| Use case |
A scheduled correlation search that raises alerts. Vyrux also calls it a rule |
| Root cause |
The one problem behind several broken use cases, such as a field that stopped arriving |
| Assurance score |
A score from 0 to 100 built from telemetry, detections and coverage |
| Broken |
A use case that cannot fire |
| Silent |
A log with no events for longer than its limit |
| Over-firing |
A use case firing above your limit of alerts a day |
| Drift |
A field whose presence changed sharply compared with last week |
| CIM |
The Splunk Common Information Model. Standard field names that standard detections expect |
| ATT&CK technique |
One attacker method from the MITRE ATT&CK framework, such as T1078 Valid Accounts |
| Mapped, validated, tested |
A rule claims the technique; the rule works and has data; a test proved it |
| Burn-in |
The watch period after a new log or parser goes live |
| Approval |
A change waiting for a second person before it reaches Splunk |
| Snoozed |
Hidden for 7 days, then back |
| Suppressed |
Hidden until something about it changes, with a reason |
| Credits |
What Chuka uses. They reset monthly and do not carry over |