# Glosario — Ciberseguridad Defensiva: Operar como SOC

Términos que el curso usa y que el examen puede pedir.

| Término | Definición en una línea |
|---|---|
| **Tríada CIA** | Confidentiality, Integrity, Availability: what every control protects. |
| **Control preventivo/detectivo/correctivo** | Stops it from starting / notices it happening / fixes it afterward. |
| **Telemetría** | Set of logs and signals from which detection is built. |
| **SIEM** | Security Information and Event Management: centralizes and correlates logs. |
| **Correlación** | Joining events from different sources into one timeline. |
| **EICAR** | Harmless test file to verify that antivirus detects. |
| **NIST 800-61** | Incident response lifecycle standard: preparation → lessons learned. |
| **Contención** | Isolate affected machines to stop spread. |
| **Erradicación** | Remove the cause: accounts, malware, entries. |
| **Playbook** | Pre-written script per incident scenario. |
| **Hardening** | Reducing attack surface to the minimum necessary. |
| **CIS Benchmark** | Internationally recognized hardening checklist per system. |
| **Backup 3-2-1** | 3 copies, 2 media, 1 offsite; and tested restoration. |
| **RPO/RTO** | How much data I can lose / how long I can be down. |
| **False positive** | Alert that was not an attack: tuning noise. |
| **Lecciones aprendidas** | Post-incident report; without it the cycle does not close. |

> Regla de estudio: si no sabes explicarlo en una frase a alguien de fuera, aún no lo sabes.