Reference
Security & OSINT
Open-source intelligence and network-security tooling, ethical-hacking classifications, SOC tiers, and SCADA signal types.
OSINT & Reconnaissance Tools
| Tool | Type | Protocol / Interface | Description |
|---|---|---|---|
| Shodan | Search Engine | HTTP API + web UI | Indexes internet-connected devices by scanning ports and grabbing service banners; used for exposed-device and IoT discovery |
| Censys | Search Engine | HTTP API + web UI | Internet-wide scanning engine indexing hosts, certificates, and protocols; academic origin (University of Michigan) |
| Maltego | Link Analysis | Desktop app, “Transform” plugins | Graphs relationships between people, domains, and infrastructure by pulling data from WHOIS, DNS, and social sources |
| theHarvester | OSINT Harvesting | CLI (Python) | Collects emails, subdomains, hosts, and names from public sources and search engines |
| Recon-ng | OSINT Framework | CLI (Python, modular) | Web reconnaissance framework with a Metasploit-like module system for automated data gathering |
Network Monitoring & IDS/IPS
| Tool | Type | Detection Model | Description |
|---|---|---|---|
| Wireshark | Packet Analyzer | Manual / protocol dissection | GUI packet capture and analysis tool built on libpcap; the standard for manual traffic inspection |
| Zeek (formerly Bro) | Network Security Monitor | Scripted behavioral analysis | Converts raw traffic into structured, high-level logs (connections, DNS, HTTP, files); detection logic written in its own scripting language |
| Suricata | IDS / IPS / NSM | Signature-based, multi-threaded | Open-source engine compatible with Snort rule syntax; also performs file extraction and protocol logging |
| Snort | IDS / IPS | Signature-based | The original open-source intrusion detection/prevention engine; now maintained by Cisco |
SIEM, SOAR & Log Pipeline
| Tool / Term | Role | Description |
|---|---|---|
| Elasticsearch | Index & Search | Distributed search/analytics engine; stores and indexes log data for fast querying |
| Logstash | Ingest & Transform | Collects, parses, and normalizes logs from many sources before they reach the index |
| Kibana | Visualization | Dashboards and exploration UI on top of Elasticsearch; the “ELK Stack” is Elasticsearch + Logstash + Kibana |
| SIEM (Security Information & Event Management) | Correlation & Alerting | Aggregates logs and alerts across an organization to correlate events and surface threats (e.g. Splunk, QRadar, Microsoft Sentinel) |
| SOAR (Security Orchestration, Automation & Response) | Automated Response | Runs automated playbooks against SIEM alerts to triage, enrich, and respond without manual steps for every event |
| LangChain | AI-Assisted Triage | LLM orchestration framework increasingly used to build AI copilots that pre-triage and summarize SOC alerts before a human analyst reviews them |
Ethical Hacking Classifications
| Term | Authorization | Intent | Description |
|---|---|---|---|
| White Hat | Authorized | Defensive | Security testing performed with explicit permission and legal scope (penetration testers, bug bounty hunters) |
| Black Hat | Unauthorized | Malicious | Illegal intrusion or exploitation for personal gain, damage, or theft |
| Grey Hat | Unauthorized | Ambiguous | Probes or discloses vulnerabilities without permission but without clearly malicious intent, often publishing findings unilaterally |
| Red Hat | Unauthorized | Vigilante | Actively counter-attacks black-hat actors; aggressive and ethically/legally murky, not a recognized professional role |
| Red Team | Authorized | Offensive simulation | Simulates real adversary tactics against an organization under a defined, authorized engagement scope |
| Blue Team | Authorized | Defensive | Monitors, detects, and responds to threats; the SOC's defensive analysts |
| Purple Team | Authorized | Collaborative | Red and Blue teams working together to improve detection coverage in real time |
| CEH (Certified Ethical Hacker) | — | Certification | EC-Council certification covering reconnaissance, scanning, enumeration, and exploitation within an authorized, ethical framework |
SOC Tiers
| Tier | Role | Responsibilities |
|---|---|---|
| Tier 1 | Triage Analyst | Monitors incoming alerts, performs initial classification, escalates confirmed incidents |
| Tier 2 | Incident Responder | Deeper investigation of escalated alerts, containment, and remediation actions |
| Tier 3 | Threat Hunter / Senior Analyst | Proactive hunting for undetected threats, forensics, and detection-rule tuning |
| Tier 4 | SOC Manager / CISO | Strategy, reporting, cross-team coordination, and overall security posture ownership |
Tier structure varies by organization size; smaller SOCs often collapse Tiers 3–4 into a single senior role.
SCADA Signal Types
| Signal Type | Abbreviation | Nature | Example |
|---|---|---|---|
| Digital Input | DI | Binary status, read | Pump running: yes/no |
| Digital Output | DO | Binary command, write | Valve: open/close |
| Analog Input | AI | Continuous measured value, read | Temperature, pressure, flow rate |
| Analog Output | AO | Continuous control value, write | Valve position 0–100% |
| Pulse Input | PI | Counted pulses over time | Flow-meter pulse count |
Common Industrial Protocols
| Protocol | Transport | Notes |
|---|---|---|
| Modbus RTU / TCP | Serial (RTU) or Ethernet (TCP) | Simplest and most widely deployed industrial protocol; no native security |
| DNP3 | Serial or TCP/IP | Common in electric utilities and water systems; supports secure authentication extension |
| OPC-UA | TCP/IP | Modern, platform-independent, built-in encryption and authentication |
| IEC 61850 | Ethernet | Substation automation standard for electrical grid communication |
| Profibus / Profinet | Serial (Profibus) or Ethernet (Profinet) | Common in European manufacturing and process automation |