Glossary

Approval gate — A human decision required before a real tool action may run. The model can propose an action but never approve one. Applies to Red Orca’s operators; accounts have no tool execution. See Safety and approvals.

CAPEC — Common Attack Pattern Enumeration and Classification: a public catalogue of attack patterns.

Citation — The exact source passage an answer was built on. Click it to verify the claim. See Evidence and citations.

CVE — Common Vulnerabilities and Exposures: a public identifier for a specific known vulnerability, such as CVE-2021-44228.

CWE — Common Weakness Enumeration: the class of weakness a vulnerability belongs to, such as CWE-79 for cross-site scripting.

D3FEND — MITRE’s knowledge base of defensive countermeasures, the defensive counterpart to ATT&CK.

Depth — How detailed an answer is: Quick, Technical, Guided or Lab. See Your first conversation.

EPSS — Exploit Prediction Scoring System: an estimated probability that a vulnerability will be exploited soon.

Finding — A recorded security observation, from a chat answer or logged by hand, with severity, evidence and ideally a fix. See Findings and sharing.

Insufficient evidence — Oyster’s honest signal that retrieval found nothing to support an answer. Add context or rephrase.

IOC (indicator of compromise) — An artefact, such as a hash, IP address, domain or path, that suggests a system was compromised.

IR / DFIR — Incident response; digital forensics and incident response.

KEV — The Known Exploited Vulnerabilities catalogue published by the US Cybersecurity and Infrastructure Security Agency (CISA): vulnerabilities seen exploited in the wild. Prioritise these.

Knowledge base — Oyster’s curated, source-attributed security reference material. See The knowledge base.

Memory — Facts, preferences and decisions Oyster remembers from your conversations, per project, under your control. See Memory.

MITRE ATT&CK — A knowledge base of real adversary tactics and techniques, each with an identifier such as T1003.

Project (engagement) — The workspace that holds one body of work: its chats, files, scope, findings and memory. See Projects.

RAG (retrieval-augmented generation) — Answering by first retrieving relevant passages, then generating from them, so answers are grounded and citable.

Scope — The targets you are authorized to assess. Target-specific Red Team plans are written only inside it. See Define an authorized scope.

Sigma — A generic, vendor-neutral format for detection rules over log data.

SOC Copilot — Oyster’s case-based investigation workbench. See SOC Copilot.

YARA — A pattern-matching format for identifying and classifying files, often malware.