Glossary

Cybersecurity often involves complex terminology and a wide array of acronyms. This glossary is designed to support your understanding of the SenseOn platform by clearly defining commonly used terms and abbreviations.

Common Terminology

Term	Meaning
Agent	A generic term for our Universal Sensor.
AI Assistant	Our Generative AI solution that accelerates incident response through automated investigation and analysis. Customers can opt in or out via Settings or our support team.
AI Case Summary	A summary of the case, compiled by the LLM (AI Assistant).
Alert	A security event generated by a third-party provider.
Case	A group of one or more observations correlated by common factors (e.g. same device or IP). Cases vary in threat level: Low, Medium, High, Critical.
Cybersecurity	The practice of protecting systems, networks, and data from digital attacks and unauthorised access.
Data	A collective term for Alerts and Telemetry.
Device	A physical or virtual component that can connect to a network (e.g. computers, servers, mobile devices, IoT devices). A device may or may not have the Universal Sensor installed.
Device ID	Normally shows the Fully Qualified Domain Name (FQDN).
Device Name	Normally shows the hostname or FQDN.
Device Precise ID	A unique set of capital letters and numbers used to identify a device.
Endpoint	A user-operated device (e.g. laptop, smartphone) that serves as a point of access to a network. Always has the Universal Sensor installed.
Endpoint Agent	A generic term for our Universal Sensor.
Endpoint Event	A unit of telemetry reported by the Universal Sensor.
Endpoint ID	Normally shows the hardware ID.
Event	Any activity on a device, such as failed logins or malware infections.
Hardware ID	A unique alphanumeric identifier (uppercase only) for a device.
Hostname	A label assigned to a device on a network, used to identify it and usually linked to an IP address.
Hunt Lab	A pane allowing users to query and view raw telemetry using SQL—ideal for investigating detailed events.
Investigation Panel	A side panel within the Knowledge Graph that helps analysts run investigations on a case.
Observation	A single security event detected by SenseOn, based on endpoint or network telemetry. Correlated observations may form a case.
Quick Action	A shortcut to retrieve telemetry without using Hunt Lab.
Recovery Codes	Backup verification codes used for 2FA if the authenticator app is unavailable.
Reflex	(Pending definition – consider adding here.)
Remediation Action	Also called Active Response Remediation Action. A quick way for users to take action directly from the platform.
Response	Any manual or automatic response taken through the SenseOn platform.
SenseOn Analyst	An analyst from the SenseOn Managed SOC team.
SenseOn Appliance	A term we avoid—refers to the outdated model of physical telemetry collection. We use a modern, cloud-based approach.
SenseOn Platform	The UI that users interact with.
Telemetry	Activity data collected by SenseOn or third parties, used to develop detections. Telemetry may become observations.
Time-based One-time Password	Temporary codes generated using the current time, used for two-factor authentication (2FA).
Universal Sensor	Our branded term for the endpoint detection software (EDR agent) that protects customer devices like laptops and servers.

Glossary of Acronyms

Acronym	Meaning
2FA	Two-factor authentication.
ARRA	Active Response Remediation Actions.
EDC	External Data Collector – API that connects SenseOn to other data sources.
EDR	Endpoint Detection and Response.
EPNS	Endpoint Network Sensor.
FQDN	Fully Qualified Domain Name – full domain path to uniquely identify a host (e.g., `host.example.com`).
NDR	Network Detection and Response.
PAT	Personal Access Tokens – secure, user-specific keys used to access SenseOn Connect.
PID	Process ID – a unique identifier for a running process.
SIEM	Security Information and Event Management – solution for detecting threats before disruption.
TOTP	Time-based One-time Password – used in the platform for 2FA.