This page defines key terms used in Agentic NDR, grouped by category.
Account and access
| Term | Description |
|---|
| UID | The ID of your primary Alibaba Cloud account, used to identify your account during the Agentic NDR trial. |
| service-linked role | A RAM role that an Alibaba Cloud service assumes to authorize cross-service access. Alibaba Cloud automatically creates this role for Agentic NDR, allowing it to access other cloud services and deliver its full range of features. To view the role, go to the Roles page in the RAM console. |
Network traffic and packets
| Term | Description |
|---|
| 5-tuple | The five elements that uniquely identify a network session: source IP address, destination IP address, source port, destination port, and protocol number. |
| 5-tuple log | A log record containing the 5-tuple of a network communication. A 5-tuple uniquely identifies a network session or connection. |
| Protocol log | A log record generated during network communications, capturing details such as packet transmission, connection establishment, errors, and security events. Agentic NDR collects the following types of protocol logs: TCP 5-tuple logs, UDP 5-tuple logs, ICMP protocol logs, HTTP protocol logs, DNS protocol logs, TLS protocol logs, and other protocol logs. |
| PCAP packet | A raw data packet stored in PCAP (Packet Capture) format — the standard format used by tools like Wireshark and tcpdump for in-depth traffic analysis, troubleshooting, and security audits. |
| Network packet payload | The actual application-layer data carried in a packet, separate from headers and protocol metadata. In an HTTP POST request, the payload is typically JSON or XML data such as form fields, file content, or API call parameters. In the context of a network attack, the payload is the malicious code or data an attacker injects to control a system or exfiltrate data. |
Log delivery
| Term | Description |
|---|
| Log delivery | The automated process of collecting log data from Agentic NDR and sending it to a destination for storage and analysis. Also called log forwarding or log shipping. Agentic NDR currently supports log delivery to Simple Log Service (SLS) in a destination region. |
Threat intelligence
| Term | Description |
|---|
| MITRE ATT&CK | ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a knowledge base of adversary tactics and techniques created and maintained by MITRE. The framework covers the following tactics: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control (C2), Exfiltration, and Impact. |