Practice vocabulary for SOC threat detection: detection rules, UEBA baselines, detection gaps, detection engineering, and rule tuning.
0 / 10 completed
1 / 10
When a SIEM detection rule generates an alert because specific log conditions were met, you say:
The detection rule fires when X conditions are met — for example, 'fires when login failures exceed 10 in 5 minutes from a single IP'.
2 / 10
When a user behavior analytics system learns normal activity patterns and alerts on unusual deviations, this is called:
The UEBA baseline detects anomalous behavior — UEBA (User and Entity Behavior Analytics) builds behavioral baselines and flags statistical outliers.
3 / 10
When a specific attack technique has no detection rule covering it in the SIEM, this is called:
The detection gap — we have no coverage for this TTP — TTPs (Tactics, Techniques, Procedures) from MITRE ATT&CK are often used to map detection coverage.
4 / 10
The SOC team role responsible for writing, testing, and maintaining detection rules is called:
The detection engineer creates the rule — detection engineers translate threat intelligence and adversary TTPs into working SIEM queries and correlation rules.
5 / 10
When a detection rule generates too many false positives and is adjusted to be more specific, this process is called:
The rule is tuned to reduce false positives — tuning may involve adding exclusions, raising thresholds, or adding corroborating conditions to reduce noise.
6 / 10
Alex from the Security Operations team commented on a code review: 'This log entry shows a failed login attempt from 192.168.1.100 at 3:45 AM. I'm flagging this as potentially malicious – we should investigate.' What does 'flagging' mean in this context?
'Flagging' here refers to an initial step in the security process. It doesn't imply a definitive determination of malicious activity but rather a signal to prioritize investigation and scrutiny. The team is marking this event as noteworthy due to its unusual timing and source IP address, prompting deeper analysis before concluding anything.
7 / 10
Sarah in the Threat Intelligence team sent a Slack message: 'We've observed an increase in anomalous network traffic originating from users accessing our internal development servers. Our User Behavior Analytics (UBA) system is detecting deviations from established baseline activity patterns, specifically elevated data transfer volumes during off-peak hours.' What is the primary function of the UBA system described here?
UBA systems are designed to establish a 'normal' baseline of user activity. By monitoring and analyzing this baseline, they can then detect anomalies – unexpected deviations from the norm – which could signal a security threat or operational issue. This contrasts with simply blocking access or encrypting data; UBA focuses on *detection*.
8 / 10
David, a DevOps engineer, is writing the PR description for a new firewall rule: 'This rule blocks all outbound connections from the development servers to known malicious IP addresses listed in our threat intelligence feeds. The SIEM will monitor traffic against this rule.' What does 'threat intelligence feeds' represent?
Threat intelligence feeds are a crucial component of proactive security. They provide up-to-date information on actively exploited threats – IP addresses, domains, malware signatures – that can be used to immediately mitigate risks. These feeds are continuously updated with the latest threat data.
9 / 10
Maria, a Security Analyst, is explaining her role during a standup meeting: 'I'm responsible for creating and maintaining the detection rules within our SIEM system. I regularly test them against simulated attacks and adjust their parameters to minimize false positives.' What is Maria primarily doing?
Maria's role centers around rule creation and maintenance within a SIEM. The core function is to define what constitutes a suspicious event (e.g., a particular log pattern) that warrants an alert. 'Testing them against simulated attacks' indicates she's proactively validating the rules' effectiveness.
10 / 10
Ben in the Incident Response team reports: 'We received a high volume of alerts from our intrusion detection system due to several false positives related to legitimate application traffic. After reviewing the alerts and refining the SIEM rules, we reduced the number of false alarms by 70%.' What is this process called?
'Tuning' refers to the process of adjusting the parameters of a detection rule (e.g., thresholds, matching criteria) to reduce the number of false positives while still effectively detecting genuine threats. It's about increasing the rule's specificity and reducing its susceptibility to benign activity.
What will I learn from the "Threat Detection Vocabulary" exercise?
Practice vocabulary for SOC threat detection: detection rules, UEBA baselines, detection gaps, detection engineering, and rule tuning.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 10 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this SOC Operations Language exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss soc operations language topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 10 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more SOC Operations Language exercises?
See the full SOC Operations Language exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.