Reference

The terms this project uses

Plain-English definitions for the terms and abbreviations used on this site.

KEVKnown Exploited Vulnerabilities catalogue: A free public list, published by the U.S. Cybersecurity and Infrastructure Security Agency, of software flaws that criminals are confirmed to be exploiting. Each entry carries a date by which U.S. federal agencies must fix it. A flaw is on the list because attacks using it have actually been observed, not because someone judged it risky. Official source (CISA) →
CPGCross-Sector Cybersecurity Performance Goals: A voluntary baseline of security practices published by the U.S. Cybersecurity and Infrastructure Security Agency, written specifically for organizations too small to employ security staff. It is a short, plainly written starting list rather than a full standard. Official source (CISA) →
CISACybersecurity and Infrastructure Security Agency: The U.S. federal agency responsible for national critical-infrastructure cybersecurity. Its publications are works of the U.S. government and are free to use. Official source →
NIST SP 800-53the U.S. federal catalogue of security requirements: The catalogue of security and privacy requirements published by the National Institute of Standards and Technology, a U.S. federal agency. U.S. government systems are measured against it, and many private organizations adopt it voluntarily. Each requirement has an identifier such as AC-2. Official source (NIST) →
SECSecurities and Exchange Commission: The U.S. financial regulator. Public companies must file a report with it when they experience a cybersecurity incident that matters to investors, which makes those filings a public record of incidents that actually happened. Official source →
SIEMsecurity information and event management system: The system an organization uses to collect records of what happens across its computers in one place, so questions can be asked across all of them at once. Microsoft Sentinel and Splunk are two examples.
KQLKusto Query Language: The language used to ask questions of data held in Microsoft Sentinel. A query written in it is text, like a spreadsheet formula, and can be read before it is run.
SPLSearch Processing Language: The language used to ask questions of data held in Splunk. A query written in it is text and can be read before it is run.
SQLStructured Query Language: The most widely used language for asking questions of stored data — the one taught in most database courses and used by most business reporting tools. Anyone who has written a database query has almost certainly written it in this.
Athena SQLthe query language of Amazon Athena: A standard way of asking questions of data stored in Amazon Web Services. It is ordinary SQL, the most widely used data query language in existence, which makes these the most broadly readable of the three query languages here.
MFAmultifactor authentication: Requiring a second step at sign-in beyond the password — a code from a phone, a hardware key, a fingerprint. It is the single most effective protection against a stolen password.
RPOrecovery point objective: How much recent work an organization has decided it can afford to lose. A four-hour objective means backups must be recent enough that no more than four hours of work would be lost.
CVECommon Vulnerabilities and Exposures identifier: The public reference number given to a specific software flaw, such as CVE-2024-1709, so that everyone discussing it means the same flaw.
CWECommon Weakness Enumeration identifier: A reference number for a *type* of programming mistake, rather than one specific flaw — for example, the class of mistake that allows a database to be manipulated through a web form.
tenantan organization's own space in a cloud service: The separate area of a shared cloud service that belongs to one organization. Running a check 'against a live tenant' means running it on a real organization's real data rather than on test data.
sourcetypea label naming the kind of record: A label attached to incoming records saying what kind of record it is — sign-in events, firewall rules, backup results. Because the checks here read the label rather than any vendor's own format, one check covers many different products.
lab-validatedexecuted in a controlled test environment: The check has been run, by the maintainer, against real security software loaded with purpose-built test data, and what it returned was recorded. It has not been run on any real organization's data.
not tenant-validatednever executed against real data: The check has passed the project's automated tests for structure and syntax, but has never been run against real data anywhere. Test it in a safe scope before relying on any result.

Where to go next

The control library — every published check, with what it finds and what it does not prove.
Coverage of the federal baseline — which of CISA's goals this project answers, and which it does not.
Recent public disclosures — what has gone wrong lately, and which check speaks to it.