Generated by Rank Math SEO, this is an llms.txt file designed to help LLMs better understand and index this website. # Sycope ## Sitemaps - [XML Sitemap](https://www.sycope.com/sitemap_index.xml): Includes all crawlable and indexable pages. ## Posts - [Sycope and Energy Logserver join forces to support incident investigation and response](https://www.sycope.com/post/sycope-and-energy-logserver-join-forces-to-support-incident-investigation-and-response): From an alert to understanding the incident - [Sycope signs strategic partnership with Netmetrix](https://www.sycope.com/post/sycope-signs-strategic-partnership-with-netmetrix): The partnership marks an important milestone in Sycope’s international expansion and strengthens the company’s presence across key Western European and international markets. By combining Sycope’s technology with Netmetrix’s extensive regional reach and expertise, the companies aim to provide organizations with greater visibility, control, and security across increasingly complex IT environments. - [Sycope and CMDBuild](https://www.sycope.com/post/sycope-and-cmdbuild): Both platforms expose APIs that can be used to exchange selected information. Sycope provides an API library for integrations without dedicated templates, including NQL queries and methods for working with Lookup data. CMDBuild provides REST web services for reading and writing information stored in the CMDB.  - [Sycope Network Checks in Nagios](https://www.sycope.com/post/sycope-network-checks-in-nagios): The two platforms can be connected through the Sycope API and the Nagios plugin mechanism. A custom Nagios plugin can query Sycope for selected network information, evaluate the returned data and present the result as a standard Nagios service state.  - [Check Point NetFlow in Sycope](https://www.sycope.com/post/check-point-netflow-in-sycope): By configuring Sycope as a flow collector in Gaia, organizations can use their existing Check Point infrastructure as a source of network telemetry for continuous monitoring and historical analysis.  - [Palo Alto Networks Flow Data in Sycope](https://www.sycope.com/post/palo-alto-networks-flow-data-in-sycope): By configuring Sycope as a NetFlow collector in PAN-OS, organizations can use their existing Palo Alto Networks infrastructure as a source of data for continuous network monitoring and historical analysis.  - [FortiGate flow data in Sycope](https://www.sycope.com/post/fortigate-flow-data-in-sycope): By configuring Sycope as a NetFlow collector for FortiGate, organizations can use data already generated by their firewall infrastructure as a source for continuous network analysis.  - [Sycope alerts in Energy Logserver](https://www.sycope.com/post/sycope-alerts-in-energy-logserver): Sycope supports Syslog as an External Destination and provides a CEF encoder for standardized event formatting. Energy Logserver can receive CEF-formatted data over TCP, creating a direct path for forwarding selected Sycope alerts into the central event environment.  - [Sycope alerts in Elasticsearch](https://www.sycope.com/post/sycope-alerts-in-elasticsearch): Sycope supports REST-based External Destinations that can send alert information to third-party HTTP endpoints. Elasticsearch exposes REST APIs for indexing JSON documents, creating a straightforward integration path between the two systems.  - [Sycope alerts in Microsoft Teams](https://www.sycope.com/post/sycope-alerts-in-microsoft-teams): The integration connects these environments through Microsoft Power Automate. Sycope sends alert data to a webhook, Power Automate processes the received information and publishes it in the selected Teams channel as an Adaptive Card.  - [Sycope alerts in Discord](https://www.sycope.com/post/sycope-alerts-in-discord): By combining Sycope’s REST-based External Destinations with a Discord webhook, selected alerts can be delivered automatically to a channel used by the responsible team.  - [Sycope alerts in IBM QRadar](https://www.sycope.com/post/sycope-alerts-in-ibm-qradar): Sycope can forward selected alerts through Syslog and encode them in Common Event Format (CEF). QRadar supports CEF-formatted events through its Universal CEF DSM, providing a standard path for adding Sycope detections to the SIEM event stream.  - [Sycope alerts in Splunk](https://www.sycope.com/post/sycope-alerts-in-splunk): Sycope supports External Destinations based on REST, allowing selected alerts to be sent to third-party HTTP endpoints manually or automatically as part of a rule action. Splunk provides the HTTP Event Collector (HEC) for receiving events over HTTP or HTTPS.  - [Sycope and SecureVisio join forces to bring network intelligence into SIEM operations](https://www.sycope.com/post/sycope-and-securevisio-join-forces-to-bring-network-intelligence-into-siem-operations): Sycope alerts are automatically transferred to SecureVisio through a dedicated connector. They are normalized, processed and correlated with information already available in the SIEM, including asset criticality, user behavior, risk level and business context.  - [Passive vs active inventory — why network scanning alone is not enough](https://www.sycope.com/post/passive-vs-active-inventory-why-network-scanning-alone-is-not-enough): Once passive discovery mechanisms are enabled, organizations frequently identify additional assets. In some cases, the difference amounts to several or even more than ten percent compared with the official inventory. These assets may include undocumented printers, laptops connected “just for a moment,” test devices, private computers, or equipment used by external implementation teams. - [The network never lies: catching attackers who already bypassed the firewall](https://www.sycope.com/post/the-network-never-lies-catching-attackers-who-already-bypassed-the-firewall): This is where lateral movement detection becomes critical. After initial access, attackers rarely move directly to their final objective. They explore the environment, identify valuable systems, reuse credentials, test access paths, move from workstation to server, and establish communication channels that blend into normal traffic. Much of this activity can happen after the firewall has already done its job according to policy: it allowed legitimate-looking traffic from a trusted internal source.  - [The hidden attacker in your OT network: the case for flow-based detection](https://www.sycope.com/post/the-hidden-attacker-in-your-ot-network-the-case-for-flow-based-detection): This is one of the reasons why OT network threat detection is different from standard IT security monitoring. In an office network, a new endpoint agent, vulnerability scanner or active discovery tool may be treated as a normal part of the security stack. In an OT environment, the same approach can introduce operational risk. A fragile controller, legacy engineering workstation or unmanaged industrial device may not tolerate unexpected traffic, software changes or aggressive probing.  - [From alert to evidence: reconstructing an attack with NetFlow](https://www.sycope.com/post/from-alert-to-evidence-reconstructing-an-attack-with-netflow): That reconstruction is one of the most important parts of incident response. The team needs to determine when the suspicious activity started, which system was involved first, how the attacker communicated with the environment, whether lateral movement occurred, which systems were reached, and whether data left the organization. These findings have to be supported by evidence that can be reviewed, challenged and correlated with other sources. - [LinkSense architecture: why agent–server, Rust and SQLite](https://www.sycope.com/post/linksense-architecture-why-agent-server-rust-and-sqlite): In the first article, we showed what LinkSense is — a lightweight, open-source synthetic monitoring tool. Here, we go one level deeper, into architectural decisions. Because in this project, almost every choice — from the communication model, through the programming language, to the database format — results from a specific problem, not from a trend. - [How to analyze network incidents with PCAP?](https://www.sycope.com/post/how-to-analyze-network-incidents-with-pcap): Network incident analysis often starts with an alert, but it very rarely ends there. - [Webinar: An attack’s in progress, can your team see it?](https://www.sycope.com/post/webinar-an-attacks-in-progress-can-your-team-see-it) - [Webinar: Threats don’t always make noise](https://www.sycope.com/post/webinar-threats-dont-always-make-noise) - [Webinar: NIS2 in Romania: How to achieve visibility and compliance?](https://www.sycope.com/post/webinar-nis2-in-romania-how-to-achieve-visibility-and-compliance) - [Sycope System Guide, part 3: Raw data](https://www.sycope.com/post/sycope-system-guide-part-3-raw-data) - [Sycope System Guide, part 2: Home & dashboards](https://www.sycope.com/post/sycope-system-guide-part-2-home-dashboards) - [LinkSense: a lightweight, open-source synthetic monitoring tool from the Sycope team](https://www.sycope.com/post/linksense-a-lightweight-open-source-synthetic-monitoring-tool-from-the-sycope-team): This exact observation led to the creation of LinkSense — a lightweight, open-source synthetic monitoring tool developed by the Sycope team. - [NIS2 starts with visibility — what the directive really requires from monitoring](https://www.sycope.com/post/nis2-starts-with-visibility-what-the-directive-really-requires-from-monitoring): NIS2 is an EU directive that introduces minimum cybersecurity requirements for organizations operating in sectors that are important for the economy and the functioning of society. - [Sycope + Jira: network alerts immediately turned into tickets and incidents](https://www.sycope.com/post/sycope-jira-network-alerts-immediately-turned-into-tickets-and-incidents): The integration connects these two areas by allowing Sycope alerts to create Jira incidents automatically or manually. A ticket can contain information about the detected event together with links that lead directly back to the relevant alert and related events in Sycope.  - [Sycope launches version 3.2 with advanced detection, expanded integrations and enhanced automation](https://www.sycope.com/post/sycope-launches-version-3-2-with-advanced-detection-expanded-integrations-and-enhanced-automation): Sycope 3.2 introduces new capabilities that significantly improve visibility into system integrations and automated workflows. A new REST Audit Stream provides a complete history of API interactions, allowing organizations to track all requests and responses across external integrations. Additionally, the Alert API Response Collector enables tracking of responses from external systems triggered by alerts, offering greater transparency and validation of automated actions. These enhancements improve troubleshooting, compliance, and overall observability of integration-driven environments. - [Sycope S.A. and PacketFront Software Partner to Enhance Network Cybersecurity and Orchestration](https://www.sycope.com/post/sycope-s-a-and-packetfront-software-partner-to-enhance-network-cybersecurity-and-orchestration): Under this partnership, Sycope and PacketFront Software customers will benefit from advanced security analytics seamlessly integrated into automated multi-vendor network management solutions. This joint offering proactively meets the growing market need for real-time protection against cybersecurity events in network environments. - [How to use a multi-layered approach in the cybersecurity strategy](https://www.sycope.com/post/how-to-use-a-multi-layered-approach-in-the-cybersecurity-strategy): Download now and protect your network from advanced threats! - [How to detect unknown devices in the network?](https://www.sycope.com/post/how-to-detect-unknown-devices-in-the-network): The problem is that the traditional approach to identifying hosts in the network – based on active scans or agents installed on systems – does not provide full visibility of the environment. As a result, some devices remain outside IT management processes, security monitoring, and network access control. - [Webinar: How LinkSense delivers lightweight open source synthetic monitoring](https://www.sycope.com/post/how-linksense-delivers-lightweight-open-source-synthetic-monitoring): The webinar is hosted by Sycope experts behind the LinkSense project — Maciej Wilamowski (CIO) and Marcin Kaźmierczak (Solution Architect). - [What is a DDoS attack and how to defend against it in 2026](https://www.sycope.com/post/what-is-a-ddos-attack-and-how-to-defend-against-it-in-2025): A DDoS attack (Distributed Denial of Service) is one of the most dangerous forms of cyberattack, consisting of overloading network infrastructure, a server, or an application with massively generated traffic. In practice, this means that legitimate users cannot access services because the system’s resources are “flooded” with artificially generated requests. - [One step closer to zero-configuration Sycope: phpIPAM integration (Hosts & Subnets)](https://www.sycope.com/post/one-step-closer-to-zero-configuration-sycope-phpipam-integration-hosts-subnets): The integration connects these two areas by automatically synchronizing phpIPAM inventory with the primary Hosts & Subnets Lookup in Sycope. This allows information already maintained in the IPAM system to be reused across Sycope without recreating the same host and subnet structure manually.  - [Compliance and regulation with Sycope](https://www.sycope.com/post/compliance-and-regulation-with-sycope): Sycope enables organizations in critical sectors — energy, finance, telecommunications, public administration, and large enterprises — to meet these requirements through real-time network observability based on factual traffic data. - [Sycope System Guide, part 1: Interface, core concepts & workflows](https://www.sycope.com/post/sycope-system-guide-part-1-interface-core-concepts-workflows) - [Webinar: Smarter networks start here! Why and how you can use network automation in your IT network](https://www.sycope.com/post/webinar-smarter-networks-start-here-why-and-how-you-can-use-network-automation-in-your-it-network) - [Webinar: Achieve faster incident response with Sycope’s NDR capabilities](https://www.sycope.com/post/webinar-achieve-faster-incident-response-with-sycopes-ndr-capabilities) - [Golden Ticket attack – detecting Kerberos attacks and securing Active Directory](https://www.sycope.com/post/golden-ticket-attack-detecting-kerberos-attacks-and-securing-active-directory-2): The attack mechanism is based on stealing the hash of the KRBTGT account, which in the Kerberos infrastructure serves as the master key used to sign all Ticket Granting Tickets (TGTs). With this hash in hand, the attacker can generate a properly signed Kerberos ticket entirely offline, assigning it any identity, privilege level, and lifetime – even up to ten years. Although such a ticket is forged, it is fully valid from the system’s perspective because cryptographically everything checks out. - [IDOR vulnerability – how to detect an attack on web applications through HTTP traffic analysis](https://www.sycope.com/post/idor-vulnerability-how-to-detect-an-attack-on-web-applications-through-http-traffic-analysis): This vulnerability appears when a system does not verify user permissions for a specific resource on the server side but merely assumes that any request coming from a logged-in account is valid. As a result, an attacker can manipulate object identifiers — for example, in the URL or the HTTP request body — and gain access to data they do not own. A classic example is the address /invoice.php?id=123, where changing the value of id to 124 allows viewing someone else’s invoice. - [Zero Trust architecture – the role of network visibility and microsegmentation in security](https://www.sycope.com/post/zero-trust-architecture-the-role-of-network-visibility-and-microsegmentation-in-security): Zero Trust is a security model based on the principle of never trusting any user or device by default — even if they are inside the organization’s network. Every access request must be continuously verified based on identity, context, and risk level. This approach limits an attacker’s ability to move within the network and reduces the impact of potential security breaches. - [ARP spoofing – how to detect a Man-in-the-Middle attack and ARP poisoning in a LAN network](https://www.sycope.com/post/arp-spoofing-how-to-detect-a-man-in-the-middle-attack-and-arp-poisoning-in-a-lan-network): ARP spoofing is an attack in a local network in which an attacker impersonates another device by sending falsified ARP messages in order to intercept network traffic between a user and, for example, the network gateway. This allows the attacker to eavesdrop on, modify, or block transmitted data. The technique is commonly used in Man-in-the-Middle attacks within LAN environments. - [Strategic partnership with Advatech](https://www.sycope.com/post/strategic-partnership-with-advatech): Advatech, founded in 1998, specializes in IT system integration with a strong focus on storage infrastructure, virtualization, and cybersecurity. With decades of experience, the company has established itself as a trusted partner for both enterprise and public sector clients looking to modernize and secure their IT environments. - [NDR vs SIEM vs XDR – differences NDR XDR, NDR vs SIEM and choosing a network monitoring system](https://www.sycope.com/post/ndr-vs-siem-vs-xdr-differences-ndr-xdr-ndr-vs-siem-and-choosing-a-network-monitoring-system): Each of these tools has a different DNA — to simplify: SIEM relies on logs, NDR focuses on traffic analysis, and XDR brings together data from multiple sources. Together, they form an ecosystem that can provide full visibility and faster incident response. - [DNS errors and DNS security – DNSSEC, protection against DNS attacks and DNS management errors](https://www.sycope.com/post/dns-errors-and-dns-security-dnssec-protection-against-dns-attacks-and-dns-management-errors): The Domain Name System (DNS) is the backbone of the Internet. Every user connection to an application, service, or cloud platform begins with translating a human-friendly domain name into an IP address. Without this process, all domain-based communication would come to a halt. This makes DNS both a critical point for availability and a vector of risk in security. - [Network monitoring and network visibility – traffic analysis as the foundation of cybersecurity visibility](https://www.sycope.com/post/network-monitoring-and-network-visibility-traffic-analysis-as-the-foundation-of-cybersecurity-visibility): Network monitoring is the foundation of managing modern IT infrastructure. It is the process of continuously tracking, recording, and analyzing activity in the network, giving organizations the ability to effectively respond to failures and cyber threats. - [Network configuration errors – how to avoid them and improve router configuration](https://www.sycope.com/post/network-configuration-errors-how-to-avoid-them-and-improve-router-configuration): At first glance, network configuration errors might seem like small mistakes made by administrators: a misconfigured port, an incorrect firewall rule, or a default user account left unchanged. In practice, however, these exact mistakes are among the main vulnerabilities exploited by cybercriminals. According to ENISA and Gartner reports, over 40% of major security incidents were not caused by sophisticated exploits but by simple network errors. - [How Sycope helps detect and stop DDoS attacks](https://www.sycope.com/post/how-sycope-helps-detect-and-stop-ddos-attacks): A DDoS attack is like a sudden wave that can paralyze even the best-designed infrastructure in a short time. The key element of defense is not just firewalls or filters, but full visibility of network traffic. Without it, it is difficult to distinguish natural growth in service popularity from the first symptoms of an attack – and it is response time that determines the scale of potential losses. - [Integrating Sycope with Slack using webhooks](https://www.sycope.com/post/integrating-sycope-with-slack-using-webhooks): Messages can include information such as the alert name, rule type, severity, timestamp, client and server IP addresses, together with a direct link to the corresponding alert in Sycope.  - [Advanced methods of protection against DDoS attacks in companies](https://www.sycope.com/post/advanced-methods-of-protection-against-ddos-attacks-in-companies): A dozen or so years ago, DDoS protection came down to simple mechanisms: blocking traffic from a single IP address, applying basic firewall rules, or limiting the number of connections (rate limiting). For the attacks of that time – usually carried out from single computers or small botnets – such an approach was in many cases sufficient. - [Integration architecture: NetFlow analytics + network automation](https://www.sycope.com/post/integration-architecture-netflow-analytics-network-automation): Successful flow-driven automation requires tight integration between network observability platforms and orchestration engines. Key architectural components include:   - [Network automation: From single scripts to multi-component orchestration](https://www.sycope.com/post/network-automation-from-single-scripts-to-multi-component-orchestration): Organizations take an average of 292 days to detect and contain a breach, giving attackers nearly nine months to establish persistence and move laterally. Traditional manual incident response processes prove inadequate against modern threats. Studies indicate that 98% of organizations report that a single hour of downtime costs over $100,000, with 81% indicating that 60 minutes of downtime results in losses exceeding $300,000.  - [Automate or stagnate: The new network reality](https://www.sycope.com/post/automate-or-stagnate-the-new-network-reality): Gartner reports that 95% of network outages are caused by human error, with the average cost of network downtime reaching $5,600 per minute for enterprise organizations. IBM's Cost of a Data Breach Report 2023 found that organizations with fully deployed security automation experienced breach costs that were $1.76 million lower than those without such capabilities.  - [Controlling Hybrid Networks Through Automatic Inventory of Resources](https://www.sycope.com/post/controlling-hybrid-networks-through-automatic-inventory-of-resources): What you'll learn from this white paper: - [Enhance your security monitoring with MITRE ATT&CK](https://www.sycope.com/post/enhance-your-security-monitoring-with-mitre-attck): What will you learn? - [Sycope Signed a Distribution Agreement with Elcore](https://www.sycope.com/post/distribution-agreement-with-elcore): By adding Sycope to its cybersecurity portfolio, Elcore enhances its capabilities in delivering tools for network traffic analysis, security threat detection, and performance monitoring, thereby helping organizations increase visibility and control over their IT infrastructure.  - [Sycope 3.1. release webinar](https://www.sycope.com/post/sycope-3-1-release-webinar): What will you learn during the webinar? - [Sycope Launches Version 3.1 with powerful Sycope API, upgraded security, and streamlined user experience](https://www.sycope.com/post/sycope-launches-version-3-1-with-powerful-sycope-api-upgraded-security-and-streamlined-user-experience): Key highlights of Sycope 3.1 including among others: - [Suricata alerts in Sycope](https://www.sycope.com/post/suricata-alerts-in-sycope): The integration brings selected Suricata alert and anomaly events into Sycope, where they can be searched, visualized and correlated with network data already available in the platform.  - [Enhancing Network Visibility: Zabbix Integration with Sycope Made Easy](https://www.sycope.com/post/enhancing-network-visibility-zabbix-integration-with-sycope-made-easy): The integration connects these perspectives in both directions. Statistics and inventory information collected by Zabbix can be synchronized with Sycope and analyzed alongside network traffic. At the same time, Sycope can provide network, security, performance and asset information directly to Zabbix as native monitoring items, triggers, graphs and dashboards.  - [New release Sycope v 2.3](https://www.sycope.com/post/new-release-sycope-v-2-3): User Scripts - [Out-of-the Box Network Performance Monitoring](https://www.sycope.com/post/out-of-the-box-network-performance-monitoring): The Sycope Probe measures server network time, client network time, initial server response time, client retransmissions and server retransmissions, in terms of Bytes, Packets and % of Packets. The Probe needs to see 100% of the traffic on the network link, and the only way to do that is by using a Network TAP. Using a SPAN port as an alternative access method, will likely drop packets if the link becomes oversubscribed, causing the Sycope Probe to miss out on key network data. - [Discover Sycope 2.4 Today](https://www.sycope.com/post/discover-sycope-2-4-today): In today's dynamic IT landscape, businesses grapple with the need for efficient and intuitive IT management tools. Sycope 2.4 is here to meet that demand head-on. - [Sycope S.A. signs distributor agreement with TESLAKOM A.Ş](https://www.sycope.com/post/sycope-s-a-signs-distributor-agreement-with-teslakom-a-s): This strategic alliance aims to expand the reach of Sycope's innovative technologies in the Turkish market. Teslakom, with over fifteen years of experience, excels in sales, telecommunications access services, project preparation, installation, maintenance, and professional technical support. Operating from its offices in Istanbul and Ankara, Teslakom has established itself as a key player in the industry. - [New partnership with Garland for full network visibility and security](https://www.sycope.com/post/new-partnership-with-garland-for-full-network-visibility-and-security): Sycope has teamed up with Garland Technology to ensure network performance monitoring solution receives every bit, byte and packet of data from key points in the network. Garland Technology can support Sycope in analysing network traffic and detecting violation of security rules. - [New distributor agreement with Nuvola based in the UK](https://www.sycope.com/post/new-distributor-agreement-with-nuvola-based-in-the-uk): Nuvola Distribution is a global Technology and Services Distributor with offices and logistics centers throughout Europe. The company was founded in 2010 and today has a strong presence in the region. The distributor provides Partner Reseller services, offering fully integrated IT solutions for their customers. - [New technology partnership with Profitap](https://www.sycope.com/post/new-technology-partnership-with-profitap): Sycope has teamed up with Profitap to ensure a network performance monitoring solution receives every bit, byte and packet of data from key points in the network. Profitap can support Sycope in analysing network traffic and detecting violation of security rules. - [Sycope partner up with Billon Group Ltd, creator of the Blockchain Platform](https://www.sycope.com/post/sycope-partner-up-with-billon-group-ltd-creator-of-the-blockchain-platform): Sycope S.A. partner up with Billon Group Ltd, creator of the Unified Blockchain Platform, have signed a Technology Partnership Agreement. Under this partnership, Sycope SA’s customers will be able to access the Billon platform – allowing them to store, share, validate and attest any or selected information, documents or data-sets utilized in the execution of cybersecurity processes. - [What is NetFlow and how is this protocol used in practise?](https://www.sycope.com/post/what-is-netflow-and-how-is-this-protocol-used-in-practise): Network visibility begins with understanding how traffic data is recorded and processed. NetFlow doesn’t analyze individual packets—its strength lies in grouping them into a logical unit called a flow. This allows administrators to look at traffic from the perspective of communication between systems rather than a chaotic stream of packets. - [New technology partner on board – macmon secure GmbH](https://www.sycope.com/post/new-technology-partner-on-board-macmon-secure-gmbh): Since 2003, macmon secure has been offering infrastructure manufacturer agnostic solutions that protect heterogeneous networks from unauthorized access thanks to instant network visibility. macmon NAC is implemented quickly and easily, with significant added value for network security. macmon NAC is a user-friendly tool that provides numerous features such as Advanced Security, Compliance,802.1X, Guest Service, VLAN Manager, Topology, Switch Viewer, Past Viewer and more. - [New distribution agreement with Softprom](https://www.sycope.com/post/new-distribution-agreement-with-softprom): Softprom is a leading IT Distributor in Eastern & Central Europe, and the CIS with a portfolio of more than one hundred vendors and trusted by more than 1200 partners. The company was founded in 1999 and today is represented in more than 30 countries. - [Sycope S.A. signs distributor agreement with Looptech Co.](https://www.sycope.com/post/sycope-signs-distributor-agreement-with-looptech-to-expand-in-gcc-countries-and-the-middle-east): Sycope S.A. has built a reputation for pioneering innovative technologies designed to enhance network security and performance. Looptech Co., on the other hand, has established itself as a trusted name in the cybersecurity industry. The company is known for developing unique and unparalleled cybersecurity solutions tailored to meet the diverse needs of its clients. - [Detecting resources and their connections based on NetFlow clients, servers, applications, and other network elements](https://www.sycope.com/post/detecting-resources-and-their-connections-based-on-netflow-clients-servers-applications-and-other-network-elements): Sycope can monitor, group, and sort all these parameters automatically. - [How to use multi-layered approach in the cybersecurity strategy](https://www.sycope.com/post/how-to-use-multi-layered-approach-in-the-cybersecurity-strategy): Intrusion Detection and Prevention Systems (IDS/IPS) are critical for monitoring network traffic to identify and mitigate malicious activity. While IDS focuses on alerting security teams about suspicious behavior, IPS takes it a step further by automatically blocking threats in real-time. These systems primarily rely on signature-based detection to identify known threats. - [Controlling hybrid networks through automatic inventory of resources, applications, and their connections](https://www.sycope.com/post/controlling-hybrid-networks-through-automatic-inventory-of-resources-applications-and-their-connections): The first environment is an internal network, divided into several geographical locations. Each location is independent, with its own network structure. The datacenter is located in the main office and, in addition to supporting several key services for employees such as email and shared network drive, also supports the ability to log into the ticket system by end customers. The ticket system is connected via a dedicated link with Internet access. The datacenter also has a closed DMZ network for critical applications. - [Root cause analysis for increased traffic from another country](https://www.sycope.com/post/root-cause-analysis-for-increased-traffic-from-another-country): With Sycope’s Trend Dashboards, you gain the power to analyze aggregated streams effortlessly, even over extended time spans. From customizing time frames to drilling down into unexpected traffic spikes, this guide will walk you through the steps to master your network insights. Let’s dive into the details and discover how to make smarter, data-driven decisions for your IT infrastructure. - [Deploying Sycope in Proxmox Virtual Environment](https://www.sycope.com/post/deploying-sycope-in-proxmox-virtual-environment): Sycope software is provided as the Virtual Appliance, meaning that the user is not required to provide any operating system or a database instance. All the monitoring and security features as well as the proprietary database are embedded within the appliance itself. Sycope Team is working to improve, adding new features and supporting the latest standards. The appliance is currently available in OVA template, which is officially supported with VMware Virtualization Platform. - [New release Sycope 3.0](https://www.sycope.com/post/new-release-sycope-3-0): 1. Hundred new dashboards out of the box for data analysis organized into three categories - [Leveraging the nTop nDPI for Application Visibility within Sycope/nProbe integration](https://www.sycope.com/post/leveraging-the-ntop-ndpi-for-application-visibility): Thanks to the close understanding of NetFlow protocol developer’s team of Sycope provide close integration with nTop's nProbe solution, that could provide visibility into Layer 7. - [Multitenancy in Sycope](https://www.sycope.com/post/multitenancy-in-sycope): Master admins can grant access for local clients’ admins via RBAC functionality if necessary. - [How to detect network artifacts related to APT28 in Sycope?](https://www.sycope.com/post/how-to-detect-network-artifacts-related-to-apt28-in-sycope): The group has been implicated in various high-profile cyber campaigns targeting governmental, military, diplomatic, defence industry, and non-governmental organizations across the world. Additionally, this group primarily engages in cyber-espionage activities, seeking to gather intelligence and sensitive information from targeted organizations. Their focus extends to political, military, and economic targets. The group conducts highly targeted and persistent attacks against specific entities, often tailoring their tactics, techniques, and procedures (TTPs) to the characteristics of the target. APT28 is known for using advanced and sophisticated techniques, including zero-day exploits, custom malware, social engineering, and phishing campaigns. They continuously evolve their tools and methods to avoid detection. - [Integrating Sycope Audit Logs with SIEM for Enhanced Compliance and Monitoring](https://www.sycope.com/post/integrating-sycope-audit-logs-with-siem-for-enhanced-compliance-and-monitoring): All information in Sycope regarding both collected data form NetFlow plus Security module alerts, system notifications and audit logs are stored in proprietary Sycope database, divided into separate collections called data streams. Data within data stream can be access by proprietary query language - NQL. Using API, via Postman or an external script for example utilizing Python, we may use NQL to request data from data stream called "audit log", that stores information about system and user actions and send them to IP address of SIEM as a json file. - [NPM and NDR: Complementary Tools for Network Security and Performance](https://www.sycope.com/post/npm-and-ndr-complementary-tools): NPM is akin to the vigilant sentinel of your network landscape, keeping a steady eye on the performance of network devices and applications. It collates data on network traffic, bandwidth usage, and response times. This information becomes the bedrock for identifying and troubleshooting potential performance issues. - [Analysis of security events in Sycope NSM](https://www.sycope.com/post/analysis-of-security-events-in-sycope-nsm): Each NDR class system should encompass functionalities that facilitate the incident handling process - from detection to mitigation and collection of evidence. Sycope was designed to cover all stages of security incident handling process. - [The rise of the Tech Guardians: how network monitoring tools secure your network](https://www.sycope.com/post/the-rise-of-the-tech-guardians-how-network-monitoring-tools-secure-your-network): Network monitoring tools are specialized software applications designed to oversee and analyze network activities, infrastructure, and performance. They provide real-time insights into the health and efficiency of an organization's network, enabling IT teams to proactively identify and resolve issues. - [Why do I need NetFlow?](https://www.sycope.com/post/why-do-i-need-netflow): NetFlow is a protocol developed by Cisco Systems, now known as standards v5, v9, IPFIX and others. It works on IP devices (routers, layer three switches) and provides statistics about IP traffic. Nowadays many manufacturers have adopted this standard. - [How to view original flows related to a given alert?](https://www.sycope.com/post/how-to-view-original-flows-related-to-a-given-alert): To view the original flows related to a given alert, go to the alerts table tab and select the alert for which you want to obtain raw flows. Then right click on the selected alert and select alert reason details. Raw data. As a result of this operation, a view appeared with a new filter identical to the one defined by the given rule. - [How do you drill down data?](https://www.sycope.com/post/how-do-you-drill-down-data): Drill down is an analytical mechanism that allows you to move from a general, aggregated view of data to more detailed information about a selected element, usually with a single click or a few subsequent analysis steps. The user starts from a summary view and then gradually goes deeper into the data to see what exactly is behind the observed value, anomaly, or trend. - [How to identify a brute force attack?](https://www.sycope.com/post/how-to-identify-a-brute-force-attack): A brute force attack is a type of cyberattack in which an attacker tries to gain access to a system or account by repeatedly trying different passwords or usernames. - [Utilizing ready-to-use system elements for smooth operations](https://www.sycope.com/post/utilizing-ready-to-use-system-elements-for-smooth-operations): There is a number of built-in elements ready to use after installation, although most of the objects, are global, a few of them will be licensed dependent. So please keep in mind if something you see here is missing, you probably need a security or performance license. - [Data Deduplication and NetFlow: How to Save Storage Space and Improve Data Analysis](https://www.sycope.com/post/how-to-save-storage-space-and-improve-data-analysis): In Sycope, the deduplication mechanism is used to remove duplicated flows from multiple sources, allowing for the accurate presentation of traffic volume and the display of traffic paths based on NetFlow data. This can help organizations better understand their network usage and performance and make informed decisions about optimizing their network. Organizations can save storage space and improve their data analysis efficiency by using data deduplication to manage their NetFlow data, helping them gain a competitive advantage in today’s data-driven world. - [How to monitor encrypted traffic in Sycope?](https://www.sycope.com/post/how-to-monitor-encrypted-traffic-in-sycope): These indicators may include IP addresses, hostnames, URLs, file hashes, geolocations (ASNs, countries), e-mail accounts, user agents, and many others. Among the commonly used indicators, one deserves special attention: JA3 TLS fingerprint. JA3 is a tool for fingerprinting TLS connections based on options specified during the negotiation of TLS sessions. Based on these fingerprints, specific applications as well as malware can be detected. - [The cyberattacks – reminder of the importance of network monitoring and security](https://www.sycope.com/post/the-cyberattacks-reminder-of-the-importance-of-network-monitoring-and-security): With each passing day, new methods of attacks are being developed, making it increasingly challenging to protect against them  (how to detect network IoCs). As a result, cybersecurity has become a top priority for organizations and individuals alike. The consequences of a successful cyberattack can be severe, ranging from financial loss to reputational damage and even legal repercussions. It is essential to stay informed about the latest trends in cybersecurity and take the necessary measures to safeguard against potential threats. - [How to detect network IoCs (URLs, Domains and IPs) in context of SNOWYAMBER, HALFRIG and QUARTERRIG in Sycope NSM?](https://www.sycope.com/post/how-to-detect-network-iocs-urls-domains-and-ips-in-context-of-snowyamber-halfrig-and-quarterrig-in-sycope-nsm): As we read in the information published: - [Data role-based access control (RBAC) do you need that?](https://www.sycope.com/post/data-role-based-access-control-racb-do-you-need-that): Data role-based access control (data RBAC): a security model that restricts access to data based on the user's role within the organization. This model provides a flexible and scalable way of enforcing security policies and ensuring that only authorized users can access sensitive data. By limiting access to the UI and data access perspectives, data RBAC helps to mitigate the risk of data breaches and ensure that the privacy and security of the data is maintained. - [2022 was a year for Sycope](https://www.sycope.com/post/2022-was-a-year-for-sycope): February was a month of change for us, we have introduced Sycope 2.0 to the world, that was accompanied by the big event for our partners, distributors and clients.‍ - [How to detect crypto mining in your organization?](https://www.sycope.com/post/how-to-detect-crypto-mining-in-your-organization): Cryptojacking is a situation in which someone uses company computing resources to mine cryptocurrencies without the organization’s consent. In practice, this means launching on a workstation, server, or sometimes in a cloud environment a process whose sole purpose is to perform calculations for a “mining pool” and transmit the results externally. The key word here is “unauthorized” — regardless of whether the activity is carried out by a cybercriminal or an employee who installs a miner on company equipment “just for a while.” - [How historical data insights give us great analytical capabilities](https://www.sycope.com/post/how-historical-data-insights-give-us-great-analytical-capabilities): The first thing we should do is prepare a Widget that will show us the current volume of traffic from and to the countries we want to monitor. A special wizard is used to create Widgets, which will guide you through the entire process, from choosing the method of data presentation, through the selection of data itself and the resolution with which you want to analyse the data. - [Detecting Network Scans using NetFlow](https://www.sycope.com/post/detecting-network-scans-using-netflow): One of the most important stages of network reconnaissance is to scan the network for working devices, running services and existing vulnerabilities. ## Pages - [News](https://www.sycope.com/news) - [Professional services](https://www.sycope.com/professional-services) - [Contact](https://www.sycope.com/contact) - [DNS / MX Lookup](https://www.sycope.com/network-tools/dns-mx-lookup): Check DNS records and mail configuration for a domain. - [Security Headers](https://www.sycope.com/network-tools/security-headers-check): Check which HTTP security headers a site sends and what to improve. - [Port Checker](https://www.sycope.com/network-tools/port-checker): A TCP connection test to a host and port — performed from the server. - [Is the website down?](https://www.sycope.com/network-tools/website-down-checker): The request is made from the server — check whether the site is down globally or just for you. - [What is my IP?](https://www.sycope.com/network-tools/what-is-my-ip): The address seen by the server (not your local LAN address). - [Password Generator](https://www.sycope.com/network-tools/password-generator): The password is created entirely in your browser — it is never sent anywhere. - [Subnet Calculator](https://www.sycope.com/network-tools/subnet-calculator): Network address, broadcast, mask, host range and binary breakdown — for IPv4. - [Network Tools](https://www.sycope.com/network-tools): lanSubnet CalculatorCalculate the network address, broadcast, mask and host range from CIDR notation.Try it >passwordPassword GeneratorStrong, random passwords generated locally in your browser.Try it >my_locationWhat is my IP?Your public IP address as seen by the server + browser details.Try it >monitor_heartIs the website down?Checks website availability with a request from our server — not from your connection.Try it >settings_ethernetPort CheckerChecks whether a TCP port is open on a host — tested from our server.Try it >shieldSecurity HeadersHTTP security headers grade (A+…F) and what to fix.Try it >dnsDNS / MX LookupDNS and mail records: A, AAAA, MX, TXT, NS, SOA, CNAME, SPF, DMARC.Try it > - [Free version TEST](https://www.sycope.com/free-version-test) - [TrueID](https://www.sycope.com/trueid) - [Open source](https://www.sycope.com/open-source) - [Network Observability Platform](https://www.sycope.com/network-observability-platform) - [LinkSense](https://www.sycope.com/linksense) - [Events](https://www.sycope.com/events) - [Pricing](https://www.sycope.com/pricing) - [Free version](https://www.sycope.com/free-version) - [Industries](https://www.sycope.com/industries) - [Use cases](https://www.sycope.com/use-cases) - [Search](https://www.sycope.com/search) - [Asset discovery](https://www.sycope.com/asset-discovery) - [Security](https://www.sycope.com/security) - [Performance](https://www.sycope.com/performance) - [Visibility](https://www.sycope.com/visibility) - [Career](https://www.sycope.com/career) - [Partners](https://www.sycope.com/partners) - [Integrations](https://www.sycope.com/integrations) - [White paper & ebook](https://www.sycope.com/white-paper-ebook) - [About Us](https://www.sycope.com/about) - [Request a demo](https://www.sycope.com/request-a-demo) - [Deal Registration Program](https://www.sycope.com/deal-registration-program) - [Case Studies](https://www.sycope.com/case-studies) - [Resource library](https://www.sycope.com/resources) - [Dictionary](https://www.sycope.com/dictionary) - [Videos](https://www.sycope.com/videos) - [Blog](https://www.sycope.com/blog) - [FAQ](https://www.sycope.com/faq) - [For investors](https://www.sycope.com/for-investors) - [Privacy Policy](https://www.sycope.com/privacy-policy): Sycope, the owner of the www.sycope.com service, makes all possible efforts to protect your privacy. This Privacy Policy is effective from May 25, 2018 for the purpose of transparent, lawful and secure processing of personal data.
The functioning of the Privacy Policy is based on the GDPR, i.e. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard of the processing of personal data and on the free movement of such data and the repeal of Directive 95/46/EC (General Data Protection Regulation), which defines what data and on what terms they are processed. - [Strona główna](https://www.sycope.com/) ## Opinie - [Jan Rześny](https://www.sycope.com/post/opinie/jan-rzesny) - [Marek Barański](https://www.sycope.com/post/opinie/marek-baranski) - [Jakub Toman](https://www.sycope.com/post/opinie/jakub-toman-3) - [Maciej Oziembło](https://www.sycope.com/post/opinie/jakub-toman-2) - [Adam Wójcik](https://www.sycope.com/post/opinie/jakub-toman-4) ## Dictionary - [Zero-Day Exploit](https://www.sycope.com/post/dictionary-item/zero-day-exploit): A zero-day exploit is the code or technique that takes advantage of a software flaw the vendor does not know about. Since the vendor is unaware of it, no patch exists yet to fix it. The name comes from the fact that, when the first attack happens, the vendor has had "zero days" to prepare a fix — the attacker gets there first. The exploit itself is a tool: it turns a theoretical weakness into a real way to take control of a system, steal data, or run malicious code. - [VLAN](https://www.sycope.com/post/dictionary-item/vlan): VLAN (Virtual Local Area Network) is a way to split one physical network into several separate logical networks. The split happens at Layer 2 of the OSI model — at the level of switches, not cables. Devices in different VLANs are kept apart: they cannot "see" each other directly or exchange traffic without a router or a Layer 3 switch. It is a bit like dividing one open-plan office into separate rooms with partitions — everyone is still in the same building, but each team gets its own space. The standard that lets Ethernet frames be tagged with a VLAN number is IEEE 802.1Q. - [TTPs](https://www.sycope.com/post/dictionary-item/ttps): TTPs (Tactics, Techniques, and Procedures) describe how an attacker operates. Instead of focusing on individual traces, TTPs organize an attacker's behavior into three levels: tactics are the goal (the “what” they want to achieve), techniques are the method (the “how” they do it), and procedures are the exact execution (the “how exactly”). This describes the lasting habits of an attacking group rather than fleeting artifacts. That is why TTPs are the most stable and hardest-to-change layer of threat knowledge. The concept is the basis of cyber threat intelligence (CTI), incident response (DFIR), and the MITRE ATT&CK framework. - [Top Talkers](https://www.sycope.com/post/dictionary-item/top-talkers): Top talkers are the hosts, applications, or conversations that generate the most traffic on a network during a given period. They are identified from flow data, collected with NetFlow, IPFIX, sFlow, or J-Flow. This data summarizes traffic by source, destination, protocol, and byte and packet counts — without the cost of recording every packet in full. A top talkers list is usually a table of IP addresses, source–destination conversation pairs, or applications, ranked from the largest down by the data they account for. - [Throughput](https://www.sycope.com/post/dictionary-item/throughput): Throughput is the amount of data that was actually transferred across a link or network path in a given time. It is usually expressed in bits per second (bps, Mbps, Gbps). It is not the same as bandwidth, the theoretical maximum capacity of the link. Bandwidth tells you how much data the link could carry. Throughput tells you how much really got through once you subtract protocol overhead, retransmissions, queuing, and hardware limits. In practice, throughput is always lower than the link's capacity. - [TAXII](https://www.sycope.com/post/dictionary-item/taxii): TAXII (Trusted Automated eXchange of Indicator Information) is a protocol that lets organizations automatically exchange threat information (Cyber Threat Intelligence, or CTI) over a secure HTTPS connection. Put simply: TAXII is a shared language that security tools at different organizations use to pull threat data from one another and pass it along — without sending it by hand over email or as files. TAXII exposes a REST-style API (the interface programs use to talk to each other) and sets out how clients and servers should behave. It is an open standard developed by the OASIS Cyber Threat Intelligence Technical Committee (CTI TC); the current version is TAXII 2.1. - [Syslog](https://www.sycope.com/post/dictionary-item/syslog): Syslog is a standard and protocol that lets devices and applications send event messages (logs) to a single, central place — a collector. Each message describes one event and contains, among other things, a PRI value (encoding the source and severity of the event), a timestamp, a host identifier and the message body. Syslog originated in the 1980s as part of the Sendmail project (created by Eric Allman). It served for years as a de facto standard and was later written down in IETF documents: RFC 3164 (2001, the so-called BSD syslog) and RFC 5424 (2009, a newer, more orderly format). - [STIX](https://www.sycope.com/post/dictionary-item/stix): STIX (Structured Threat Information eXpression) is an open standard for describing and exchanging cyber threat intelligence (CTI). Put simply: it is a shared language and format that lets different security systems record and pass on what they know about threat actors, campaigns, malware, vulnerabilities and indicators of an attack. The same data is understood both by a human and by a machine. In the current STIX 2.1 version, data is written in JSON. - [Software Bill of Materials (SBOM)](https://www.sycope.com/post/dictionary-item/software-bill-of-materials): A Software Bill of Materials (SBOM) is a machine-readable list of every component, library and dependency that a piece of software is built from. Each entry comes with metadata about its origin, version and license. An SBOM works like the ingredients list on a food package: it shows exactly what is inside — including transitive dependencies, that is, components pulled in indirectly by another component. It is the core tool for managing risk in the software supply chain and for quickly finding vulnerable parts. - [Silver Ticket Attack](https://www.sycope.com/post/dictionary-item/silver-ticket-attack): A Silver Ticket attack is a technique used by an attacker who has already gained a foothold in an Active Directory network. It involves forging a Kerberos service ticket (TGS — Ticket-Granting Service, the ticket issued for access to one specific service) and presenting it straight to that service, bypassing the domain controller. The ticket is encrypted with the password of the service account or computer account that owns the service, so the service treats it as genuine. The domain controller (KDC — Key Distribution Center, which normally issues Kerberos tickets) takes no part in this, so it leaves no trace in its logs. That is the main difference from a Golden Ticket attack: a Golden Ticket needs the krbtgt account password and grants control over the whole domain, while a Silver Ticket targets a single service — which makes it much harder to detect. - [Secure Access Service Edge (SASE)](https://www.sycope.com/post/dictionary-item/secure-access-service-edge): SASE (Secure Access Service Edge) is an IT architecture model in which networking and security functions are combined into a single, cloud-delivered service. The service runs at the network edge, close to the user or device. Instead of routing all traffic through a corporate headquarters, SASE inspects it and applies rules at many of the provider's distributed points. Access is decided by the user's identity and context, not by where they sit in the network. - [Scrubbing Center](https://www.sycope.com/post/dictionary-item/scrubbing-center): A scrubbing center is a specialized network facility — your own or cloud-based — to which traffic bound for protected resources is diverted during a DDoS attack. The goal is simple: filter out the malicious packets and pass on only the traffic judged legitimate (so-called clean traffic). The center sits between the internet and the target network like a checkpoint at the entrance: it inspects traffic at the network, transport and application layers, separates anomalies from ordinary sessions, and sends the cleaned packets back, usually over a GRE tunnel or a dedicated link. - [SaaS Security Posture Management (SSPM)](https://www.sycope.com/post/dictionary-item/saas-security-posture-management): SaaS Security Posture Management (SSPM) is a category of tools that continuously check and maintain the security level of SaaS applications — software you use through a browser as a service (such as Microsoft 365, Google Workspace, or Salesforce). The tool connects to each app through its API (the interface programs use to talk to each other) and catches misconfigurations, overly broad permissions, risky integrations, and drift away from a secure baseline. It then shows you how to fix the issue, or fixes it automatically. Unlike tools that watch the network, SSPM looks inside the application itself, not just at the traffic flowing to it. - [SaaS / IaaS / PaaS](https://www.sycope.com/post/dictionary-item/saas-iaas-paas): SaaS, IaaS, and PaaS are the three core cloud service models. They differ in how much of the work the provider takes on and how much stays with the customer. IaaS (Infrastructure as a Service) delivers just the infrastructure: compute, storage, and networking as virtual machines. PaaS (Platform as a Service) adds a ready-made environment for running applications and developer tooling, and takes over operating-system and server management. SaaS (Software as a Service) is a finished application in the browser — the provider handles almost everything except the customer's data and user accounts. - [RTT (Round Trip Time)](https://www.sycope.com/post/dictionary-item/rtt): RTT (Round Trip Time) is the time between sending a packet and getting confirmation that it arrived. It covers the trip to the destination, the moment the receiver handles the packet, and the trip back. RTT is given in milliseconds (ms) and is the basic measure of network latency. - [RTO (Recovery Time Objective)](https://www.sycope.com/post/dictionary-item/rto): RTO (Recovery Time Objective) is the maximum time within which a system, application, or business process must be back up and running after a failure, disaster, or security incident. Past that point, the downtime starts to cause harm the organization cannot afford. RTO is measured forward — from the moment of disruption to the moment service is working again — and is usually stated in minutes, hours, or days. It is one of the two core parameters of a business continuity and disaster recovery (BC/DR) plan, alongside RPO. - [RPO (Recovery Point Objective)](https://www.sycope.com/post/dictionary-item/rpo): RPO (Recovery Point Objective) is the maximum amount of data — measured in time — that an organization is willing to lose after a failure, disaster, or attack. Put plainly: how far back in time must we be able to restore data for the loss to be acceptable? RPO sets the largest allowable "gap" between the last good, recoverable copy and the moment of failure — and that tells us how often backups or replication need to run. - [Root Cause Analysis (RCA)](https://www.sycope.com/post/dictionary-item/root-cause-analysis): Root Cause Analysis (RCA) is a structured way of finding what truly caused a problem or incident — not just its visible symptoms. A root cause is the factor whose removal keeps the problem from coming back. That is different from factors that merely make things worse: fixing those may reduce the impact, but it does not guarantee the failure will not happen again. RCA is built on data — logs, metrics, event timelines, and evidence — not on guesswork. - [RODO / GDPR](https://www.sycope.com/post/dictionary-item/rodo-gdpr): GDPR (General Data Protection Regulation), known in Poland as RODO (Rozporządzenie o Ochronie Danych Osobowych), is EU Regulation 2016/679 that sets out how organisations may collect and use people's personal data. The European Parliament adopted it on 27 April 2016, and it has applied since 25 May 2018 across all EU member states. As a regulation it applies directly — it does not need to be rewritten into national law, although countries may add their own clarifications (in Poland, the 2018 Personal Data Protection Act). - [REST API](https://www.sycope.com/post/dictionary-item/rest-api): A REST API (Representational State Transfer Application Programming Interface) is a way for two applications to talk to each other over a network. A client (for example, an app running in a browser) and a server exchange data using HTTP — the same protocol that loads web pages. Each piece of data, called a resource, has its own address (a URI), and to act on it you use a few standard HTTP commands: GET (read), POST (create), PUT and PATCH (change), and DELETE (remove). The communication is stateless: every request carries everything the server needs, and the server does not remember previous requests. An interface is called "RESTful" only when it follows the rules of the REST style — using HTTP and JSON alone is not enough. - [Resource Hijacking](https://www.sycope.com/post/dictionary-item/resource-hijacking): Resource Hijacking is an attack in which an adversary uses the compute power, network bandwidth, or services of a compromised system to run their own resource-hungry tasks — without the owner's consent and usually without their knowledge. In MITRE ATT&CK (a widely used map of attacker methods) it is listed as technique T1496 in the Impact group, because excessive resource use can slow down — and sometimes outright stall — a system or service. The most common forms are cryptojacking (cryptocurrency mining), proxyjacking (reselling someone else's bandwidth), cloud service abuse, and — increasingly — LLMjacking (stealing access to AI models). - [Reflection Attack](https://www.sycope.com/post/dictionary-item/reflection-attack): A reflection attack is a way of attacking a network in which the attacker impersonates the victim. The attacker sends requests to ordinary, legitimate servers — known as reflectors — but in the "sender address" field writes the victim's IP address instead of their own. The server replies as usual, except the reply goes not to the attacker but straight to the victim's address. In this way an innocent server becomes an unwitting tool of the attack. In practice the technique is used almost exclusively to overwhelm a target with traffic, that is, for denial-of-service attacks. Its distributed form is called DRDoS (Distributed Reflection Denial of Service). For the attack to work, two conditions must be met: the attacker has to be able to forge the sender's address (so-called IP spoofing, easiest over UDP, which does not check the sender) and there have to be public services that answer anyone who asks. - [Rate Limiting](https://www.sycope.com/post/dictionary-item/rate-limiting): Rate limiting is a mechanism that controls how many requests a single client may send to a server, API, or service within a defined time window. Once the limit is exceeded, additional requests are rejected — usually with an HTTP 429 Too Many Requests response — or delayed. Rate limiting keeps a service available to everyone, shares resources fairly, and makes many forms of abuse harder, such as DDoS, brute force, credential stuffing, and scraping. - [QUIC](https://www.sycope.com/post/dictionary-item/quic): QUIC is a transport-layer protocol — a set of rules for how data travels across the network between two devices. It runs over UDP and bundles two things that used to be separate into one mechanism: reliable data transport and encryption (TLS 1.3). As a result, you no longer set up the connection (TCP) and the encryption layer (TLS) separately. The IETF standardized QUIC in 2021 in RFC 9000 (the transport itself), RFC 9001 (the TLS integration), and RFC 9002 (loss detection and congestion control). Its main use is HTTP/3 (RFC 9114), the version of the web protocol that runs on QUIC. Google originally designed QUIC as "gQUIC"; the IETF version differs from that early form at the protocol level. - [Probe (Sonda)](https://www.sycope.com/post/dictionary-item/probe): In networking, a probe is a device or program that watches network traffic at a chosen point in the network, analyzes it, and passes the result on — as flow records (condensed summaries of connections), metadata, or full packets. A probe does not create the traffic and is not a full copy of it. It is an analysis tool that works on data delivered to it from elsewhere: through a switch mirror port (SPAN) or a tap inserted into the link (TAP). In network performance monitoring (NPM) and network detection and response (NDR), the probe collects the telemetry on which the upper correlation and detection layers run. - [Privileged Access Management (PAM)](https://www.sycope.com/post/dictionary-item/privileged-access-management): Privileged Access Management (PAM) is a set of tools and processes that secure, control and monitor accounts with elevated permissions. These accounts can change system configuration, run the infrastructure and reach sensitive data — things an ordinary user cannot do. PAM mainly watches over administrator accounts, service accounts, domain accounts and machine identities. Its goal is to reduce risk: grant only the permissions that are needed, keep passwords in an encrypted vault, and record sessions. PAM is a specialized part of the broader field of Identity and Access Management (IAM). - [PCI-DSS](https://www.sycope.com/post/dictionary-item/pci-dss): PCI DSS (Payment Card Industry Data Security Standard) is a set of rules that any company handling card data must follow. It is developed and maintained by the PCI Security Standards Council (PCI SSC) — a council founded by Visa, Mastercard, American Express, Discover, and JCB. The standard says how to protect cardholder data at companies that store, process, or transmit it. The current version is PCI DSS v4.0.1, published on June 11, 2024; it replaced v4.0, which was retired on December 31, 2024. All the rules are organized into 12 requirements grouped under 6 control objectives (goals). - [Packet Loss (Utrata pakietów)](https://www.sycope.com/post/dictionary-item/packet-loss): Packet loss is when some of the packets sent across a network never reach their destination. It is given as the percentage of packets dropped relative to all packets sent over a given interval (for example, 1%). Together with latency and its variation (jitter), it is one of the three core metrics of network quality. - [OWASP Top 10](https://www.sycope.com/post/dictionary-item/owasp-top-10): OWASP Top 10 is a list of the ten most serious types of security risks for web applications. It is published by the OWASP Foundation (Open Worldwide Application Security Project). The list groups related weaknesses into ten categories and orders them by how often they occur and how damaging their consequences are. Each category is tied to CWE identifiers — a shared catalogue of software flaw types. For developers, pentesters and auditors it is a common reference point: where to start so that an application is secure. The most recent editions are OWASP Top 10:2021 and the newer OWASP Top 10:2025, but the 2021 edition is still the most widely cited. - [On-premise / Cloud / Hybrid](https://www.sycope.com/post/dictionary-item/on-premise-cloud-hybrid): On-premise, cloud, and hybrid are the three basic ways a company can run its IT infrastructure. On-premise (local) means the organization buys its own hardware and keeps it in-house — in its own data center or a leased rack. In the cloud model, it rents compute, storage, and networking from an outside provider (such as AWS, Azure, or Google Cloud) and pays for what it uses. Hybrid combines the two: some systems stay local, others run in the cloud, and the two environments are connected. The models differ mainly in cost structure (CAPEX vs OPEX), how much control you keep, how easily you can scale, and who is responsible for security. - [NSM (Network Security Monitoring)](https://www.sycope.com/post/dictionary-item/nsm): Network Security Monitoring (NSM) is the discipline of collecting, storing, and analyzing network traffic data to detect and respond to intrusions. NSM assumes that prevention eventually fails, so it focuses on visibility and detection: gathering telemetry (full packet content, session data, transaction data, and alerts) that lets an analyst reconstruct what happened during an incident and assess its scope. The term was popularized by Richard Bejtlich in "The Tao of Network Security Monitoring" and "The Practice of Network Security Monitoring," which frame NSM as a threat-centric approach rather than reliance on the firewall alone. - [NSEL (NetFlow Secure Event Logging)](https://www.sycope.com/post/dictionary-item/nsel-netflow-secure-event-logging): NSEL (NetFlow Secure Event Logging) is the way a Cisco ASA firewall (and ASASM / Secure Firewall ASA) sends information about network traffic to a monitoring system. It is built on NetFlow Version 9. Plain NetFlow reports flow statistics every so often. NSEL works differently — it is event-driven: it sends a record only when something meaningful happens to a connection, namely when that connection is set up, torn down, or denied. - [NPM (Network Performance Monitoring)](https://www.sycope.com/post/dictionary-item/npm): Network Performance Monitoring (NPM) is the continuous collection and analysis of data about how a network behaves and how the traffic flowing across it performs. The point is to measure network quality the way users and applications actually feel it — to spot slowdowns early and pinpoint where the cause sits: which device, link, or service. NPM pulls data from several sources at once — device metrics, records of traffic flows, packets, and tests that generate artificial traffic — and compares them against a baseline, a stored picture of what the network looks like on a normal day. - [NOC (Network Operations Center)](https://www.sycope.com/post/dictionary-item/noc-network-operations-center): A NOC (Network Operations Center) is a place — physical or virtual — from which a team of engineers and technicians keeps an organization's network, servers, and services running around the clock (24/7). The main job of a NOC is to make sure everything works and stays available: spotting outages, reacting to them, and restoring service within agreed timeframes. A NOC focuses on keeping things running — not on defending against attacks, which is the job of a SOC. - [NIST Cybersecurity Framework](https://www.sycope.com/post/dictionary-item/nist-cybersecurity-framework): The NIST Cybersecurity Framework (NIST CSF) is a voluntary set of guidelines for managing cybersecurity, developed by the U.S. standards body NIST (National Institute of Standards and Technology). Instead of dictating specific tools or products, it describes the outcomes an organization should achieve. In other words, it says what to do, not with what. It is not a checklist or a standard you get certified against. In the current CSF 2.0 release (February 2024), the framework's core is built around six functions: Govern, Identify, Protect, Detect, Respond and Recover. - [Network TAP](https://www.sycope.com/post/dictionary-item/network-tap): A Network TAP (Test Access Point) is a small hardware device inserted directly into a network cable. It copies all the traffic passing through it and sends that copy to monitoring tools, while the live traffic keeps flowing untouched. A TAP works at the physical layer — the level of the raw signal on the wire. It passes the original packets between two devices and, at the same time, hands a duplicate to analysis tools such as packet sniffers, intrusion detection and prevention systems (IDS/IPS), NDR platforms (which watch network traffic for threats), and forensic systems. - [Network Packet Broker (NPB)](https://www.sycope.com/post/dictionary-item/network-packet-broker-npb): A Network Packet Broker (NPB) is an appliance or software that collects a copy of network traffic from TAP points and SPAN ports, then filters, cleans up, and distributes it to monitoring and security tools (IDS/IPS, NDR, SIEM, APM, sniffers, forensics systems). An NPB works on a copy of the traffic, off to the side of the main flow (this is called out-of-band), so it does not change or slow down production communication — unless it is deliberately placed in the traffic path (inline mode). It operates at OSI Layers 2–4 (up to Layer 7 in more advanced models). Its job is simple: give each tool exactly the packets it needs, and not bury it under the rest. - [Network Forensics](https://www.sycope.com/post/dictionary-item/network-forensics): Network forensics is the branch of digital forensics that captures, records, and analyzes network traffic to determine the source and course of a security incident or other event. The key difference from classic disk forensics is this: on a disk, evidence stays put; on a network it is fleeting. A packet you do not record the moment it crosses the network is gone for good. Because of that, the discipline relies either on continuous, planned recording of traffic or on fast action right after an event is detected. - [Multitenancy](https://www.sycope.com/post/dictionary-item/multitenancy): Multitenancy is an architectural model in which a single instance of software and a shared pool of infrastructure serve multiple independent customers. These customers are called tenants — usually an organization or a customer account. Each tenant sees its own data and settings as if they were its own, even though it actually shares compute, storage, and databases with others. The separation between tenants is kept by the software itself (the application and data layers), not by a separate deployment for each customer. Most SaaS products and public cloud services are built on this model. - [Multi-Factor Authentication (MFA)](https://www.sycope.com/post/dictionary-item/multi-factor-authentication-mfa): Multi-Factor Authentication (MFA) is a way of confirming identity that requires at least two independent proofs (factors) from different categories. You get access only after every required factor checks out, so a stolen password alone is not enough to sign in to an account. - [Microsegmentation](https://www.sycope.com/post/dictionary-item/microsegmentation): Microsegmentation is a network security method that splits an environment into small, isolated zones. The boundary sits at the level of an individual workload — an application, virtual machine, container or process — and each one gets its own access policy. Traditional segmentation relies on subnets and VLANs. Microsegmentation goes deeper and mainly controls east–west traffic, meaning the communication between systems inside the network. Here the rules are written around workload identity and attributes, not around an IP address or a physical location in the infrastructure. - [Latency (Opóźnienie)](https://www.sycope.com/post/dictionary-item/latency-opoznienie): Latency is the time data needs to travel from sender to receiver across a network. It is given in milliseconds (ms). It is usually measured in one of two ways: as one-way delay, or as round-trip time (RTT) — the time there and back. Low latency means the system responds almost instantly. High latency is something you feel: pages load sluggishly, games lag, and online calls break up. Latency is not the same as bandwidth. Even a very "wide" link can have high latency if the data has far to travel or sits waiting in queues. - [Jitter](https://www.sycope.com/post/dictionary-item/jitter): Jitter is the uneven pace at which data packets arrive across a network. Picture trains scheduled to run once a minute — but one shows up after 50 seconds, the next after 70, the one after that in 55. On average it's still "every minute," yet the gaps keep jumping around. That wobble in the spacing between packets is jitter. Formally it's the packet delay variation, and it's measured in milliseconds. - [JA3 / JA4 Fingerprinting](https://www.sycope.com/post/dictionary-item/ja3-ja4-fingerprinting): JA3 / JA4 Fingerprinting are techniques that build a stable "fingerprint" of a TLS client or server from the way it negotiates an encrypted connection. The fingerprint comes from the cleartext, not-yet-encrypted fields of a connection's first packets — ClientHello and ServerHello (TLS version, cipher list, extensions, supported curves, ALPN). That lets you recognise an application type, the TLS library in use, or a malware family without decrypting the connection's content. JA3 was created at Salesforce, and JA4+ — its successor — at FoxIO. - [J-Flow](https://www.sycope.com/post/dictionary-item/j-flow): J-Flow (jFlow) is Juniper Networks' method of monitoring network traffic based on flows. Instead of recording the full contents of packets, Juniper devices group them into condensed records described by a tuple of fields (source and destination addresses, ports, protocol, interface) and send those records over UDP to a separate server called a collector. The collector tallies how much traffic there was, of what kind, and where it was headed. J-Flow does the same job as Cisco's NetFlow and is compatible with it at the data-format level. - [ISO 27001](https://www.sycope.com/post/dictionary-item/iso-27001): ISO/IEC 27001 is an international standard that describes how an organization should properly protect its information. Put simply: it is a set of requirements that lets a company prove it isn't guarding data on gut feeling, but through a thought-out, verifiable system. In the standard, that system is called an Information Security Management System (ISMS). The whole idea rests on a risk-based approach: first you work out what could go wrong and how, then you protect what actually matters. ISO 27001 certification is not required by law, but it is a widely recognized way of showing that a company takes security seriously. - [Inventory](https://www.sycope.com/post/dictionary-item/inventory): Inventory (asset inventory) in cybersecurity is an up-to-date, central record of all of an organization's IT assets together with their descriptions — hardware, software, cloud services, accounts, and data. It is the foundation for managing risk, vulnerabilities, and the attack surface. The principle is simple: you cannot protect, monitor, or patch something you do not know about. That is why inventory is the first step of any mature security program. - [Incident Response Lifecycle](https://www.sycope.com/post/dictionary-item/incident-response-lifecycle): The incident response lifecycle is an organized, repeatable way to handle security incidents. It covers detecting an event, analyzing it, containing and removing the threat, and finally recovering systems and learning from what happened. Two models describe it most often. The first is the four-phase model from NIST SP 800-61: preparation; detection and analysis; containment, eradication and recovery; post-incident activity. The second is the six-step SANS model, known as PICERL (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned). The lifecycle is a loop, not a line: lessons from each incident feed back into preparation. - [Identity and Access Management (IAM)](https://www.sycope.com/post/dictionary-item/identity-and-access-management-iam): Identity and Access Management (IAM) is the area of cybersecurity that answers two simple questions: who or what is asking for access and what they are allowed to do. The first is authentication; the second is authorization. The goal of IAM is to make sure the right people, services and devices reach only the resources they actually need, and only when they need them. In other words, everyone gets exactly as much access as required and no more. This idea is known as the principle of least privilege. - [ICMP](https://www.sycope.com/post/dictionary-item/icmp): ICMP (Internet Control Message Protocol) is a network-layer protocol that carries error messages and control information about IP packets. Unlike TCP and UDP, it does not move application data or set up connections. It is a signaling channel: it lets routers and computers tell a sender that a packet did not arrive, that a route has changed, that the packet's time to live (TTL) expired, or that a host is unreachable. ICMP for IPv4 is described in RFC 792, and its messages are wrapped in IP packets with protocol number 1. - [HTTP / HTTPS](https://www.sycope.com/post/dictionary-item/http-https): HTTP (Hypertext Transfer Protocol) is the protocol a browser uses to ask a server for a page or data, and that the server uses to reply. It works in a request–response model and is stateless — it treats each request on its own, with no memory of previous ones. HTTPS (HTTP Secure) is the same protocol, but carried through an encrypted TLS (Transport Layer Security) tunnel. TLS adds confidentiality, data integrity, and proof of the server's identity. HTTP uses port 80 by default, and HTTPS uses port 443. The whole difference is that HTTPS wraps plain HTTP in a layer of encryption. - [FlowSpec](https://www.sycope.com/post/dictionary-item/flowspec): FlowSpec (BGP Flow Specification) is an extension to the BGP routing protocol that distributes detailed traffic filtering rules across the network, together with the action to apply to matching traffic. Normally, to block some traffic you have to enter the rules (ACLs) on each router by hand, one by one. FlowSpec works differently: an operator defines a flow once, and that definition spreads on its own through BGP to every router. A rule can match traffic by addresses, protocol, ports, or packet length, and the action can discard it, rate-limit it, redirect it, or mark it. FlowSpec is described in the standards documents RFC 8955 (for IPv4) and RFC 8956 (for IPv6), which replaced the earlier RFC 5575. - [Encrypted Traffic Analysis (ETA)](https://www.sycope.com/post/dictionary-item/encrypted-traffic-analysis-eta): Encrypted Traffic Analysis (ETA) is a set of techniques that detect threats and identify the type of network traffic without decrypting connections. Instead of reading packet payloads, ETA looks at what is visible from the outside anyway: the unencrypted parts of the TLS handshake (such as the ClientHello message), packet sizes and order, the timing between packets, certificate details, DNS queries, and address/port pairs. It is a bit like judging a parcel by its shape, weight, and label without opening the box. From these features, statistical methods and machine learning (ML, models that learn from data) identify malware, communication with attacker-controlled servers (command-and-control, or C2), data exfiltration, and unusual behavior — while the contents of the connection stay private. - [Drill-down](https://www.sycope.com/post/dictionary-item/drill-down): Drill-down means moving from a general value to more detailed data within the same hierarchy. You click an element of a report, chart, or dashboard — for example a regional total, an alert, or a traffic metric — and step one level down to see what that value is made of. Drill-down is the inverse of roll-up (aggregating upward) and one of the classic OLAP operations. - [DNS](https://www.sycope.com/post/dictionary-item/dns): DNS (Domain Name System) is the system that turns easy-to-remember website names (like example.com) into the strings of numbers (IP addresses, like 93.184.216.34) that devices actually use to find each other on the internet. The simplest way to picture it is as the phone book of the internet: you know the name, and DNS quietly looks up the "number" you need to dial to connect. - [DHCP](https://www.sycope.com/post/dictionary-item/dhcp): DHCP (Dynamic Host Configuration Protocol) is the protocol that lets a device get an IP address and the rest of its network settings on its own as soon as it joins a network: the subnet mask, the default gateway, and the DNS server addresses. It works as a client-server exchange: the device (the client) asks, and a DHCP server answers. Without it, someone would have to type these settings in by hand on every computer, phone, and printer. DHCP runs over UDP — the server listens on port 67 and the client on port 68. The rules are defined in RFC 2131 (with RFC 2132 covering the extra options); the IPv6 version, DHCPv6, is defined in RFC 8415. - [Data Retention](https://www.sycope.com/post/dictionary-item/data-retention): Data retention is the practice of defining how long an organization keeps data before it archives, anonymizes, or permanently deletes it. A retention policy gives each data category (system logs, personal data, financial records, backups) a set retention period — based on law, industry regulation, and operational need — and once that period is up, the data is deleted automatically. - [Data Loss Prevention (DLP)](https://www.sycope.com/post/dictionary-item/data-loss-prevention-dlp): Data Loss Prevention (DLP) is a set of techniques and tools that keep sensitive data from leaking out of an organization. DLP detects, monitors, and blocks the unauthorized use, transmission, and leakage of that data — whether it is sitting on a disk (data at rest), being sent somewhere (data in motion), or being worked on right now (data in use). The system recognizes which data is protected, checks its content and context, and when that data tries to cross a defined boundary, it reacts according to rules: it blocks, quarantines, encrypts, or raises an alert. - [Data Exfiltration (Wyciek danych)](https://www.sycope.com/post/dictionary-item/data-exfiltration-wyciek-danych): Data exfiltration is the unauthorized copying or transfer of data out of an organization's systems to a place the attacker controls. It is usually the last step of an intrusion: the attacker first gets into the network and gains privileges, then takes what they came for — customer records, intellectual property, passwords, or source code. In the MITRE ATT&CK model this maps to tactic TA0010 (the exfiltration phase). The data can be taken by an outside attacker running malware or by an insider abusing their legitimate access. - [Cyber Kill Chain](https://www.sycope.com/post/dictionary-item/cyber-kill-chain): The Cyber Kill Chain is a model that shows a targeted cyberattack as a chain of steps that follow one another — from gathering information about the victim all the way to the attacker reaching their real goal. It was developed in 2011 by Lockheed Martin as part of its Intelligence Driven Defense approach, taking the military idea of a kill chain into the world of networks. The core idea is simple: the attacker has to get through every link in the chain, while a defender only needs to break one link to stop the whole attack. - [Cross-Site Request Forgery (CSRF)](https://www.sycope.com/post/dictionary-item/cross-site-request-forgery-csrf): Cross-Site Request Forgery (CSRF) — also called XSRF or a session riding attack — is a web application vulnerability. It lets an attacker make a logged-in user perform an action without meaning to: change a password, send a transfer, grant someone privileges. The trick relies on the fact that the browser automatically adds the victim's session cookie to every request. The server sees a valid session and carries out the command, because it trusts the logged-in user — it does not check whether the request really came from its own site. - [Content Security Policy (CSP)](https://www.sycope.com/post/dictionary-item/content-security-policy-csp): Content Security Policy (CSP) is a browser security mechanism that tells the browser which places a page is allowed to load and run resources from — scripts, styles, images, fonts, frames, and network connections. You deliver the policy through the Content-Security-Policy HTTP header (or a tag). It is a set of directives separated by semicolons; each directive has a name and a list of allowed sources. CSP is first of all a layer of defense against cross-site scripting (XSS, where an attacker injects foreign code into a page) and, through the frame-ancestors directive, against clickjacking. - [Command Injection](https://www.sycope.com/post/dictionary-item/command-injection): Command injection is a vulnerability in which an application assembles an operating system command from data typed by a user and passes it to the system shell without first removing special characters. The attacker then appends their own commands to the expected value, and the server runs them with the application's privileges. The operating-system variant has its own entry in the weakness catalogue: CWE-78 (OS Command Injection). It also falls under the Injection category in the OWASP Top 10 — the list of the most common web application vulnerabilities. - [Collector (Kolektor)](https://www.sycope.com/post/dictionary-item/collector-kolektor): A collector is a part of a monitoring system that gathers data sent by network devices or agents (known as exporters), tidies it up, stores it, and then makes it available for analysis. In networking it most often means a flow collector that takes in NetFlow, IPFIX, or sFlow records, or a log (syslog) collector that gathers events from systems. The collector sits in the middle of the exporter → collector → analyzer chain: it does not create the data and usually does not judge it — it brings together a stream of telemetry from many sources. "Telemetry" here simply means measurement data about what is happening in the network and systems. - [CMDB](https://www.sycope.com/post/dictionary-item/cmdb): A CMDB (Configuration Management Database) is a central place where a company stores information about every part of its IT environment: servers, applications, network devices and services. Each of these parts is called a Configuration Item, or CI for short. What matters most, though, is that a CMDB records not just the objects themselves but the links between them — who uses what, and what depends on what. That makes it possible to see how individual technical pieces add up to the services the business actually relies on. This is exactly what sets a CMDB apart from a plain list of equipment. The idea comes from the IT management good practices described in ITIL/ITSM. - [Cloud Security Posture Management (CSPM)](https://www.sycope.com/post/dictionary-item/cloud-security-posture-management-cspm): Cloud Security Posture Management (CSPM) is a category of security tools that constantly check whether a cloud environment is set up correctly. They catch misconfigurations, excessive permissions and gaps against standards across IaaS, PaaS and SaaS services. CSPM connects to the cloud agentlessly (through the provider's APIs, with nothing installed on the machines), compares the real state of resources against security policies and benchmarks (such as CIS and NIST), and then points out what to fix — sometimes fixing it automatically. - [Cloud Access Security Broker (CASB)](https://www.sycope.com/post/dictionary-item/cloud-access-security-broker-casb): A Cloud Access Security Broker (CASB) is a control layer that sits between users and cloud services and keeps an eye on how employees use them. It mediates traffic to SaaS, PaaS and IaaS applications, so an organization can see which cloud services are in use and stay in control of its data and access, and respond to threats in places a traditional firewall or web gateway cannot reach. The term was popularized by Gartner around 2012, which framed CASB through four pillars: visibility, compliance, data security and threat protection. - [BYOD (Bring Your Own Device)](https://www.sycope.com/post/dictionary-item/byod-bring-your-own-device): BYOD (Bring Your Own Device) is a model and policy in which employees or contractors use their own devices — smartphones, laptops, tablets — for work: to reach company data, applications, and networks. The defining feature of BYOD is a split in ownership: the device belongs to the user, but the company keeps control over its data. This split — personal hardware, company data on one device — is exactly what creates both the benefits and the particular risks of BYOD. - [Blackholing / RTBH](https://www.sycope.com/post/dictionary-item/blackholing-rtbh): Blackholing (black hole routing) is a network defense technique in which selected traffic is deliberately sent to a null interface (Null0 / discard) and quietly dropped there — with no error message returned to the sender. The packets simply vanish. RTBH (Remotely Triggered Black Hole filtering) is its automated version. From a single point (a trigger router) an operator announces a discard route over the BGP protocol, and every edge router immediately starts throwing away traffic headed for the specified address. It is used mostly to put out volumetric DDoS attacks at Layer 3/4 quickly — the kind that flood a link with sheer packet volume. - [Baseline (Baselining)](https://www.sycope.com/post/dictionary-item/baseline-baselining): A baseline is a statistical picture of how an IT environment — the network, servers, and users — behaves when everything is normal. It is built from telemetry collected over a stretch of time treated as representative. Baselining is the process of building that baseline and keeping it up to date. The baseline acts as a reference point: current activity is compared against it, and clear deviations are treated as anomalies worth investigating. It is a bit like knowing the daily rhythm of a household — once you know who usually comes and goes, and when, it is easier to notice that something is off. Without a reliable baseline, anomaly detection loses its meaning, because you cannot recognize a deviation if you do not know what normal looks like. - [Bandwidth](https://www.sycope.com/post/dictionary-item/bandwidth): Bandwidth is the maximum, theoretical rate at which a given link can transfer data over a period of time. It is expressed in bits per second (bps) and its multiples: Kbps, Mbps, Gbps. Bandwidth tells you the capacity of a channel — how much data fits in it — not how much you actually manage to send. That second figure is called throughput. - [Asset Discovery](https://www.sycope.com/post/dictionary-item/asset-discovery): Asset discovery is the automatic process of finding and listing everything that runs in an organization's IT environment — hardware, software, network services, cloud resources, and connected devices. The goal is a single, up-to-date inventory. That inventory is the starting point for vulnerability management, attack surface reduction, and meeting regulatory requirements. Security rests on a simple rule: you cannot protect something you do not know exists. - [API](https://www.sycope.com/post/dictionary-item/api): An API (Application Programming Interface) is an agreed set of rules that lets two programs exchange data and run each other's functions without knowing how the other side is built inside. Think of it as a contract: it states which requests you can send, in what format, which data is required and what the other side will send back. The most common form today is the web API, which runs over HTTP (the same protocol the web is built on). In these APIs, data is usually sent as JSON or XML. - [API Security](https://www.sycope.com/post/dictionary-item/api-security): API Security is the set of practices and controls that protect application programming interfaces (APIs — the way programs „talk” to each other over a network) against unauthorized access, business logic abuse, data exposure, and attacks. It covers checking who is making a call and whether they are allowed to (authentication and authorization), encrypting data in transit, validating input, limiting traffic, keeping an inventory of every endpoint, and monitoring for unusual behavior at the application layer (usually HTTP/HTTPS traffic). - [Amplification Attack](https://www.sycope.com/post/dictionary-item/amplification-attack): An amplification attack is a type of DDoS attack in which an adversary floods the victim with a huge amount of traffic while sending very little themselves. The trick is that the attacker abuses publicly reachable servers (most often running the UDP protocol) as amplifiers. They send small requests to these servers but forge the sender address, putting in the victim's address instead. The servers dutifully reply, only with much larger packets, and send them not to the attacker but to the victim. How many times bigger the response is than the request is called the amplification factor. - [North-South vs East-West Traffic](https://www.sycope.com/post/dictionary-item/north-south-vs-east-west-traffic): North-South and East-West are two directions in which data moves across a network. The names come from how data center diagrams are usually drawn. North-South traffic enters the environment from outside or leaves it — for example between a user on the Internet and a server in a data center or cloud (top-to-bottom on the diagram). East-West traffic is horizontal: it stays inside and moves between servers, virtual machines, containers, microservices and databases. The distinction matters mainly for network architecture and security. North-South traffic is controlled at the network edge (firewall, IPS, WAF). East-West traffic usually bypasses those controls — which is exactly why it is the main channel an attacker uses to move across the network (lateral movement). - [WAF (Web Application Firewall)](https://www.sycope.com/post/dictionary-item/waf-web-application-firewall): A web application firewall (WAF) is a security system that monitors, filters, and blocks HTTP/HTTPS traffic to and from web applications. It is used to protect applications from attacks such as SQL injection, cross-site scripting (XSS), and other malicious requests. A WAF helps reduce the risk of data breaches, service disruption, and unauthorized access to web applications. - [MTTD (Mean Time to Detect)](https://www.sycope.com/post/dictionary-item/mttd-mean-time-to-detect): MTTD (Mean Time to Detect) is the average time it takes an organization to detect a security incident after it occurs. It is a cybersecurity metric used to measure how quickly threats are identified. A lower MTTD indicates faster threat detection, which can reduce the time attackers have to operate and support more effective incident response. - [MTTR (Mean Time to Repair)](https://www.sycope.com/post/dictionary-item/mttr-mean-time-to-repair): MTTR (Mean Time to Repair) is the average time required to restore a system, service, or device after a failure. It is used to measure how quickly an organization can return operations to normal after an incident. A lower MTTR indicates faster recovery, less downtime, and better incident response efficiency. - [False Positive](https://www.sycope.com/post/dictionary-item/false-positive): A false positive is an incorrect security alert that identifies a legitimate file, email, process, or activity as malicious. In cybersecurity, false positives occur when a detection system flags safe content as a threat. They matter because they create unnecessary investigation work, slow operations, and can reduce trust in security alerts. - [Honeypot](https://www.sycope.com/post/dictionary-item/honeypot): A honeypot is a decoy system or service designed to attract unauthorized access attempts and monitor attacker activity. It is used in cybersecurity to detect threats, study attack methods, and divert intrusions away from real systems. Organizations deploy honeypots to gather intelligence on malicious behavior and improve their defenses. - [IoA (Indicator of Attack)](https://www.sycope.com/post/dictionary-item/ioa-indicator-of-attack): IoA (Indicator of Attack) is a cybersecurity term for signs of malicious activity that suggest an attack is in progress or being prepared. It is used to detect suspicious behavior early, before damage occurs. Security teams use IoA to investigate threats, respond faster, and block attacks based on attacker actions rather than only after-impact traces. - [IoC (Indicator of Compromise)](https://www.sycope.com/post/dictionary-item/ioc-indicator-of-compromise): An indicator of compromise (IoC) is a forensic artifact or observable evidence that may indicate a security breach or malicious activity on a system or network. Security teams use IoCs to detect, investigate, and respond to incidents by identifying signs such as suspicious IP addresses, file hashes, domains, or abnormal behavior. Monitoring IoCs helps organizations recognize threats earlier and limit damage from attacks. - [Firewall / NGFW](https://www.sycope.com/post/dictionary-item/firewall-ngfw): A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predefined rules. A next-generation firewall (NGFW) adds application awareness, intrusion prevention, and deeper packet inspection to classify and filter traffic more precisely. Together, they help organizations control access, reduce unauthorized connections, and detect suspicious activity on the network. - [IPS (Intrusion Prevention System)](https://www.sycope.com/post/dictionary-item/ips-intrusion-prevention-system): An intrusion prevention system (IPS) is a network security tool that monitors traffic and blocks detected threats in real time. It inspects packets and connections for suspicious patterns, then stops attacks such as intrusion attempts, malware delivery, and some forms of DDoS traffic before they reach systems. Organizations use IPS to reduce risk, limit unauthorized access, support incident response, and help meet security and compliance requirements. - [EDR](https://www.sycope.com/post/dictionary-item/edr): EDR is endpoint detection and response, a cybersecurity technology that monitors endpoints for suspicious activity and helps detect, investigate, and respond to threats. It collects and analyzes data from devices such as laptops, servers, and workstations to identify malicious behavior, including unknown or emerging attacks. Organizations use EDR to improve incident detection, contain compromises, and support faster remediation across their endpoints. - [XDR](https://www.sycope.com/post/dictionary-item/xdr): XDR (extended detection and response) is a cybersecurity approach that collects and correlates data from multiple security layers to detect and respond to threats. It is used to improve visibility across endpoints, networks, email, and cloud environments from a single platform. XDR helps security teams identify incidents faster, reduce false alerts, and automate response actions. - [SOAR](https://www.sycope.com/post/dictionary-item/soar): SOAR is a cybersecurity approach that combines security orchestration, automation, and response to coordinate and automate incident handling. It helps security teams manage alerts, standardize response procedures, and reduce manual work during investigations. By linking tools and workflows, SOAR supports faster, more consistent responses to security incidents. - [VPN](https://www.sycope.com/post/dictionary-item/vpn): A VPN (Virtual Private Network) is a service that creates an encrypted connection between a device and a remote network over the internet. It is used to protect data in transit, hide the user’s IP address, and provide secure access to private networks. VPNs are commonly used for secure remote work, privacy on public Wi-Fi, and controlled access to network resources. - [BGP (Border Gateway Protocol)](https://www.sycope.com/post/dictionary-item/bgp-border-gateway-protocol): BGP (Border Gateway Protocol) is the Internet’s standard exterior gateway protocol for exchanging routing information between autonomous systems. It is used by routers to determine how data moves across large networks and between Internet service providers. BGP helps direct traffic efficiently and supports the stability and reachability of Internet communications. - [sFlow](https://www.sycope.com/post/dictionary-item/sflow): sFlow is a network traffic monitoring protocol that uses packet sampling to collect and export flow data from network devices. It is used to analyze traffic patterns, bandwidth usage, and network performance. Organizations use sFlow to monitor large or high-speed networks with lower overhead than full packet capture. - [XSS (Cross-Site Scripting)](https://www.sycope.com/post/dictionary-item/xss-cross-site-scripting): Cross-Site Scripting (XSS) is a web security vulnerability that allows an attacker to inject malicious scripts into content viewed by other users. It usually occurs when an application displays untrusted input without proper validation or output encoding, causing the script to run in the victim’s browser. XSS can be used to steal session cookies, hijack accounts, and alter page content, making it a significant risk for websites and web applications. - [SQL Injection (SQLi)](https://www.sycope.com/post/dictionary-item/sql-injection-sqli): SQL injection (SQLi) is a code injection attack that exploits insecure SQL queries to access or manipulate a database. It works by inserting malicious SQL into input fields, URLs, or other application parameters. SQLi is used by attackers to steal, change, or delete data and can lead to account compromise, service disruption, or full system access. - [Botnet](https://www.sycope.com/post/dictionary-item/botnet): A botnet is a network of internet-connected devices that has been infected and remotely controlled by an attacker. It is used to carry out coordinated actions such as sending spam, launching denial-of-service attacks, or spreading malware. Because the devices involved often belong to unsuspecting users, botnets can operate at scale and are difficult to detect and stop. - [Cryptojacking / Cryptomining](https://www.sycope.com/post/dictionary-item/cryptojacking-cryptomining): Cryptojacking is the unauthorized use of another person’s or organization’s computing resources to mine cryptocurrency. Attackers install mining code on devices or cloud systems so they can generate coins without paying the full cost of hardware or electricity. It can slow systems, increase energy use, and cause overheating or reduced performance. - [Shadow IT](https://www.sycope.com/post/dictionary-item/shadow-it): Shadow IT is the use of applications, devices, or services by employees without approval or oversight from the IT department. It often arises when workers choose tools that are faster or more convenient for everyday tasks. Shadow IT can improve short-term productivity, but it can also bypass security policies, limit visibility, and increase organizational risk. - [TLS / SSL](https://www.sycope.com/post/dictionary-item/tls-ssl): TLS/SSL is a set of cryptographic protocols used to encrypt and authenticate data transmitted over a network. It is used to secure connections between clients and servers, especially on websites, email systems, and online applications. By protecting data confidentiality and integrity, it helps prevent interception, tampering, and impersonation during transmission. - [SOC (Security Operations Center)](https://www.sycope.com/post/dictionary-item/soc-security-operations-center): A Security Operations Center (SOC) is a centralized team or facility that monitors, detects, analyzes, and responds to cybersecurity threats. It provides continuous oversight of an organization’s systems, networks, and endpoints to identify suspicious activity and handle security incidents. SOCs help reduce risk, improve incident response, and support compliance with security requirements. - [DORA](https://www.sycope.com/post/dictionary-item/dora): DORA, or the Digital Operational Resilience Act, is an EU regulation that sets requirements for ICT risk management, incident reporting, testing, and third-party oversight in the financial sector. It applies to banks, insurers, investment firms, payment institutions, and certain technology providers. Its purpose is to improve the operational resilience of financial entities and reduce disruption from cyber incidents and technology failures. - [NIS2](https://www.sycope.com/post/dictionary-item/nis2): NIS2 is the European Union directive on cybersecurity and the protection of networks and information systems. It sets security and incident reporting requirements for essential and important entities in sectors such as energy, healthcare, transport, and digital services. The directive is intended to improve risk management, operational resilience, and cooperation with national authorities across the EU. ## Integrations - [CMDBuild](https://www.sycope.com/post/integration/cmdbuild) - [Nagios](https://www.sycope.com/post/integration/nagios) - [Check Point](https://www.sycope.com/post/integration/check-point) - [Palo Alto](https://www.sycope.com/post/integration/palo-alto) - [FortiGate](https://www.sycope.com/post/integration/fortigate) - [Energy Logserver](https://www.sycope.com/post/integration/energy-logserver) - [Elasticsearch](https://www.sycope.com/post/integration/elasticsearch) - [Microsoft Teams](https://www.sycope.com/post/integration/microsoft-teams) - [Discord](https://www.sycope.com/post/integration/discord) - [SecureVisio](https://www.sycope.com/post/integration/securevisio) - [IBM QRadar](https://www.sycope.com/post/integration/ibm-qradar) - [Splunk](https://www.sycope.com/post/integration/splunk) - [Atlassian Jira](https://www.sycope.com/post/integration/atlassian-jira) - [IP Address Management (IPAM)](https://www.sycope.com/post/integration/ip-address-management-ipam) - [Slack](https://www.sycope.com/post/integration/slack) - [Suricata](https://www.sycope.com/post/integration/suricata) - [Zabbix](https://www.sycope.com/post/integration/zabbix) ## Case studies - [How Veolia used Sycope to reduce SIEM licensing costs and enhance network monitoring](https://www.sycope.com/post/case-study/how-veolia-used-sycope-to-reduce-siem-licensing-costs-and-enhance-network-monitoring): Veolia Group stands as a leader in delivering innovative energy, water, and waste management services aligned with the UN’s Sustainable Development Goals. Globally employing over 220,000 professionals, and 4,600 in Poland alone, Veolia serves both municipalities and industries with sustainable infrastructure solutions. In 2021, it delivered drinking water to 79 million people and generated nearly 48 million MWh of energy.  - [How local ISP uses Sycope to protect network from DDoS attacks and others](https://www.sycope.com/post/case-study/how-local-isp-uses-sycope-to-protect-network-from-ddos-attacks-and-others): Sat Film is a Polish network and cable TV operator. The company has its headquarters in Włocławek and Łódź. It offers digital television, fixed and mobile telephony services and broadband Internet access. It is the 8th largest cable operator in Poland in terms of number of subscribers. It provides access to 160 channels on its own digital platform,including over 120 channels in HD quality. It delivers Internet services based on DOCSIS, GPON, Wi-Fi and mobile technologies, offering several different bandwidth packages. The company is a local ISP, responsible for creating connections on a regional scale; its core tasks include providing customers with stable Internet access, redirecting Internet traffic, and maintaining the technological infrastructure. The company has an extensive technical department to support network continuity. From the customer's perspective, it is very important to defend against all types of threats that can negatively affect the telecommunications network and access to services by its users. In such a situation, network monitoring has become a key objective in order to quickly locate attacks and neutralize them. - [National Oncology Center in Poland achieves 3x faster network data collection and troubleshooting with Sycope](https://www.sycope.com/post/case-study/how-national-institute-of-oncology-uses-sycope-to-keep-its-network-running-optimally): The National Research Institute of Oncology in Gliwice is one of Poland's most advanced medical and research centers. With over 120 researchers, including 30+ professors and habilitated PhDs, the Institute treats thousands of patients and drives pioneering research in oncology, radiotherapy, nuclear medicine, and medical physics.  ## Thank You Pages