setting the order of patching.

Collector (Kolektor)

Monitoring component that gathers, organizes, and stores telemetry (NetFlow, IPFIX, sFlow, syslog) from exporters; the middle link in the exporter-collector-analyzer chain.

Command Injection

A vulnerability where an application passes user input to the system shell, letting an attacker run arbitrary operating system commands with the process's privileges (CWE-78).

Content Security Policy (CSP)

A browser security mechanism set by an HTTP header that limits where a page can load scripts and other resources from, mainly to make XSS attacks harder.

Credential Stuffing

Automated attack using stolen login credentials across multiple websites to gain unauthorized account access.

Cross-Site Request Forgery (CSRF)

A web application vulnerability in which an attacker makes a logged-in user perform an action unknowingly, because the browser itself adds their session cookie to the request.

Cryptojacking / Cryptomining

Unauthorized use of a device’s computing power to mine cryptocurrency, usually without the owner’s knowledge. It consumes resources, slowing performance and increasing energy use.

Cyber Kill Chain

A model that shows a cyberattack as seven consecutive phases — from reconnaissance to actions on objectives — and helps detect and break an attack at each stage.

Cyber Threat Intelligence

Security feed algorithm implemented in Sycope CTI actively monitors a number of sources and generates unified list of current IoCs.

Data deduplication

It helps to save enormous amount of data storage. Sycope as first on the market used deduplication mechanism for NetFlow.

Data Exfiltration (Wyciek danych)

Unauthorized copying or transfer of data out of an organization's systems, usually the last step of an attack; detected mainly through outbound-traffic and DNS anomaly analysis.

Data Loss Prevention (DLP)

A set of techniques that detect and block unauthorized leakage of sensitive data at rest, in motion, and in use through classification, content checks, and rule enforcement.

Data mining

A technique used to analyze existing information, usually with the intention of pursuing new avenues to pursue business.

Data Retention

The practice of defining how long an organization keeps data before archiving or permanently deleting it, balancing legal and investigative needs against lower risk.

DDoS (Distributed Denial of Service)

Cyberattack where multiple compromised devices flood a target with traffic to overwhelm and disable services.

Dead Drop Resolver

A technique where attackers hide malicious data in legitimate online resources, allowing covert control without direct contact.

Deep Packet Inspection

A method used in computer networking to scrutinise the content of data packets transmitted over a network.

DGA (Domain Generation Algorithms)

Malware technique that automatically generates numerous domain names to evade detection and maintain contact with command-and-control servers.

DHCP

A client-server protocol (UDP 67/68) that lets a device automatically get an IP address and network settings (mask, gateway, DNS) via the DORA process, for a lease period.

Digital Experience Monitoring

A strategy for optimizing digital interactions, enhancing performance, ensuring security, and boosting user satisfaction.

Direct Network Flood

A type of DoS attack that overwhelms a network with excessive traffic, causing disruption and downtime.

DNS

The system that turns website names (e.g. example.com) into the IP addresses devices use to connect. Known as the "phone book of the internet"; key to how networks work and to security.

DNS Amplification

DNS Amplification is a DDoS attack where attackers exploit open DNS servers to flood targets with massive response traffic, causing service outages.

DNS Spoofing / Cache Poisoning

Attack injecting fake DNS responses to redirect users to malicious sites for data theft, credential harvesting, or malware distribution.

DNS Tunneling

DNS Tunneling is a technique that encodes data within DNS queries to covertly transmit information through networks and bypass security controls.

Domain Hijacking

Cyberattack where hackers gain unauthorized control of a domain by exploiting weak security or stolen credentials to redirect traffic.

DORA

An EU regulation requiring financial firms to manage ICT risk, report incidents, test resilience, and oversee technology suppliers. It aims to strengthen digital operational resilience in finance.

DoS (Denial of Service)

Attack overwhelming a server with traffic requests to make services inaccessible to legitimate users.

Drill-down

A data analysis operation: stepping from a general value down to a more detailed level in a hierarchy; in network monitoring from alert, through flows, to packet.

EDR

Endpoint detection and response (EDR) is a security technology that monitors endpoints for suspicious activity. It detects threats, alerts defenders, and can isolate compromised devices.

Encrypted Traffic Analysis (ETA)

Threat-detection techniques that examine encrypted network traffic without decryption — using TLS metadata, fingerprinting (JA3/JA4), packet sizes and timing, and machine learning.

End User Experience Monitoring

A strategy for optimizing end-users' interactions, focusing on real-time analysis.

False Positive

A false positive is an incorrect alert that flags a safe email, file, or process as a threat. It matters because it can waste time and interrupt normal work.

Fast Flux

A technique where attackers rapidly change IP addresses of malicious servers, using a botnet to evade detection and takedown efforts.

Firewall / NGFW

A network security system that monitors and filters incoming and outgoing traffic based on rules. An NGFW adds deeper inspection of applications and threats to block advanced attacks.

FlowSpec

A BGP extension that distributes precise traffic filtering rules across the network, each with an action (drop, rate-limit, or redirect); used for accurate DDoS mitigation.

Honeypot

A honeypot is a decoy system set up to attract cyberattacks. It helps defenders detect threats and study attacker behavior in a controlled environment.

HTTP / HTTPS

Protocol a browser uses to fetch web resources via request–response (port 80). HTTPS is the same protocol inside a TLS tunnel (port 443): confidentiality, integrity, server identity.

HTTP Flood

HTTP Flood is a DDoS attack overwhelming servers with massive volumes of legitimate-looking HTTP requests from thousands of bots.

ICMP

Network-layer protocol that carries error messages and control information about IP packets; the basis for the ping and traceroute tools.