Quickly learn the definitions and functions of key networking technologies, and how Netscout incorporates these technologies into products and solutions. These pages can help you understand benefits, what you can do with the technology, and how it works, with links to additional resources.
For education and training specific to Netscout products and solutions, please visit our Support and Services page.
In-depth guides and blogs written by talented network and security experts.
Learn About Cybersecurity
Cybersecurity fundamentals and modern techniques for safeguarding and defending electronic data from cyberattacks.
Learn About Network Monitoring
Key information on getting full network visibility to finally see and understand your entire network
Learn About DDoS Attacks
In a distributed denial-of-service (DDoS) attack, a network of computers work in tandem to overflow an access point and prevent legitimate users from accessing a service.
Learn About Mobile Network Monitoring and 5G
Understanding mobile network technologies to monitor and manage your entire network.
F-L
What is an Incident?
An occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies.
What is an Incident of Attack?
An Indicator of Attack (IOA) is differentiated from an IOC (q.v.) by quality and a lower incidence of false positives. It can be thought of as a higher quality indicator of a true attack. ASERT differentiates IOAs from IOCs on the basis of quality and insight. IOCs are mere indicators of malicious software, while IOAs from the Arbor perspective are high fidelity and help identify malice and intent in the form of Campaigns (i.e. directed, persistent efforts by a proven Attackers).
Controversy: IOA as a term was coined recently by Counterstrike (a Threat Intelligence provider) and as such is not as well-known as IO, may change definition readily and may lead to some confusion among vendors who try to co-opt the term (as Arbor has done).
What is Incident Response (IR)?
The manual and automated procedures used to respond to reported incidents (real or suspected), systems failures and errors, and other undesirable events.
What is an Incident Response Plan?
The documentation of a predetermined set of instructions or procedures to detect, respond to, and limit consequences of a malicious cyber-attacks against an organization’s information system(s).
What is an Indicator of Attack?
An Indicator of Attack (IOA) is differentiated from an Indicator of Compromise (q.v.) by quality and a lower incidence of false positives. It can be thought of as a higher quality indicator of a true attack. ASERT differentiates IOAs from IOCs on the basis of quality and insight. IOCs are mere indicators of malicious software, while IOAs from the...
An Indicator of Attack (IOA) is differentiated from an Indicator of Compromise (q.v.) by quality and a lower incidence of false positives. It can be thought of as a higher quality indicator of a true attack. ASERT differentiates IOAs from IOCs on the basis of quality and insight. IOCs are mere indicators of malicious software, while IOAs from the Arbor perspective are high fidelity and help identify malice and intent in the form of Campaigns (i.e. directed, persistent efforts by a proven Attackers).
An Indicator of Compromise (or IOC) is found normally in the context of a threat feed as an item shared that might lead to discovery of an exploit or malware. An IOC is the result of research by third parties or investigators who are observing and documenting rogue behavior of attackers and malware. IOCs typically produce high false positives (i.e. alarms that aren’t real). Related terms include IOA (q.v.) and Tactics, Techniques and Practices" (TTP).
Controversy: IOA as a term was coined recently by Counterstrike (a Threat Intelligence provider) and as such is not as well-known as IO, may change definition readily and may lead to some confusion among vendors who try to co-opt the term (as Arbor has done).
What is an Indicator of Compromise?
An Indicator of Compromise (or IOC) is found normally in the context of a threat feed as an item shared that might lead to discovery of an exploit or malware. An IOC is the result of research by third parties or investigators who are observing and documenting rogue behavior of attackers and malware. IOCs typically produce high false positives (i.e...
An Indicator of Compromise (or IOC) is found normally in the context of a threat feed as an item shared that might lead to discovery of an exploit or malware. An IOC is the result of research by third parties or investigators who are observing and documenting rogue behavior of attackers and malware. IOCs typically produce high false positives (i.e. alarms that aren’t real). Related terms include IOA (q.v.) and "Tactics, Techniques and Practices" (TTP).
Controversy: IOCs are seen as less interesting to the industry than TTPs, which is the equivalent to an IOC with respect to specific attackers and attacker groups.
Cybersecurity Awareness Month
Every October, the NETSCOUT team promotes the conversation around Cybersecurity Awareness Month. We share resources and expertise on how everyone, from end users to service providers, can improve their cyber literacy, keep up with the newest technologies, and join the industry.
Learn how to stay safe online with our helpful resources.