# Glossary

> The terms used in Oyster and across its documentation, from citations and scope to CVE, CWE, KEV, EPSS, MITRE ATT&CK, D3FEND, Sigma and YARA.

Source: https://documentation.redorca.ai/reference/glossary/
Last updated: 2026-11-01

**Approval gate** — A human decision required before a real tool action may run. The model can propose an action but never approve one. Applies to Red Orca's operators; accounts have no tool execution. See [Safety and approvals](https://documentation.redorca.ai/understand/safety/).

**CAPEC** — Common Attack Pattern Enumeration and Classification: a public catalogue of attack patterns.

**Citation** — The exact source passage an answer was built on. Click it to verify the claim. See [Evidence and citations](https://documentation.redorca.ai/understand/evidence-and-citations/).

**CVE** — Common Vulnerabilities and Exposures: a public identifier for a specific known vulnerability, such as CVE-2021-44228.

**CWE** — Common Weakness Enumeration: the class of weakness a vulnerability belongs to, such as CWE-79 for cross-site scripting.

**D3FEND** — MITRE's knowledge base of defensive countermeasures, the defensive counterpart to ATT&CK.

**Depth** — How detailed an answer is: Quick, Technical, Guided or Lab. See [Your first conversation](https://documentation.redorca.ai/get-started/first-conversation/).

**EPSS** — Exploit Prediction Scoring System: an estimated probability that a vulnerability will be exploited soon.

**Finding** — A recorded security observation, from a chat answer or logged by hand, with severity, evidence and ideally a fix. See [Findings and sharing](https://documentation.redorca.ai/guides/findings/).

**Insufficient evidence** — Oyster's honest signal that retrieval found nothing to support an answer. Add context or rephrase.

**IOC (indicator of compromise)** — An artefact, such as a hash, IP address, domain or path, that suggests a system was compromised.

**IR / DFIR** — Incident response; digital forensics and incident response.

**KEV** — The Known Exploited Vulnerabilities catalogue published by the US Cybersecurity and Infrastructure Security Agency (CISA): vulnerabilities seen exploited in the wild. Prioritise these.

**Knowledge base** — Oyster's curated, source-attributed security reference material. See [The knowledge base](https://documentation.redorca.ai/understand/knowledge-base/).

**Memory** — Facts, preferences and decisions Oyster remembers from your conversations, per project, under your control. See [Memory](https://documentation.redorca.ai/guides/memory/).

**MITRE ATT&CK** — A knowledge base of real adversary tactics and techniques, each with an identifier such as T1003.

**Project (engagement)** — The workspace that holds one body of work: its chats, files, scope, findings and memory. See [Projects](https://documentation.redorca.ai/get-started/projects/).

**RAG (retrieval-augmented generation)** — Answering by first retrieving relevant passages, then generating from them, so answers are grounded and citable.

**Scope** — The targets you are authorized to assess. Target-specific Red Team plans are written only inside it. See [Define an authorized scope](https://documentation.redorca.ai/guides/red-team/scope/).

**Sigma** — A generic, vendor-neutral format for detection rules over log data.

**SOC Copilot** — Oyster's case-based investigation workbench. See [SOC Copilot](https://documentation.redorca.ai/guides/blue-team/soc-copilot/).

**YARA** — A pattern-matching format for identifying and classifying files, often malware.