Glossary
The terms this manual uses, defined once.
- Source
- Where events come from: a connector reading another tool's API, a log file mapped by a source mapping, or a feed another system pushes to.
- Event
- One thing that happened, mapped to one shape and kept append-only in the event store before anything reads it.
- Detection rule
- A declared condition over events, with fixtures it must match and must not. A rule is live, in the trial ring (it records what it would raise) or off.
- Finding
- Something a rule, a correlation or an automation says is wrong. Its state is open, triaged, accepted, fixed, stale, false-positive or benign, and every decision on it is kept.
- Case, incident
- A record of something being handled, graded sev1 to sev4, with the notification duties of each regime that applies.
- Regime
- A law with a notification clock: GDPR (eu), NIS2, DORA, SEC, CIRCIA or HIPAA. A clock starts when somebody decides the organisation is aware.
- Playbook
- Steps for a kind of incident, proposed, approved and then worked through step by step.
- Action
- One declared thing done to another platform, such as suspending an Okta account. Asked for by one person, approved by another.
- Automation
- A rule of the form when this happens, if this is true, do this, in one of three modes: watch, ask or act.
- Estate
- The people who work here and what they use, joined across the tools that know about them.
- SSVC, VEX
- SSVC is the decision tree that turns a vulnerability's facts into what to do; VEX is the published statement of whether a product is affected.
- Audit log
- The append-only record of every change Vaigil makes, hash-chained, signed and anchored.