> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/appendix/glossary.md). # Glossary [A](#a) | B | [C](#c) | [D](#d) | [E](#e) | [F](#f) | [G](#g) | [H](#h) | [I](#i) | J | K | [L](#l) | [M](#m) | N | [O](#o) | [P](#p) | Q | [R](#r) | [S](#s) | [T](#t) | [U](#u) | V | [W](#w) | X | Y | Z ## A #### Advanced Persistent Threats Enginsight's **Advanced Persistent Threats** (APT) feature can detect and block sophisticated, persistent threats on [hosts](#host) where [Pulsar](#pulsar) is installed. #### Agent An **agent** is a largely autonomous program installed on a host to perform specific tasks. The Enginsight agent is the [Pulsar](#pulsar) component. #### Anomalies **Anomalies** is one of the Enginsight microservices running on the Enginsight [Application Server](#application-server). It compares the baseline progression of machine learning metrics with the measured data to detect anomalies. #### API Collector [Collectors](#collectors) collect, process, and forward raw logs to the Enginsight [SIEM](#siem). **API collectors** are preconfigured collectors for cloud applications from well-known vendors. #### Application Server The Enginsight **Application Server** runs the Enginsight platform's user interface, API, and all Enginsight services. #### Asset In Enginsight, an **asset** is either a [host](#host) (a server or client) or an [endpoint](#endpoint) (a website or domain). #### Automatic System Hardening Enginsight's **automatic system hardening** helps you meet technical requirements and legal compliance obligations. It includes security-relevant technical checks on your [hosts](#host), which are performed automatically. If required, the corresponding system-hardening measures are rolled out automatically to assigned hosts. #### Autopilot **Autopilot** is part of the Enginsight [Shield](#shield) component. It is an automated ruleset that can automatically drop or block network attacks detected by the [Intrusion Detection System](#intrusion-detection-system). *** ## B *** ## C #### Cockpit **Cockpits** are part of the Enginsight [SIEM](#siem). They are custom dashboards that are created based on filtered log entries from the [data lake](#data-lake), known as [streams](#stream). #### Collectors **Collectors** collect, process, and forward raw logs to the Enginsight [SIEM](#siem). [General collectors](#general-collector) include event relays, which collect syslog data, and log file collectors, which collect raw data from specific log files on selected hosts. [Host collectors](#host-collector) are operating system-specific collectors that collect raw data from the specific logs of selected Windows, Linux, and macOS hosts. [API collectors](#api-collector) are preconfigured collectors for cloud applications from well-known vendors. #### Control **Controls** are part of the [automatic](#automatic-system-hardening) and [organisational system hardening](#organisational-system-hardening). A control is a measure that must be followed to meet technical, organisational, and legal compliance requirements. *** ## D #### Data Lake The **data lake** is part of the Enginsight [SIEM](#siem). It serves as a central data source that combines, indexes, and groups raw data collected by [collectors](#collectors) from a wide variety of logs. #### Database Server The Enginsight **Database Server** is the central storage location for all Enginsight platform data except data belonging to the Enginsight [SIEM](#siem). Enginsight uses MongoDB, a document-oriented NoSQL database management system. #### Discovery In Enginsight, a **discovery** is the agentless inventory of all network devices in an organization's IT infrastructure. Discoveries are performed using the Enginsight component [Watchdog](#watchdog). *** ## E #### Endpoint An **endpoint** in Enginsight is an internal or external website or domain that is monitored from different locations, such as internal or external networks or different geographical regions, using the Enginsight component [Observer](#observer). #### Environmental Score The **Environmental Score** (ENVS) is part of the Common Vulnerability Scoring System (CVSS). It allows you to adapt CVSS Base Metrics individually to the security and organizational requirements of your IT environment. This helps you assess more accurately the actual risk that detected vulnerabilities pose to your organization. The **Environmental Score Manager** in Enginsight allows you to select predefined ENVS metrics for assigned [hosts](#host) or [endpoints](#endpoint) to calculate their security risk based on your infrastructure. #### Extractor **Extractors** are part of the Enginsight [SIEM](#siem). An extractor allows you to retrieve specific information from source fields in collected logs and integrate it into other standard target fields or custom fields. *** ## F #### File Integrity Monitoring Enginsight's **File Integrity Monitoring** (FIM) feature monitors the integrity of files and directories in real time on all [hosts](#host) where [Pulsar](/docs/manual/english/installation-and-configuration/installation-and-configuration/enginsight-components/pulsar.md) is installed. Monitoring is based on the operating system's file system events, allowing modifications or access to files and directories to be detected immediately. #### Flow **Flows** are part of the Enginsight [SIEM](#siem). In Enginsight, a flow is a single run of a [playbook](#playbook). *** ## G #### General Collector [Collectors](#collectors) collect, process, and forward raw logs to the Enginsight [SIEM](#siem). **General collectors** include event relays, which collect syslog data, and log file collectors, which collect raw data from specific log files on selected [hosts](#host). #### Generator **Generator** is one of the Enginsight microservices running on the Enginsight [Application Server](#application-server). It generates PDF reports for hosts, endpoints, penetration tests, and other objects. *** ## H #### Hacktor **Hacktor** is an Enginsight component installed as a service in a specific network segment to perform [penetration tests](#penetration-test) on reachable [assets](#asset) using specific checks. #### Historian **Historian** is one of the Enginsight microservices running on the Enginsight [Application Server](#application-server). It aggregates measured data so that it can be displayed over time. #### Host In Enginsight, a **host** is a server or client on which the Enginsight [Pulsar](#pulsar) [agent](#agent) is installed to monitor the host from within. #### Host Collector [Collectors](#collectors) collect, process, and forward raw logs to the Enginsight [SIEM](#siem). **Host collectors** are operating system-specific collectors that gather raw data from the specific logs of selected Windows, Linux, and macOS hosts. *** ## I #### Incident In Enginsight, custom alerts can trigger and display [issues](#issue) and incidents. **Incidents** are one-time occurrences that indicate a specific condition and can be reviewed immediately. They remain open until they are manually marked as reviewed. #### Intrusion Detection System Enginsight's **Intrusion Detection System** (IDS) monitors network traffic on all [hosts](#host) where [Pulsar](#pulsar) is installed to detect attacks, misuse, and violations of security policies. #### Intrusion Prevention System Enginsight's **Intrusion Prevention System** (IPS), the [Shield](#shield) component, allows network traffic and network attacks detected by the Enginsight Intrusion Detection System (IDS) to be blocked individually on all [hosts](#host) where [Pulsar](#pulsar) is installed. #### Issue In Enginsight, custom alerts can trigger and display issues and [incidents](#incident). **Issues** are persistent or recurring conditions that continue over a certain period of time. They are closed automatically as soon as the condition no longer applies and the problem has been resolved. *** ## J *** ## K *** ## L #### Load Balancer In a load-balanced Enginsight setup, the **Load Balancer** receives external requests from [hosts](#host) and forwards them to the appropriate server. nginx is installed on the Load Balancer and ensures that external connections are encrypted via HTTPS using SSL/TLS certificates. #### Loggernaut **Loggernaut** is a component of the Enginsight [SIEM](#siem). It is usually installed on the [SIEM Management Server](#siem-management-server) and acts as the SIEM's central control element. *** ## M #### Microsegmentation **Microsegmentation** divides a network into smaller, isolated sections to ensure that an attack or malware infection cannot spread across the entire IT infrastructure. On the Enginsight platform, microsegmentation is implemented on a [host](#host) basis. #### Mongo Dump Enginsight uses MongoDB, a document-oriented NoSQL database management system, as its database. A **Mongo dump** is a backup of the MongoDB-based database. *** ## N *** ## O #### Obfuscators **Obfuscators** are part of the Enginsight [SIEM](#siem). They allow field values in selected fields to be masked. The masked information is then displayed, for example, only as asterisks (\*) in the [data lake](#data-lake). #### Observation In Enginsight, an **observation** is the agentless monitoring of a domain or network device on which [Pulsar](#pulsar) cannot be installed. Observations are performed using [Simple Network Management Protocol (SNMP) monitoring](#snmp-monitoring), [ping monitoring](#ping-monitoring), or [port monitoring](#port-monitoring). For observations, the Enginsight component [Watchdog](#watchdog) is used. #### Observer **Observer** is an Enginsight component that is installed as a service on servers that represent different locations, such as internal or external networks or different geographical regions, to monitor [endpoints](#endpoint) (websites and domains). #### Organization Enginsight is multi-tenant. Enginsight instances are managed through **organizations**, which can be main organizations and suborganizations. #### Organizational System Hardening Enginsight's **organizational system hardening** includes security-relevant, non-technical checks of processes within an [organization](#organisation) that require human action. Like the [automatic system hardening](#automatic-system-hardening), it helps meet organizational process requirements and legal compliance obligations. *** ## P #### Penetration Test A **penetration test** is a planned, controlled, and automated attack on an organization's own systems to systematically identify vulnerabilities. Penetration tests are performed using the Enginsight component [Hacktor](#hacktor). They can be performed on [hosts](#host) where [Pulsar](#pulsar) is installed or across entire network ranges. Systems monitored within the network by a [Watchdog](#watchdog) can also be defined as targets. #### Ping Monitoring **Ping monitoring** uses ping checks to monitor the availability and response times of domains and network devices on which [Pulsar](#pulsar) cannot be installed. #### Playbook **Playbooks** are part of the Enginsight [SIEM](#siem). They allow complex response processes for events triggered by a [workflow](#workflow) to be orchestrated and executed automatically. #### Plugin In Enginsight, **plugins** are custom scripts that can be executed in response to a specific system event or as a scheduled activity on assigned [hosts](#host) where [Pulsar](#pulsar) is installed. #### Port Monitoring **Port monitoring** uses port checks to monitor the availability of domains and network devices on which [Pulsar](#pulsar) cannot be installed by checking whether specific ports are reachable. #### Profiler **Profiler** is one of the Enginsight microservices running on the Enginsight [Application Server](#application-server). It calculates the baseline progression of machine learning metrics. #### Pulsar **Pulsar** is an agent installed on a [host](#host), meaning a server or client, to monitor it from within and detect and block network attacks. In the context of the Enginsight [SIEM](#siem), Pulsar also acts as a [collector](#collectors) for raw logs, which are then forwarded to the SIEM. *** ## Q *** ## R #### Reporter **Reporter** is one of the Enginsight microservices running on the Enginsight [Application Server](#application-server). It supplies the Enginsight platform with current vulnerability data (CVEs) and distributes it to the individual platform components. *** ## S #### Scheduler **Scheduler** is one of the Enginsight microservices running on the Enginsight [Application Server](#application-server). It triggers scheduled automated actions, such as plugins or audits. #### Sentinel **Sentinel** is one of the Enginsight microservices running on the Enginsight [Application Server](#application-server). It manages alerts and their associated notifications. #### Shield **Shield** is Enginsight's [Intrusion Prevention System](#intrusion-prevention-system) (IPS). It allows network traffic and network attacks detected by the Enginsight [Intrusion Detection System](#intrusion-detection-system) (IDS) to be blocked individually on all [hosts](#host) where [Pulsar](#pulsar) is installed. #### SIEM The Enginsight **SIEM (Security Information and Event Management)** collects comprehensive security information from various internal and external log sources, analyzes incoming log data, and makes it available for further processing in a central [data lake](#data-lake). For example, critical event patterns can be detected using [workflows](#workflow). These events can then be used in [playbooks](#playbook) to define and execute automated response processes. #### SIEM Index Server The **SIEM Index Server** is the primary database for the Enginsight [SIEM](#siem). It indexes logs and makes them easy to search. #### SIEM Management Server The **SIEM Management Server** is part of the Enginsight [SIEM](#siem). It receives logs through the Enginsight API and forwards them to one or more [SIEM Index Servers](#siem-index-server), where they are processed. #### SNMP Monitoring **SNMP monitoring** uses SNMP sensors to monitor network devices on which [Pulsar](#pulsar) cannot be installed. Monitoring is performed using the Simple Network Management Protocol (SNMP) based on Management Information Base (MIB) files. #### Stream **Streams** are part of the Enginsight [SIEM](#siem). A stream is a managed or custom log filter used to filter and display raw logs from the [data lake](#data-lake). *** ## T #### Themis **Themis** is one of the Enginsight microservices running on the Enginsight [Application Server](#application-server). It acts as an integrity manager and checks data for correctness and currency. #### TLS Interception Enginsight's **TLS Interception** feature allows encrypted network traffic to be decrypted locally on a Linux [host](#host) by the Enginsight [agent](#agent) [Pulsar](#pulsar) and analyzed for attack patterns using the [Intrusion Detection System](#intrusion-detection-system). #### Tracer **Tracer** is an Enginsight component responsible for Machine Learning-based time series analysis in the Enginsight [SIEM](#siem) and on [hosts](#host). *** ## U #### Updater **Updater** is one of the Enginsight microservices running on the Enginsight [Application Server](#application-server). It manages and updates configuration checklists for [hosts](#host). *** ## V *** ## W #### Watchdog **Watchdog** is an Enginsight component installed in a subnet to monitor network devices on which [Pulsar](#pulsar) cannot be installed or to inventory devices without using an [agent](#agent). #### Workflow **Workflows** are part of the Enginsight [SIEM](#siem). They allow conditions to be defined based on [streams](#stream), triggering a SIEM incident when those conditions are met. *** ## X *** ## Y *** ## Z ***