Install
Technology, IT & Security terms
Analytics of the machines themselves: security, observability, networks, cloud cost, engineering and AI systems.
Endpoint detection and response (EDR) Software that continuously records endpoint activity, applies detection logic, and lets responders investigate and contain threats. Extended detection and response (XDR) A platform that correlates telemetry across endpoints, network, identity, and cloud into a single detection and investigation view. Indicator of compromise (IOC) A piece of forensic evidence, such as a file hash or IP address, suggesting a system has been breached or contacted by an attacker. Mean time to detect (MTTD) The average time between when an incident begins and when a team becomes aware of it. MITRE ATT&CK framework A public knowledge base of adversary tactics and techniques used as a shared vocabulary for describing attacker behavior. Open-source intelligence (OSINT) Intelligence produced from publicly available information — social media, news, public records — rather than classified sources. Security operations center (SOC) The team responsible for continuously monitoring an organization's systems, triaging alerts, and coordinating incident response. SIEM (security information and event management) A platform that centralizes and correlates log and event data across an IT environment to detect and investigate security threats. SOAR (security orchestration, automation and response) A platform that automates and orchestrates the response steps a security team takes after an alert is raised. Threat intelligence Analyzed information about attacker groups, tools, and techniques used to anticipate and defend against threats, not just react to them. User and entity behavior analytics (UEBA) Analytics that baseline normal user and device behavior and flag deviations that could signal a compromise, even without a known IOC. Zero-day vulnerability A software flaw unknown to the vendor, or unpatched, at the time it is discovered or actively exploited. Application performance monitoring (APM) Monitoring that tracks application response time, errors, and throughput, tying degraded performance to its root cause. Distributed tracing Following a single request across multiple services in a distributed system to see where time was spent or an error occurred. Error budget The amount of unreliability a service is allowed over a period, equal to 100% minus its service level objective. Log aggregation Collecting log data from many separate systems into one centralized, searchable store instead of checking each system individually. Mean time to resolve (MTTR) The average time from when an incident is detected to when it is fully resolved and normal service is restored. Metric cardinality The number of unique time series a metric produces, driven by every distinct combination of its labels or tags. Service level indicator (SLI) The specific, measured metric, such as success rate or latency, used to judge a service's performance against a target. Service level objective (SLO) An internally set reliability or performance target, measured over a time window, set above any contractual SLA. NetFlow analysis Examining summarized records of network traffic exported by routers and switches to understand traffic patterns. Network latency The time it takes data to travel from a source to a destination across a network, usually measured as round-trip time. Network utilization The share of a network's total available capacity that is actually being used over a given period. Packet loss The percentage of data packets sent across a network that never arrive at their destination. Quality of experience (QoE) A subjective measure of how satisfactory a network or service feels to the user, distinct from raw technical performance. Cloud unit economics Cloud infrastructure cost measured per unit of business value, such as cost per customer, transaction, or API call. Commitment-based discounts Reduced cloud pricing offered in exchange for committing to a minimum level of spend or usage over a fixed term. FinOps An operating model for managing cloud spending collaboratively across engineering, finance, and business teams. Showback and chargeback Two ways of attributing shared cloud costs to teams, one for visibility only, the other billing the cost to their budget. Change failure rate The percentage of production deployments that result in a degraded service requiring a rollback, hotfix, or incident. Deployment frequency How often an organization successfully releases code to production, one of the four DORA metrics. DORA metrics Four measures of software delivery and operational performance covering release speed, stability, and recovery. Lead time for changes The time from when code is committed to when it is running successfully in production, one of the four DORA metrics. SPACE framework A model for measuring developer productivity across satisfaction, performance, activity, communication, and efficiency. Agentic analytics The use of AI agents that autonomously plan and execute multi-step analytics work, such as investigating a metric change. AI agent A system that uses a language model to plan and take multi-step actions, such as calling tools or APIs, toward a goal. Context window The maximum amount of text, measured in tokens, a language model can consider at once when generating a response. Embeddings Numeric vector representations of text, images, or other data, positioned so similar items sit close together in the vector space. Fine-tuning Further training a pretrained model on a smaller, targeted dataset to adapt its behavior to a specific task or domain. Generative AI AI systems that create new content, text, images, audio, or code, rather than only classifying or predicting a label. Guardrails Rules, filters, or checks placed around a language model to keep its inputs and outputs within acceptable, safe bounds. Hallucination When a language model generates confident, fluent output that is factually wrong or unsupported by its source material. Knowledge graph A network of entities and the labeled relationships between them, used to represent and query structured knowledge. Large language model (LLM) A neural network trained on vast amounts of text to predict and generate language, the technology behind most modern AI assistants. LLM evaluation Systematically testing a language model's outputs for quality, accuracy, safety, and consistency before and after deployment. LLM observability Monitoring a language model's live behavior in production, tracking its inputs, outputs, latency, cost, and failure patterns. LLM-as-a-judge Using a language model to score or compare the outputs of another model, as a scalable substitute for human review. Prompt engineering Designing and refining the instructions given to a language model to reliably get the output you want. Retrieval-augmented generation (RAG) An architecture that retrieves relevant documents at query time and feeds them to a language model so its answers are grounded in sources. Semantic search Search that matches results to a query's meaning rather than its exact keywords, using vector similarity between embeddings. Token The basic unit of text, roughly a word piece, that a language model reads, processes, and is priced and measured by. Vector database A database optimized to store numeric embeddings and quickly find the ones most similar to a given query vector.