Glossary

Last updated 10 Nov 2026

The words Signal uses, in one place.

Term	Meaning
Anchor	A time that dates a state - a key's last write, an install date - with what that time is.
Approved	A signal about something in the profile's baseline or approved tools: kept, and marked.
Baseline	The profile's list of what your organisation runs on purpose.
Case	In Signal Console: one investigation's runs, triage and push key, in its own database.
Coalesce	The fields whose values make matches one signal.
Collection	In Signal Console: one run of one host. A host's latest collection is its current one.
Corroboration	Another source's record of the same thing, attached to a signal instead of making a second signal.
Derived field	A field Signal computes, not one Windows writes - an address's scope, an account's kind.
Entity	One thing on one host - a program, an account, a task - with every signal about it.
Evidence type	A kind of record with named fields: `process_creation`, `logon`, `autostart`...
Event / state	An event happened at a time; a state was true when Signal read the host.
Fact rule	A rule over the whole run, with no single event behind it.
Fidelity contract	Every rule's tests: what it must match, and a look-alike it must not.
Finding	A rule that fired on a run, with its signals.
KPI	A module's headline number, with a status and a note.
Module	The part of Signal that answers one question about the host.
Not run	A rule that could not be evaluated - never the same as clear.
Outbox	Where a run waits on the host when a push was not accepted in time.
Pattern rule	A rule over one record at a time.
Pivot point	An incident's indicator - a hash, an address, an account - that Scope searches for.
Profile	The scoping profile: what a run looks for.
Push key	A case's key: it lets Signal send runs to that case in the console.
Raw log record	`security_event` or `system_event`: any record of that log, whatever it means.
Run	One survey of one host: one JSON document.
Selection	A named set of field matchers in a rule's detection.
Signal	Every match of one rule about one thing, with a count and its times.
Source health	Whether each evidence type was read, partly read, not read or unavailable.
Suppress	Withhold a rule from runs given the profile, with a reason.
Telemetry	The state of a source a module's detection depends on: on, off, absent or unknown.
Triage	In the console: an entity's state - new, reviewed, benign, escalated - with a note.