SOAR and AI SOC glossary

A

Agentic SOC

Another name for an AI SOC, stressing agents that plan and act rather than follow fixed steps.

Agentic workflow

A workflow in which an AI agent chooses the steps at run time within limits set by the team, instead of following a fixed sequence written in advance.

AI SOC

A platform that uses AI agents to triage and investigate security alerts and, within limits, respond.

AI SOC analyst

A product term (used by Dropzone AI and Prophet Security, among others) for an AI agent that triages and investigates alerts.

Alert investigation

Gathering evidence across tools to reach a verdict on an alert.

Alert triage

Deciding whether an alert is benign, suspicious or malicious, and how urgent it is.

Autonomy modes

Levels of automatic action a platform allows, such as Mate's Recommend only, Supervised and Auto-run.

B

BYOK (bring your own key)

An option in which the customer supplies and controls the encryption keys used for its data. Prophet Security lists a bring-your-own-key option.

C

Case management

Recording an alert or incident as a case with its evidence, timeline, owner and actions. SOAR platforms include it, and several AI SOC platforms keep their own case record.

Context graph

A store of relationships and history about an environment, such as assets, owners and how past alerts were decided, that AI agents query during an investigation. Mate Security calls its version the Security Context Graph; Torq acquired Jit in May 2026 for its AI context graph technology.

CSF 2.0

Version 2.0 of the NIST Cybersecurity Framework, published in February 2024. It organises cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover.Source: NIST Cybersecurity Framework

D

D3FEND

A MITRE knowledge graph of defensive cybersecurity techniques, the defensive counterpart to ATT&CK. Splunk says its prebuilt SOAR playbooks are aligned to MITRE ATT&CK and D3FEND.Source: MITRE D3FEND

Data residency

A requirement that data is stored and processed in a specific country or region. Dropzone AI offers an EU data residency option, and Conifers added a Singapore data region in July 2026 alongside North America and Europe.

Detection engineering

Writing, testing and tuning the rules that raise alerts. Prophet Security, Conifers and Mate Security describe AI help for this work.

Deterministic workflow

An automation that runs the same steps in the same order for a given input. Torq supports deterministic and agentic workflows in one engine, and Mate Security describes Gamebooks as deterministic where they can be.

DFIR

Digital forensics and incident response: collecting and analysing evidence after an incident and running the response. 7AI offers an on-demand DFIR service.

E

EDR

Endpoint detection and response. Software on laptops and servers that records activity, raises alerts and can isolate a host.

F

False positive

An alert raised on activity that turns out to be benign. Closing false positives quickly, with a stated reason, is a large part of triage.

Federated SIEM

A 7AI product name for querying security data where it already sits, in SIEMs, data lakes and cloud platforms, instead of centralising it first.

G

Gamebook

Mate Security's term for an investigation process in which intent and boundaries are fixed and agents choose how to execute each step.

Guardrails

Limits on what an agent may do, such as confidence thresholds, scoped permissions and blast-radius limits.

H

Human in the loop

A person approves an action before it runs.

Human on the loop

Actions run automatically while a person monitors and can intervene.

Hyperautomation

Torq's term for its automation engine, which runs agentic and deterministic workflows.

I

Incident response

The work of preparing for, detecting, containing and recovering from security incidents. NIST SP 800-61 Rev. 3 (April 2025) sets out recommendations within the NIST Cybersecurity Framework 2.0.Source: NIST SP 800-61 Rev. 3

M

MDR

Managed detection and response. A service in which an outside provider monitors, investigates and responds to alerts for a customer.

MITRE ATT&CK

MITRE describes it as "a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations". Detection coverage and threat hunts are often mapped to it.Source: MITRE ATT&CK

Model Context Protocol (MCP)

An open-source standard for connecting AI applications to external systems such as data sources and tools. Palo Alto Networks lists native MCP support in Cortex AgentiX.Source: modelcontextprotocol.io

MSSP

Managed security service provider. A company that runs security monitoring and operations for several customers, usually on a multi-tenant platform.

MTTR

Mean time to respond (or resolve): the average time from alert to resolution.

Multi-tenant

One platform instance serving several customers or business units with their data kept separate. Conifers says CognitiveSOC is multi-tenant from the start, and Dropzone AI sells an MSSP tier with a dedicated multi-tenant environment.

P

Parallel run

The period in a migration when the SOAR and the new platform both operate and their results are compared.

Playbook

A predefined sequence of steps a SOAR runs when an alert matches its trigger.

Proof of value

A time-boxed test of a product on the buyer's own alerts and tools, with success criteria agreed before it starts. Our buyer note explains how to run one for an AI SOC platform.Read: How to run an AI SOC proof of value

S

Shadow mode

Running an AI SOC platform on live alerts without letting it act, so that its verdicts can be compared with analysts' decisions before any autonomy is granted.

SIEM

Security information and event management. Software that collects logs and events from across an environment, correlates them and raises alerts.

Single-tenant

A deployment in which one customer's data and processing run in an environment not shared with other customers. Dropzone AI's Enterprise tier and Prophet Security describe single-tenant options.

SOAR

Security orchestration, automation and response. Software that runs predefined playbooks across security tools and manages cases.

SOC 2

An attestation report on a service provider's security controls, issued under AICPA criteria. A Type I report covers the design of controls at a point in time; a Type II report covers how they operated over a period.

T

Threat hunting

Searching for threats that existing alerts did not catch, usually starting from a hypothesis. Dropzone AI, Prophet Security and Conifers each describe AI agents for it.

Threat intelligence

Information about adversaries, their infrastructure and their techniques, used to enrich alerts and guide hunts. Cortex XSOAR includes threat intel management with Unit 42 intelligence.

U

UEBA

User and entity behaviour analytics: modelling normal behaviour for users and devices and flagging deviations. Splunk describes Enterprise Security as integrated with agentic AI, SOAR, UEBA and SIEM.

V

Verdict

The conclusion of an investigation, such as benign, suspicious or malicious, ideally with the evidence behind it.