Glossary

This glossary defines the vocabulary of AI Blue, from the five blue team functions and the degrees of delegation to the artefacts, roles, tools, frameworks and organisations that the chapters use. Each entry gives the book's own usage in one or two sentences and names the chapter where the term is introduced or defined. Where a term is used in a sense the chapters do not support, it is left out rather than defined.

How to use this glossary

Entries are grouped alphabetically under their initial letter. An identifier in code formatting, such as DET-* for detection records, names a pattern: the wildcard stands for the number the organisation assigns to each record, and the book's examples use NR for Nordvik Region and HM for Hansa Mutual.

Levels, modes and action classes are defined in sets, so read an entry for a level or a class together with the entries it refers to. The book sets ceilings rather than single values: where an entry states a default, a profile may set a lower level, and the lowest ceiling that applies governs.

A

AC-0 Preserve. The response class for preservation actions such as snapshotting a host or placing a hold on logs. They change nothing in the estate and default to Level 3 Bounded (Chapter 10).

AC-1 Narrow and reversible. The response class for actions such as isolating one end-user workstation or revoking one session, which a person can undo in minutes (Chapter 10).

AC-2 Wide or business-critical. The response class for actions such as isolating a production host or taking a service offline. They are reversible, but reach many users and default to Level 2 Supervised (Chapter 10).

AC-3 Partly reversible, or about a person. The response class for actions such as disabling a user account. They are undone only in part, or decide about a named person's access to work, so they need a named human decider (Chapter 10).

AC-4 Irreversible or external. The response class for actions such as wiping a host, notifying a regulator or paying a ransom. They cannot be recalled, so the system drafts and a named person acts at Level 1 Assisted (Chapter 10).

Alert. A claim about the world: a pattern of events that indicates activity deserving attention. Like any claim, it needs evidence, context and a decision before it can be closed (Chapter 7).

Analysis products. The third of the three evidence layers, next to originals and working copies, in which findings are written. The AI writes analysis and never alters an original or a manifest (Chapter 8).

Apprenticeship route. A designed path from a person with little experience to an analyst who can work a case unaided and supervise an agent (Chapter 23).

Attacker-writable input. An input that the adversary can influence, such as a log field or a ticket. The more of an action's basis is attacker-writable, the more corroboration must come from independent sources, and the lower the ceiling if it cannot (Chapter 4).

Automation bias. The documented tendency of people working with automated aids to accept their output. The book treats it as a property of working with automation and not as a failing of individuals (Chapter 14).

Awareness. The moment an organisation becomes aware of an incident, from which reporting clocks start. The book records two awareness timestamps, when a system first flagged an event and when a person confirmed it, and opens every clock that could apply at the earlier one (Chapter 19).

B

B1 Anticipate. The function of knowing what is likely to come and where the organisation is exposed. It covers threat intelligence, exposure awareness and the hypotheses that direct detection and hunting (Chapter 2).

B2 Detect. The function of engineering, running and tuning the detections that turn telemetry into alerts (Chapter 2).

B3 Investigate. The function that turns an alert into a verified case through triage, scoping, analysis and forensics (Chapter 2).

B4 Respond. The function of containment, eradication, recovery coordination, communication and reporting (Chapter 2).

B5 Learn. The function of post-incident review, purple teaming and the improvement of detections, playbooks and mandates that follow (Chapter 2).

Back-pressure. The rule that a system gives way before the reviewer does. When review load grows, the agent's level is lowered, so that the pressure falls on the agent and not on the person (Chapter 14).

Blue team. The set of people and functions that defend an organisation. It owns the result of the purple loop (Chapter 2).

Board page. The single page the board sees on the team, with at most three decisions, each traced to a measure and produced from the records (Chapter 20).

Break-glass access. A sealed credential that grants a defined set of actions for a limited time to a named role, for cases outside the playbook. An agent never holds it (Chapter 10).

C

Canary. A decoy that no legitimate process touches, such as a ticket with instruction-like text addressed to the agent. If the agent acts on it, the action is a high-confidence signal of steered behaviour and triggers the stop path (Chapter 15).

Case record (CASE-*). The verified account of an alert or case, with the evidence, the reasoning and a note of who or what reached each conclusion under which delegation (Chapter 7).

Caught-seed rate. The seeded faults caught over the seeded faults injected. It is the direct measure of review quality and is read with its counts (Chapter 14).

Class owner. The named person who answers for the definition of an alert class and for its measured performance (Chapter 7).

Clock profile (CLK-*). The set of reporting clocks that apply to an organisation, held as code in the SOC repository with a market overlay for each entity (Chapter 19).

Closure class (SC-01 to SC-03). A narrow, named class of alerts that a closure policy allows a system to close, at a stated level and with a named owner (Chapter 7).

Closure policy (CLOSE-*). The policy that states, for each class, its definition, the evidence to close, the degree of delegation, the owner, the sampling and seeding rates and a stop condition written as numbers (Chapter 7).

Co-determination. The rights of employee representatives to be informed, consulted or to agree, as national law provides. In Germany it reaches tools that can monitor employees, under BetrVG §87(1) no. 6, as the book applies it to Hansa Mutual (Chapter 4).

Conductor. The person who conducts an agent team. In the SOC the conductor is the SOC lead, because the team's output is a closed alert, a verdict on an incident or a host taken off the network (Chapter 13).

Containment ledger. The handover record generated from the case record. It lists every action taken, at which level, under which playbook and with what rollback state, and the incident commander signs it (Chapter 10).

Containment profile (CP-*). The profile that states the ceiling on containment actions, read together with the permission manifest (Chapter 15).

Coverage statement. The record that ends a hunt, stating what was searched and what was not. A null result ends in a coverage statement (Chapter 9).

Custody record. The record of who handled evidence. The AI is named in it as an actor with an identity, a mandate and a work log (Chapter 8).

D

Decider. The named human who answers for a decision with a consequence for a person or an irreversible effect. A record of a delegated decision says who delegated it (Chapter 4).

Decision right. A requirement with a holder, a deputy, a response time, an evidence standard and a record (Chapter 18).

Decision-rights file (DRF-*). The file that holds the decision rights of a team, kept as code in a protected path that the paging tool reads (Chapter 18).

Decoy. A deliberately placed false asset, such as a decoy host, credential or token. Decoys detect the adversary and also check the SOC's own AI (Chapter 15).

Degraded mode. The manual way of working that the SOC keeps for the period in which agents, a class or the platform are stopped (Chapter 13).

Degrees of delegation. The levels, from Level 0 Advisory to Level 4 Autonomous, at which each capability may act, set per function and per action class (Chapter 4).

Delegation profile (DLG-*). The artefact that states, for each capability, the usage mode and the level at which it may act. An action that is not listed is not delegated (Chapter 4).

Delegation register. The sum of what has been delegated. Each row records the level, the record that granted it, the fallback if the AI is removed and the date of the next reversibility test (Chapter 4).

Detection debt. The accumulated cost of detections that no longer do what they claim (Chapter 6).

Detection record (DET-*). A versioned record of a detection with its logic, data sources, ATT&CK mapping, tests, owner, alert budget and review date (Chapter 6).

DORA. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. The book applies Article 5, on the management body, and Articles 17 to 19, on incident management, classification and reporting (Chapter 2).

E

Escape rate. The share of closed alerts in a class that a later review shows should not have been closed (Chapter 7).

Evidence to close. The conditions that must all hold, each checkable by the policy point, before a class of alerts may be closed (Chapter 7).

Exit. The ability to leave a provider and replace the service. The book treats it as a capability that is tested once a year (Chapter 16).

Expected. The label for a statement that is supported by a stated trend or a decided instrument (Chapter 1).

Extraction. The step in which intelligence is read and structured. The extraction system proposes at Level 1 Assisted and acts on nothing (Chapter 5).

F

Finding (FND-*). A gap or weakness recorded with an owner, a control and a re-test date. A finding is closed when the re-test passes and not before (Chapter 11).

G

Grant authority. The named authority that grants any level above Level 2 by a recorded decision, after confirming that the conditions for it were met (Chapter 4).

Grounding. The requirement that every technique, indicator and claim in an extraction links to a quoted span of its source. A proposal without a span is rejected (Chapter 5).

H

Horizon register (HZN-*). The register in which every trend carries a label, a trigger, an owner and a posture, and which is reviewed each year (Chapter 24).

Hunt record (HNT-*). The record of a hunt, holding the hypothesis and its source, the reviewed query pack with its costs, the result, the coverage statement and the conversion (Chapter 9).

I

Illustrative. The label on a worked example, scene or record that is not a real organisation's document. The scenes of the book are illustrative composites of two invented organisations (Chapter 1).

Incident commander. The role that leads a major incident. It assigns work, decides on containment with the business owner, controls communication and keeps the record (Chapter 2).

K

KBV-IT-2024. The group works agreement on IT systems between Hansa Mutual and its Konzernbetriebsrat. Its SOC annex limits what is logged about analysts and fixes the purpose of authorship records (Chapters 4, 6 and 21).

Known-answer event. A benign record kept in the data lake for testing. A query that misses it is treated as broken (Chapter 8).

L

Level 0 Advisory. The lowest level of the series' scale: the AI suggests and a person decides and acts. The book uses it for a new agent in shadow mode (Chapter 13).

Level 1 Assisted. The level at which a system recommends or drafts and a person confirms before anything is done. Drafting is set at this level by default (Chapter 4).

Level 2 Supervised. The level at which a person approves each action taken by the system (Chapter 4).

Level 3 Bounded. The level at which a system takes an action inside a codified playbook, and a policy decision point outside the model enforces the playbook (Chapter 4).

Level 4 Autonomous. The highest level, at which no person stands between a decision and its effect. The book never uses it for an irreversible B4 Respond action or for a decision about a named person's access to work (Chapter 4).

M

Management body. The body that approves the mandate and the resources and accepts residual risk. NIS 2 Article 20 and DORA Article 5 place oversight of risk management on it, and accountability does not pass to a tool (Chapter 4).

Mandate. The written authority of a team, with three parts: the scope of what it defends, the authority to act and the obligation to show that work was done within that authority (Chapter 4).

Mandate manifest (MND-*). The written mandate of an agent: its purpose, tasks, level for each action class, approvers, budget, escalation rules, review date and expiry. The platform enforces it outside the agent (Chapter 13).

Manual queue. The queue that people work by hand when agents or the platform are stopped, following the day-one runbook and tested in a drill (Chapter 16).

Mode 0 Ambient AI. AI that the organisation did not choose or switch on, which is a feature of a product or a service it has bought (Chapter 2).

Mode 0 blind spot. The risk that AI present in bought software escapes the organisation's decisions, because it was never an acquisition decision (Chapter 4).

Mode 1 Conversational assistants. The usage mode in which drafting and summarising are done with the analyst's own identity (Chapter 4).

Mode 2 Embedded workplace assistants. The usage mode in which recommendations appear inside the SOAR or EDR console (Chapter 4).

Mode 3 Agentic work tools. The usage mode in which a tool takes actions with the analyst's identity (Chapter 4).

Mode 4 Built AI applications. The usage mode in which services run with their own service identity (Chapter 4).

Mode 5 Autonomous production agents. The usage mode in which agents have an identity and permissions of their own (Chapter 4).

MITRE ATT&CK. The catalogue of adversary techniques, which the book uses as the common key that joins intelligence, detections and hunts (Chapter 2).

MS-1. The annex of the Nordvik Region framework that fixes paging times and gives the Region ownership of its detection content (Chapter 6).

MS-2. The annex of the Nordvik Region provider terms that turns the Mode 0 blind spot into six terms: levels and actions, quarterly sampling, audit rights, evidence, tuning and test rights, and notice of model change (Chapter 16).

MSSP. A managed security service provider, which holds part of a function by contract. Where it closes alerts, it carries out part of B3 Investigate on the organisation's behalf (Chapter 2).

N

NIS 2. Directive (EU) 2022/2555. Article 20 places the approval and oversight of cybersecurity risk-management measures on management bodies, and Article 23 sets the incident notification duties (Chapter 2).

NIST CSF 2.0. The NIST Cybersecurity Framework, with six Functions, to which the blue team functions are mapped. The CSF is a framework and not law (Chapters 1 and 2).

Notice of model change. The period of notice that a provider gives before a model, rule or threshold that affects closure or action changes. Annex MS-2 sets it at 20 working days (Chapter 16).

O

Observable. The label for a statement that is happening now and is documented (Chapter 1).

Originals. The first of the three evidence layers. They are never altered, and the AI reads copies and writes analysis (Chapter 8).

Oversight record. The record of a review: the key fact, the route used to reproduce it, the result and the reviewer's provisional view. It is what makes the difference between a review and an approval visible (Chapter 14).

Oversight-quality metric (OQM-*). The set of measures that show how review is conducted: time to approval, rejection rate, reversals, caught seeds, reproduction rate and unassisted share (Chapter 14).

P

Permission manifest. The list, for each agent, of its tools, action classes, targets, rate limit and autonomy level. The policy decision point enforces it, and a call outside it is denied (Chapter 15).

Playbook debt. The gap between the playbooks a team holds and those it can show work: rollbacks never exercised, stop paths never timed and approvers who have left (Chapter 11).

Playbook manifest (PBK-*). The object that carries the authority for an action. It names the trigger, the independent corroboration, the action, the limits, the approver, the rollback and the stop path, and a policy decision point enforces it (Chapter 10).

Policy decision point (PDP). The component outside the model that evaluates each tool call against the agent's permission manifest. Nothing the model reads can reconfigure it (Chapter 15).

Post-incident review (PIR-*). The blameless review of an incident, which is evidence-based and ends in changes to code that have owners, dates and re-tests (Chapter 11).

Pressure register (PRS-*). The register of the pressures on the team, each labelled observable, expected or speculation, with a local measure, a threshold and the decision it informs (Chapter 3).

Purple team. The joint loop between the red team and the blue team, in which a finding becomes a better detection, a better playbook or a better decision right (Chapter 2).

Q

Query pack. A set of hunt queries that a reviewer has read as code and approved before they run read-only on a schedule (Chapter 9).

Queue. The interface through which the SOC receives alerts. Anything that is not alerted is invisible to it (Chapter 2).

R

Red team. The team that emulates an adversary, under written rules of engagement, to test the defence (Chapter 2).

Rejection rate. The share of proposals rejected or sent back. Read on its own it does not show whether review is real, so the book reads it with the other metrics (Chapter 14).

Reopen rate. The share of closures that an analyst reopens on review. A rate that is too high shows that the class is not safe, and a rate of zero over many months may show that review is not real (Chapter 7).

Reproduction rate. The share of reviews in which the key fact was reproduced by another route (Chapter 14).

Residual queue. The part of the queue that remains with people after closure by class: ambiguous and novel cases that resemble tier 2 work (Chapter 7).

Response tiers. The tiers at which response decisions are taken, from the playbook through on-call, the incident commander and the executive to the management body. The lowest tier that can decide with the evidence decides (Chapter 18).

Review protocol. The protocol that sets the review tiers by level, requires reproduction for Level 2 and adds a critique agent for questions, not verdicts (Chapter 14).

Reversibility. Whether an action can be undone. Together with time and judgement, it is one of the three properties that decide how much of a function can be delegated (Chapter 2).

Role charter (ROLE-*). The charter of a role. It states what the role is for, its decision rights with time limits, its ceilings and what it may not do (Chapter 17).

S

Seeded error. A known fault placed in an AI output to measure whether review catches it (Chapter 14).

Seeded incident. A known case injected into the queue so that review can be seen to catch it (Chapter 14).

Shadow mode. The first step in introducing an agent, at Level 0 Advisory. The book's default is four weeks (Chapter 13).

Soundness. The standard that a conclusion of an AI system must meet: grounding, completeness, alternatives considered, stated confidence, reversibility and stability, defined in advance (Chapter 14).

SOC. The security operations centre, the group of analysts who monitor telemetry and work the alerts that detections raise (Chapter 2).

Speculation. The label for a statement that is plausible but not supported by present evidence (Chapter 1).

Stop drill. A timed exercise of the stop path, run on a schedule to check that the stop can be reached (Chapters 11 and 13).

Stop path. The route by which a system is stopped. It runs outside the system it stops, is held by named people who can use it without asking and is drilled (Chapter 10).

Stop right. The right, held by a named set of people, to stop an agent or a class at once, without prior approval or justification (Chapter 4).

T

T0 Own. The trust class of inputs produced by the SOC's own deterministic tooling, such as the asset inventory or case state, written by staff and pipelines under change control (Chapter 15).

T1 Telemetry. The trust class of inputs produced by systems the organisation runs, which contain attacker-chosen fields such as command lines and file names (Chapter 15).

T2 Submitted. The trust class of inputs written by a person with no technical integrity, such as tickets, phishing reports and email bodies (Chapter 15).

T3 Published. The trust class of inputs written by third parties and consumed as intelligence, such as threat reports and vendor feeds (Chapter 15).

Team charter (ROLE-*). The artefact that states what the team is for, who answers and who decides what. It is the top of the artefact stack and changes rarely (Chapter 4).

Threat hunt. The search for activity that no detection has flagged, starting from a testable hypothesis. It ends in a finding or a null result (Chapter 9).

Tier 0. The set of assets whose compromise gives control of everything else. A SOC platform qualifies because it reads telemetry across the estate, writes response actions and holds the detection content and case history (Chapter 15).

Tier 1. The tier at which alerts are taken in order of priority and either closed or escalated with the evidence gathered so far (Chapter 2).

Tier 2. The tier that investigates what tier 1 escalates, and closes it, escalates it to tier 3 or hands the case to incident response (Chapter 2).

Tier 3. The tier, where it exists, of the most experienced analysts, who take the hard cases, hunt and often write or review detections (Chapter 2).

Triage. The work that turns an alert into a verified case by deciding whether it is real, how serious it is and who needs to know. It belongs to B3 Investigate and not to B2 Detect (Chapter 2).

U

Unassisted share. The share of cases that a person works from raw data without the AI's summary. It shows whether the investigative skill that supervision depends on is still exercised (Chapter 14).

V

Verified, declared and failed. The three states of a control or detection on the coverage map. A detection counts as verified only when a recent test shows that it fires (Chapter 11).

W

Workload identity. The identity that an agent holds as a system and not as a person, which can be revoked. A Mode 5 agent has one (Chapter 4).

Working copies. The second of the three evidence layers. The AI may read them but never alter them, and it does not touch the originals (Chapter 8).

Works agreement. The agreement with employee representatives that limits what may be logged about analysts and how monitoring may be used (Chapters 12 and 21).