(flowpro-glossary)=

# Glossary

This glossary is meant to serve as a reference for terms and concepts used in the FlowPro system software or this product manual.

## FlowPro

`````{dropdown} View content

(glossary-flowpro)=

BotNet

: A network of private computers infected with malicious software and controlled as a group without the owners' knowledge

Command and Control

: Command and Control cyberattacks (C2 or C&C) happen when bad actors infiltrate a system and install malware that lets them remotely send commands from a C2 server to infected devices

Data Exfiltration

: Unauthorized data transfer, either manually from a device or over a network

DGA (Domain Generation Algorithms)

: Algorithms seen in various families of malware that are used to periodically generate a large number of domain names that can be used as rendezvous points with the command and control servers

DNS Data Leak

: DNS server requests that are visible to third parties

Domain Reputation List

: List of domains that have been determined, with a high probability, to be "bad domains"

DPI (Deep Packet Inspection)

: An advanced method of examining and managing network traffic, functioning at the application layer of the OSI model

JA3 Signature

: A method to fingerprint an SSL/TLS client connection based on fields in the Client Hello message from the SSL/TLS handshake. So named as it was first published by John Althouse, Jeff Atkinson, and Josh Atkins from Salesforce in 2017

Observation Domain
: A value used by the collector device to group devices when receiving data sessions

plixer.ini

: FlowPro configuration file

Trusted Domain List

: List of domains that are allowed on the network (whitelisted)

`````

## General networking

`````{dropdown} View content

(glossary-general)=

2LD (Second-level Domain)

: Part of the naming convention for domain names.  For example, in example.com, *example* is the second-level domain of the .com TLD (Top level domain)

3LD (Third-level Domain)

: For example, in www.mydomain.com, *www* is the third-level domain

ACK (Acknowledgment Code) 

: A unique signal sent by a computer to show that it has successfully transmitted data

ACL (Access Control List)

: A set of rules governing access to a particular object or system resource

Active Directory / AD

: Proprietary directory service offered by Microsoft, which allows for centralized management of users, devices, and other IT assets

API (Application Programming Interface) 
: A software component that allows applications to share data and functionality
     
ARP (Address Resolution Protocol)

: Protocol that maps a dynamic IP address to a physical machine's permanent MAC address in a local area network (LAN)

CA (Certification Authority) 

: A trusted entity that issues, signs, and stores digital certificates

CDP (Cisco Discovery Protocol)
: Protocol used by Cisco devices to allow neighboring networking devices to learn about each other

CIDR (Classless Inter-Domain Routing) 

: An IP addressing method that improves the efficiency of allocating IP addresses

CLI (Command-line Interface) 

: A text-based interface for applications and operating systems that allows a user to enter commands

Collector

: SIEMs, Flow Collectors, SNMPTrap Receivers, or other network management systems that analyze data forwarded from networked devices

DHCP (Dynamic Host Configuration Protocol)

: Network management protocol used to automatically assign IP addresses and other communication parameters to devices on an Internet protocol network

DNS (Domain Name System) 

: A system by which computers and other devices on the Internet or Internet protocol networks are uniquely identified using names matched to their IP addresses

Egress

: Traffic that exits a device or network

Endpoint 

: An entity (device, service, node, etc.) at the end of a network communication channel

Encapsulated Remote SPAN (ERSPAN)

: Encapsulates mirrored traffic in GRE (Generic Routing Encapsulation) and sends it over Layer 3 networks

ESX (Elastic Sky X)

: A pre-configured, ready-to-deploy virtual machine (VM) designed to run on VMware ESX or ESXi

Exporter

: A networked device such as a router, switch, or server that generates data and sends it to the flow collector device

Fault tolerance

: A system's ability to continue operating without interruptions in the event of hardware or software failure
     
FQDN (Fully Qualified Domain Name)

: The complete address of a computer, host, or any other entity on the Internet

GRE (Generic Routing Encapsulation)

: A tunneling protocol developed by Cisco Systems

Hyper-V

: A pre-configured, ready-to-deploy virtual machine designed to run on Microsoft Hyper-V, typically packaged in VHD/VHDX format

ICMP (Internet Control Message Protocol) 

: A protocol used for devices within the network to determine possible network issues

Identity Provider (IdP)

: A third-party entity and/or service that stores and manages identities and credentials for use by other websites, applications, or other digital resources

IP address
: A unique numerical label assigned to a networked device 

IPFIX (Internet Protocol Flow Information Export) 

: A protocol intended to collect and analyze the flow data from supported network devices

KVM (Kernel-based Virtual Machine)

: A pre-configured virtual machine designed to run on KVM hypervisors, packaged in formats like QCOW2 or OVA for easy deployment in Linux-based virtualization environments

Latency

: The latency of a network is the time it takes for a data packet to be transferred from its source to the destination

LDAP (Lightweight Directory Access Protocol) 

: An open, cross-platform protocol used to access and maintain directory services for assets in an Internet protocol network
       
LLDP (Link Layer Discovery Protocol)

: A vendor-neutral protocol used by devices on IEEE 802 networks to advertise their identity, capabilities, and other information

MAC (Media Access Control) address 

: A unique hardware identifier typically assigned by manufacturers to network adapters and devices
     
MIB (Management Information Base)

: A database that stores information used for managing a network

MTTR (Mean Time to Resolution) 

: The average amount of time between the detection and remediation of a security threat or incident

NDR (Network Detection and Response)

: A cybersecurity solution that uses machine learning to detect cyber threats and aid remediation

Network interface

: A (physical or software-based) point of connection between a network entity and the rest of the network

NIC (Network Interface Card)

: Adapter that provides devices network connections, either wired or wireless

NID (Network Infrastructure Device)

: Any device, such as an access point, router, or switch, that provides the means for entities to communicate with each other over a network

NTP (Network Time Protocol) 

: A networking protocol used to synchronize device clocks over the Internet

NXDOMAIN (No Existing Domain) 

: An error message that means that a domain mentioned in the Domain Name System (DNS) query does not exist
     
Open port

: A TCP or UDP port that has been configured to accept packets

OUI (Organizationally Unique Identifier)

: A unique 24-bit number in a MAC address that identifies the vendor or the manufacturer of the device

OVF (Open Virtualization Format)

: An open source standard for packaging and distributing virtual machines and software applications 

Packet 

: A block of data transmitted across a network

PDU (Protocol Data Unit)

: An individual unit of information exchanged by entities on a network using the same protocol

PostgreSQL

: An open-source relational database management system (RDBMS) that supports both SQL and JSON querying

PXE (Preboot Execution Environment)

: A network booting protocol that allows computers to boot from a network rather than a local storage device like a hard drive or USB

RADIUS (Remote Authentication Dial-In User Service) 

: A client-server AAA (authentication, authorization, accounting) protocol used to manage remote user access to a network

Redundancy

: The state of having duplicate or alternative services as backups to allow for continuous availability

REST API (Representational State Transfer Application Programming Interface)

: A set of rules that allows systems to communicate over the web using standard HTTP methods

Router

: A device that forwards or routes data packets to devices on a network

Server

: A system or device that provides resources, data, services, or applications to other devices over a network

Single Sign-On (SSO)

: A technology that enables users to access multiple applications with a single set of credentials through third-party authentication services

SIP/RTP (Session Initiation Protocol/Real-Time Protocol)

: SIP is the control protocol, and RTP is the payload protocol used to send and receive Voice over IP (VoIP)

SNMP (Simple Network Management Protocol)

: An IP network protocol used to collect data related to state and/or behavior from devices on a network

SNMP trap

: An alert message that is initiated by an SNMP-enabled device to notify the management system of significant events or changes in status

Software agent

: A persistent piece of software that performs certain actions and/or interacts with its environment on behalf of a user or another program

SPAN (Switched Port Analyzer)

: A dedicated port on a switch that takes a mirrored copy of network traffic from within the switch to be sent to a destination

SSDP (Simple Service Discovery Protocol)

: A network protocol used for advertising and discovering network services

SSH (Secure Shell Protocol)

: A network communication protocol that allows network services to be used securely over an unsecured network

SSL (Secure Sockets Layer)

: A protocol for establishing secure connections between networked devices

STIX (Structured Threat Information eXchange)

: An industry-standard file format for the exchange of threat information between organizations and platforms

Suricata

: A network threat detection engine used to analyze network traffic and identify potential security threats

Switch

: A device that connects devices in a network and allows them to communicate with each other

SYN scan

: A port scanning technique that allows for the discovery of the status of a communications port without establishing a full connection

Syslog

: A cross-platform network logging protocol used to send and/or receive alerts between different devices on a network

TACACS+ (Terminal Access Controller Access-Control System)

: A protocol where the remote access server and the authentication server provide validation for users attempting to access the network

TAXII (Trusted Automated eXchange of Indicator Information)

: A protocol that allows the transmission of threat information, primarily in STIX format, between systems and organizations

TCP (Transmission Control Protocol)

: A connection-oriented protocol that enables the bidirectional exchange of messages between devices on the same network

TLS handshake

: The process that starts secure communication between a client and a server

TSIG (Transaction Signature)

: A protocol that secures DNS packets and allows a Domain Name System to authenticate updates to the DNS database

TTL (Time To Live)

: A field in the IP packet header that specifies the maximum number of hops (or router passes) a packet can take before being discarded

UDP (User Datagram Protocol)

: A communication protocol for transmitting messages between applications and programs in a network

Virtual appliance

: A pre-configured virtual machine image with pre-installed software that is meant to serve a specific function

VoIP (Voice over Internet Protocol)

: A technology that allows voice calls using an internet connection

VPC (Virtual Private Cloud)

: A secure and private cloud hosted in a public cloud

VRF (Virtual Routing and Forwarding)

: A technology that separates routing tables to isolate management traffic to the management interface

Web server banner

: A text-based greeting message, which includes information like open ports, services, and version numbers, returned by a web host

`````