-

Dictionary

Sycope dictionary

We understand how important it is to build the knowledge around the solution we offer - we provide you with extra insights that can help in using the Sycope solution more effectively.

Newest additions

Throughput

The amount of data actually transferred across a network per unit of time (bps); lower than a link's theoretical capacity because of overhead, latency, and packet loss.

TAXII

Open OASIS standard for automatically exchanging cyber threat intelligence (CTI) over REST/HTTPS; delivers STIX data using collections (pull) and channels (push).

Syslog

A standard and protocol for sending system event messages from devices and applications to a central collector; each entry encodes the source (facility) and importance (severity).

STIX

Open OASIS standard for describing cyber threats in JSON: typed objects (SDO/SCO/SRO) and their relationships, used to exchange threat intelligence.

Check our vocabulary

ICMP Flood (Ping Flood)

ICMP Flood is a denial-of-service attack using excessive ping packets to overwhelm network resources and disrupt service availability.

Identity and Access Management (IAM)

Managing digital identities and controlling access to resources: it combines authentication (who) with authorization (to what) under the principle of least privilege.

Incident Response Lifecycle

An organized, repeatable process for detecting, analyzing, containing, removing and recovering from security incidents; described as 4 NIST phases or 6 SANS steps (PICERL).

Insider Threat

A risk posed by employees, contractors, or partners who misuse or accidentally expose access to data or systems. It helps identify internal sources of security breaches and loss.

Internet Peering

A direct network interconnection between ISPs, enabling mutual traffic exchange, enhancing efficiency, and reducing costs.

Intrusion Detecting System

A security solution that monitors network traffic for signs of suspicious activity, cyberattacks, or policy violations.

Inventory

An up-to-date, central record of all IT assets (hardware, software, services, accounts) with their descriptions — the basis for managing risk, vulnerabilities, and the attack surface.

IoA (Indicator of Attack)

An indicator of attack is a sign of suspicious activity that may show an attack is in progress or about to happen. It helps security teams detect and stop threats early.

IoC (Indicator of Compromise)

An indicator of compromise is a digital artifact or behavior that may signal a security breach. It helps security teams detect, investigate, and respond to threats quickly.

IPFIX

A standardized method for exporting network flow data, enabling detailed analysis of traffic patterns.

IPS (Intrusion Prevention System)

An intrusion prevention system monitors network traffic for suspicious activity and blocks detected attacks automatically. It helps protect systems and data from unauthorized access and other threats.

ISO 27001

International standard telling companies how to protect information properly: a management system (ISMS), a risk-based approach, Annex A controls and certification.

J-Flow

Juniper Networks' method of monitoring IP traffic based on sampling, exporting flow records over UDP to a collector; the equivalent of NetFlow.

JA3 / JA4 Fingerprinting

Techniques that build stable TLS client and server fingerprints from cleartext handshake fields (ClientHello/ServerHello), letting you spot an application or malware without decrypting traffic.

Jitter

Jitter is the uneven pace at which packets arrive (delay variation, in ms). It harms VoIP and video calls, and in security it masks C2 beaconing.

Latency (Opóźnienie)

Latency is the time data takes to travel from sender to receiver across a network, measured in ms as RTT or one-way delay; its components are propagation, serialization, queuing, and processing.

Lateral Movement

Lateral movement is a post-breach technique where attackers move across a network to escalate privileges and access sensitive systems and data.

Malware

Malicious software designed to infiltrate systems, steal data, disrupt operations, or sabotage computers without user knowledge or consent.

Man-in-the-Middle (MitM)

Attack where a hacker intercepts and eavesdrops on communications between two parties, potentially stealing data or altering information.

Microsegmentation

A network security method that splits an environment into small, isolated zones at the level of single workloads. It controls east–west traffic and limits an attacker's lateral movement.

MITTRE ATT&CK

A knowledge base that classifies and documents cyber threat tactics and techniques enabling effective defence against cyber attacks.

MTTD (Mean Time to Detect)

The average time it takes to detect a security threat or incident. It measures how quickly an organization identifies problems so it can respond sooner and reduce damage.

MTTR (Mean Time to Repair)

The average time needed to repair a system or recover from an incident after a failure is detected. It measures how quickly operations can be restored and downtime reduced.

Multi-Factor Authentication (MFA)

Multi-factor authentication requires at least two independent factors from different categories (knowledge, possession, biometrics) to confirm identity and make account takeover harder.

Multitenancy

An architectural model where one software instance serves multiple independent tenants on shared infrastructure, separating their data logically. The basis of SaaS and cloud.

NAC

A cybersecurity system designed to regulate and manage access to computer networks.

NDR (Network Detection and Response)

A security technology that monitors network traffic to detect suspicious activity and respond to threats. It helps identify attacks early and support incident response.

NetFlow

Information about streams of data flowing through network devices is called NetFlow - the most widely-used standard for flow data statistics

Network Forensics

Branch of digital forensics that captures and analyzes network traffic (PCAP, flow, logs) to determine the source and course of an incident and to preserve evidence.

Network Observability

A real-time data analysis, enabling proactive issue resolution and optimization for seamless operations and enhanced security.

Network Packet Broker (NPB)

An appliance or software that collects a copy of traffic from TAPs and SPAN ports, filters it, and distributes it to monitoring and security tools.

Network TAP

A device inserted into a network cable that makes a faithful copy of all traffic and passes it to monitoring tools without affecting the live network.

Network Topology

A blueprint of device connections, defining data flow patterns and influencing performance and fault tolerance.

NIS2

An EU directive that sets cybersecurity requirements for essential and digital service providers. Its purpose is to improve risk management, incident reporting, and resilience against cyber threats.

NIST Cybersecurity Framework

A voluntary, risk-based NIST framework that organizes cybersecurity around outcomes. In version 2.0 (2024) it has six functions: Govern, Identify, Protect, Detect, Respond and Recover.

NOC (Network Operations Center)

A center where a team watches over networks, servers, and services around the clock — keeping them available and performing well, and handling outages.

North-South vs East-West Traffic

Directions of network data flow: North-South crosses the network edge (client–server), while East-West moves horizontally inside, between servers and services.

NPM (Network Performance Monitoring)

Continuous measurement of network performance, availability, and quality — latency, packet loss, jitter, throughput — using SNMP, flow data, packets, and synthetic tests.

NSEL (NetFlow Secure Event Logging)

How a Cisco ASA firewall sends traffic data, based on NetFlow v9 and event-driven: records are created when a flow is set up, torn down, or denied.

NSM (Network Security Monitoring)

Collecting and analyzing network traffic data (full content, session, transaction, alert) to detect and respond to intrusions, on the assumption that prevention sometimes fails.

On-premise / Cloud / Hybrid

Three ways to run IT infrastructure, differing in who owns the hardware, how costs are counted (CAPEX/OPEX), how much control you keep, scaling, and how security responsibility is divided.

OWASP Top 10

An OWASP Foundation list of the ten most serious types of web application security risks, used as a reference point for secure coding and testing.

Packet Loss (Utrata pakietów)

When some sent packets never reach their destination; measured as a percentage, it triggers TCP retransmissions and degrades VoIP and video quality.

Password Spraying

Password spraying is a cyberattack that tries one common password across many user accounts to bypass detection systems.

PCI-DSS

Payment card data security standard (PCI SSC): 12 requirements across 6 goals, protecting cardholder data at merchants and service providers. Current version: v4.0.1.

Phishing

Phishing attacks can be difficult to detect. However, there are steps you can take to protect yourself from phishing attacks.

Port Scanning

A method of detecting vulnerable nodes in a network by accessing different ports on a host or same port on different hosts.

Principle of Least Privilege

A cybersecurity principle limiting user access to essential functions, minimizing risks, and safeguarding sensitive data.

Privilege Escalation

Privilege escalation is an attack where an attacker gains higher-level system access than authorized, exploiting vulnerabilities or misconfigurations.

Privileged Access Management (PAM)

Tools and processes that protect and monitor accounts with elevated permissions: a password vault, least privilege, just-in-time access and session recording.

Probe (Sonda)

A device or program that watches network traffic at a given point and forwards flows, metadata, or full packets to monitoring (NPM) and threat-detection (NDR) systems.

Process Doppelgänging

A sophisticated malware injection technique that creates and executes malicious processes without being detected.

Protocol Attack

A protocol attack exploits weaknesses in network protocols like HTTP, TCP, or DNS to overwhelm system resources and disrupt service availability.

QUIC

A UDP-based transport protocol with built-in TLS 1.3 encryption. It sets up the connection and encryption in one step, carries many streams at once, and survives network changes; the basis of HTTP/3.

Ransomware

Malicious software that encrypts files and demands payment for decryption, blocking access to critical data until ransom is paid.

Rate Limiting

Mechanism that caps how many requests a single client may send within a time window; once exceeded, requests are rejected (HTTP 429) or delayed, protecting availability and curbing abuse.

RBAC

A security method that assigns permissions to roles rather than individuals, ensuring users only access necessary resources.

Reflection Attack

A network attack in which requests carrying the victim's spoofed IP are sent to reflector servers so their replies flood the target — the basis of DRDoS attacks.

Resource Hijacking

Attack (MITRE ATT&CK T1496) in which an adversary uses a compromised system's compute, bandwidth, or services for their own tasks — from cryptojacking to LLMjacking.

REST API

A way for applications to exchange data over HTTP in the REST style: each resource has its own address, you use GET/POST/PUT/DELETE methods, and the server keeps no session.