Entities

Last updated 10 Nov 2026

On this page

An entity is one thing on one host - a program, an account, a task - with every signal about it from every module. It is what you triage.

Three levels

Level	What it is	Who decides it
Signal	One rule about one thing: every match of it, each on its timeline.	The rule: its severity, its next steps, its ATT&CK techniques.
Entity	One subject on one host, with every signal about it from every module, and the signals it is only named in.	You: you triage the entity as a whole.
Facts	What Signal read about the entity: a program's file, hash, signature and version; an account's record; a log's size.	Read once per entity, for every module.

Type	Known by
`program`	Its path. A host program such as `cmd.exe`, `powershell.exe`, `rundll32.exe` or `svchost.exe` is one entity per thing it runs - so a logon script and a shell started by Word are never mixed.
`file`	Its path: a DLL, a script, a document.
`account`	Its SID; by name only when no SID is known.
`service`, `task`	The service's key name; the task's path.
`address`, `domain`	An IP address; a site's host name.
`log`	An event log, by channel.
`product`, `threat`	A security product by name; a threat it named.
`application`, `extension`	An installed application by name; a browser extension by ID.
`remote_tool`, `remote_peer`	A remote access product; the other side of one of its sessions.
`gpo`, `directory_object`	A Group Policy object by GUID; another directory object by its distinguished name.
`web_app`, `wmi_consumer`, `setting`, `recovery`	A web site; a WMI consumer; a network setting; one of the host's ways back.

Every link between two entities has a role, so you can read it as a sentence:

Role	Read it as
`parent` / `child`	the program that started it / a program it started
`ran_as` / `ran`	the account it ran as / what ran as this account
`actor` / `did`	the account that did what the record records / what this account did
`target`	the account acted on
`runs` / `run_by`	the program a service, task or tool starts / what starts it
`from` / `to`	where it came from (an address, a site) / where it goes
`hijacks`	the program a debugger entry diverts
`recorded_by`, `detected_as`	the security product that recorded it; the threat it was named as
`in_file`, `deploys`, `site`, `peer`, `tool`	the file a record was read from; what a GPO deploys; the web site holding it; the other side and the tool of a remote session

In Signal's sample fleet, WS-ALPHA has the task \Microsoft\Windows\WinSvcUpdate. It is one entity of type task, with:

two SCOPE-PIVOT-HIT signals (critical): the task's name and its program are both pivot points of the incident;
one PERSIST-TASK-HIDDEN signal (high): it has no security descriptor, so the Task Scheduler hides it;
related entities: the program it runs, C:\Users\Public\svc.exe, and the actor that registered it, CORP\alice.

One click on the program shows its own facts - hash, signature, version - and every signal about it.

Before you trust an entity's quiet neighbours, read what Signal could not see.