asset - what you are trying to protect
threat - something that can affect the CIA triad
vulnerability - a weakness or flaw in a security program that, if exploited, threatens the CIA triad
risk - a potential for damage to the CIA triad as a result of a threat
exploit - program/code designed to take advantage of a vulnerability

Severity = Asset Priority * Threat Impact
Risk  = Probability *  Severity

Confidentiality | Integrity | Availability

Malware - Malicious Software
PUP - Potentially Unwanted Program
Adware - serves unwanted or malicious advertising
Virus - infects other programs to copy its self
Worm - a virus that can spread over a network, often targetting known exploits
Trojan - program pretending to be legitimate or desired software
Bots - program performing automated tasks (no direct human interaction required)
Botnet - collections of bots
Cryptominer - Malware that mines cryptocurrency on a users device on behalf of an adversary
Scareware - makes false claims about a virus infecting a device, typically involving a request for payment to solve the issue.
Ransomware (targets Availability) - Malware that encrypts a file system allowing adversaries to require companies to pay a ransom for a decryption key
Extortionware/leakware, aka. Double Extortion Ransomware (targets CONFIDENTIALITY) - like ransomware but also involves malware uploading encrypted data (or part of encrypted data) to be released to the public if the target doesn't pay

A piece of observable forensics that suggests an endpoint or environment may have been compromised.

IoC - Indicates Compromise
IoA - Indicator of Attack

Answers along the lines of:
Unusual, rare, or otherwise anomalous rhythmic DNS requests
Unusual, rare, or otherwise anomalous network traffic
Impossible Travel Events
Unknown and unapproved applications on a system
A surge in Invalid login or access attempts
A surge in domain activity from an entity
New and Unapproved User Account Creation
Suspicious Registry changes
etc...

Security | Applicatoin | System

Event ID :	Desc
4624	Successful account log on
4625	Failed account log on
4634	An account logged off
4648	A logon attempt was made with explicit credentials
4719	System audit policy was changed.
4964	A special group has been assigned to a new log on
1102	Audit log was cleared. This can relate to a potential attack
4720	A user account was created
4722	A user account was enabled
4723	An attempt was made to change the password of an account
4725	A user account was disabled
4728	A user was added to a privileged global group
4732	A user was added to a privileged local group
4756	A user was added to a privileged universal group
4738	A user account was changed
4740	A user account was locked out
4767	A user account was unlocked
4735	A privileged local group was modified
4737	A privileged global group was modified
4755	A privileged universal group was modified
4772	A Kerberos authentication ticket request failed
4777	The domain controller failed to validate the credentials of an account.
4782	Password hash an account was accessed
4616	System time was changed
4657	A registry value was changed
4697	An attempt was made to install a service
4698, 4699, 4700, 4701, 4702	Events related to Windows scheduled tasks being created, modified, deleted, enabled or disabled
4946	A rule was added to the Windows Firewall exception list
4947	A rule was modified in the Windows Firewall exception list
4950	A setting was changed in Windows Firewall
4954	Group Policy settings for Windows Firewall has changed
5025	The Windows Firewall service has been stopped

Firewall|Anti-Virus|EDR|NDR|Proxy|ESG|IDS/IPS|secret managers|SIEM|App Whitelisting|Script Control|UBA/UEBA|CASB|Vulnerability Scanners|MFA/2FA|SOAR|etc

IDS - detects security events
IPS - has the capability to block security events

SIEM - combines security information management and security event management - collects and aggregates events for alerting, analysis/investigation
NIDS - event generation - uses signatures, pattern matching, reputation scoring, or anomaly detection to generate security events in network traffic
HIDS - event generation - uses signatures, pattern matching, reputation scoring, or anomaly detection to generate security events on a host

Endpoint Detection and Response (aka endpoint threat detection and response) - endpoint security solution that logs and monitors devices to detect and investigate cyber intrusions

open-ended

VirusTotal|OTX|Cymon|PassiveTotal|ThreatConnect|Threat Crowd|Threat Miner|IBM X-Force|Talos

Hybrid Analysis | Any.Run | Joe's Sandbox | OPSWAT

Block the IP addresses

deny - will send an ICMP type 3 (destination unreachable) response
drop - no notification of denial / silently stops traffic

In-band | Inferential | Out-of-Band

Encoding the output
Applying filters at the point where input is received
Using appropriate response headers
Enabling content security policy
Escaping untrusted characters

TCP - creates sessions, slower but reliable (unicast)
UDP - fast but not guaranteed, shout (unicast, multicast, broadcast)

SYN
SYN-ACK
ACK
Congrats. You're established.

Wraps TCP session an encrypted tunnel to secure data in packets.

encoding - (AVAILABILITY) reversible transformation of data format to preserve data usability
encrypting - (CONFIDENTIALITY) secure encoding of data to allow only authorized access to decrypt to reveal the original text
hashing - (INTEGRITY) one way unique(ish) summary of data used for integrity

A salt is random data that is applied to a hashed password stored in the password database to protect against known hash attacks.

App
Presentation
Session
Transport
Network
Data Link
Physical

Simple Network Management Protocol is the standard / protocol for obtaining and organizing information about managed devices.

Hardware manufacturers write MAC addresses; however, users can "mask" it on the software side so that the device appears to have a different MAC address.

Address Resolution Protocol maps IPs to MAC addresses for a LAN. ARP poisoning is where an attacker sends a "spoofed" ARP message on a LAN to associate the attacker's MAC address with the IP of another host.

Man-in-the-middle exploit to fall back to SSL 3.0.
The attacker needs to make 256 SSL 3.0 requests to reveal one byte of encrypted messages.