Common terms used within the Teleseer knowledge base and application.
Alert: configurable detection rule that generates events for matching network traffic.
Alert Event: a notification generated for specific traffic matching a configured Alert.
Alert Quota: the maximum number of individual alert events a single Alert configuration can generate per instance of telemetry analysis.
ASN: Autonomous System Number, a globally unique identifier that defines a group of one or more IP prefixes.
ATT&CK: MITRE Adversarial Tactics, Techniques, and Common Knowledge, a framework used to map detected threats to known adversary behaviors.
Beaconing: periodic, automated communication from a host to a remote server, often indicative of command-and-control activity.
Broadcast Domain: the portion of the network sharing the same layer 2 segment in which all hosts can reach other by broadcasting on this layer.
bro/zeek: a powerful framework for network traffic analysis and security monitoring.
C2: Command-and-control, infrastructure used by an attacker to communicate with compromised hosts.
CIDR: Classless Inter-Domain Routing, a notation used to define a range of IP addresses in a network (e.g., 192.168.1.0/24).
Cooked PCAP: a packet capture collected from an "any" device interface that lacks layer 2 (MAC address) content, also referred to as SLL.
CVE: Common Vulnerabilities and Exposures. A database identifying security vulnerabilities, with metrics per CVE record indicating severity of each. Values can be looked up at https://www.cve.org/.
DPI: Deep Packet Inspection, a method of examining packet contents beyond the last header to identify applications, protocols, or credentials.
DUA: Data Under Analysis is the total uncompressed amount of data that Teleseer has processed and stored for your account.
External Hosts: hosts identified as being outside the local network boundary. The default criteria defining the set of external hosts include TAP location, IP TTL values, and other analysis.
Flow: a group of packets sharing common network attributes, such as IP addresses, ports, and protocol, and observed within the same period of activity.
GreyNoise: a cybersecurity platform that collects and analyzes Internet-wide scan and attack traffic.
Host: a device that appears within the topology.
Inspector: contains detailed information about the selected host or timeline block.
Inventory: a table of hosts within the current project.
IPinfo: an IP address geolocation lookup to include geographic location, company name, domain, and what type of company it is.
Layer 2: the data link layer, responsible for node-to-node data transfer and MAC addressing.
MRT-C: Mission Relevant Terrain in Cyberspace, a method of identifying critical network assets whose disruption could significantly impact a mission.
NAT: Network Address Translation, a method of mapping multiple devices to a shared IP address.
PCAP: Packet Capture, a network collection file containing packet data of network traffic.
PCAPNG: PCAP Next Generation file. Similar to PCAP but contains additional metadata in packet header.
Project: an object used to ingest uploaded files. Opening a project will view the corresponding topology.
RDNS: Reverse DNS lookup which is used to query the DNS to determine the domain name associated with an IP address.
Rule Set: a collection of Suricata rules used to evaluate network traffic for known threats or suspicious behavior.
Sample Projects: pre-loaded example projects used to demonstrate topology generation from different file types.
SID: a unique identifier manually assigned to a Suricata rule.
Signature: the full Suricata rule written in Suricata's rule language, reflecting all scope and detection settings configured through the UI.
Smart Filter: a toggle that narrows a table or panel to display only content related to the currently selected host(s).
Subnet: a logical subdivision of a network sharing a common IP address range.
Suricata: an industry standard open source network intrusion detection system integrated into Teleseer's processing pipeline.
Swim Lane: an individual row within the Timeline representing traffic for a specific protocol.
Tag: a keyword used to identify, categorize, or describe a project or host. Tags are searchable from the Network, Inventory, and External Hosts panels and can be used to filter or locate specific assets.
TAP: the physical or logical location where traffic is collected for analysis.
Team: a collection of projects that share a common access.
Timeline: an interactive listing of all traffic that occurred within the given file set or from the selected host(s).
Topology: the reconstructed network diagram.
Upload: an uploaded file (of a supported file type).
User: an individual end user with access to one or more teams.
VLAN: Virtual Local Area Network, a logical grouping of hosts that share the same broadcast domain regardless of physical location.
Vulnerable: this host has been identified as having a common vulnerability.
