VERISCO Alertio Reference

Glossary

The terms used across the Alertio documentation and console, in alphabetical order.

Acknowledge: Record on an incident that it has been seen and is being handled. See Incidents.
Agent: The lightweight program on an endpoint that sends events and carries out response actions.
Alert: One detection: a rule matched an event. Identical alerts within five minutes are grouped into one with a count.
Asset criticality: How important a machine is: Low, Medium, High or Critical. One of the four factors of the risk score.
Blast radius: The machines an incident involves, with their criticality.
Blind spot: A MITRE ATT&CK technique against which no detection fired in the selected period. See MITRE ATT&CK coverage.
Correlation pattern: A rule that recognises an attack across several alerts. Alertio ships seven. See Correlation patterns.
Deduplication: Combining identical alerts within a five-minute window into one, with an occurrence count. Also the name of one score factor.
Dry run: Resolving every step of a playbook against real data without carrying anything out.
Endpoint: A machine monitored by Alertio.
Enrolment token: A short-lived secret that lets a new machine join. Single-use and valid for 24 hours by default.
Gate: The risk score an alert needs to reach the Triage Queue on its own. 50 by default.
Incident: A group of related alerts that together describe one attack.
Kill chain: The six stages of an attack Alertio tracks: Reconnaissance, Credential Access, Exploitation, Privilege Escalation, Lateral Movement and Impact.
Kill-chain depth: The furthest stage an incident reached.
Playbook: A sequence of response actions run together, always started by a person.
Quick action: A single response action run directly from the Response Center. Recorded as a one-step playbook run.
Response action: One thing done to an endpoint, such as blocking an address or isolating a host.
Response script: Your own code that an agent runs as a response action. Written, validated, tested and deployed from the console.
Risk score: Alertio's measure, from 0 to 100, of how much an alert matters in your environment. See Risk scoring.
Schedule: A time window that changes how much an alert's timing weighs in its score.
Severity: The category the detection rule assigns: Critical, High, Medium or Low.
Severity floor: The guarantee that an alert its rule rates critical always reaches the Triage Queue, whatever its score.
Suppressed: Held below the gate. Kept, searchable and auditable, never deleted.
Triage Queue: The analyst's working list: only the alerts that need a person, each with the reason it is there.
Trust rule: A rule that lowers the score of activity known to be legitimate.
Verdict: The AI model's conclusion on an alert: true positive, false positive or needs review. Or, for a threat intelligence lookup: malicious, suspicious, harmless or undetected.

Something missing or wrong on this page? Tell us and we will fix it.