Glossary

Use this reference to understand the labels, counts, assessments and controls you see in the Heimdal Intelligence Appliance (HIA). The first part explains values in their on-screen context: what is shown, where it comes from, how it is derived and what it does not establish. The second part is a supporting glossary of the vocabulary used throughout the HIA guides.

Find the label you see

For an unfamiliar term, search this article for the exact UI label.

Endpoint and investigation evidence

Evidence (investigation header or tab)

Where it appears: Cyber Operations → investigation detail.

What it means: The header shows the number of event records returned for that investigation. The Evidence tab lists those records, including event name/time, source module, event class, process/domain/file context and correlation reasons, where available.

How it is derived: The API joins stored investigation-to-event links with retained normalized security events for the investigation's entity. The header displays the length of that returned list. It is an investigation result, not a fresh count of every endpoint event inside the dashboard time selector.

Example: Evidence 3 means three returned event records support this investigation. They could describe repeated or related activity. It does not mean three confirmed attacks, three distinct affected devices or a risk score of three. Missing collection and retention limits affect what can be present.

Evidence (beside an endpoint in Related Assets)

Where it appears: An endpoint's row or card inside an investigation.

What it means: The stored evidence-association counter for that asset in that investigation.

How it is derived: The correlation worker starts the asset counter at one and increments it when attaching an event associated with that asset. The UI reads this stored counter; it does not recalculate it from endpoint history or from the visible Evidence list.

Example: Evidence 5 means five associations have been counted for this asset. Do not describe it as five independent proofs or attacks. Because it is a maintained counter rather than a fresh count, do not assume it always equals the investigation header after retention or unusual reprocessing. Counter reconciliation needs its own verification.

Evidence (endpoint assessments and provenance)

Where it appears: Endpoint Detail → General → Microsoft Patch Baseline, hardware/lifecycle panels and asset advisories.

What it means: The observations and matching rules supporting that particular assessment. It is not one universal endpoint score.

What is shown:

• Patch evidence can include update title, reported status, event time and collection time.
• Build evidence includes reported full build, inventory retrieval time, Microsoft metadata and evaluation time.
• Asset advisories can show product/version matches and CVE context.
• Raw/API Provenance identifies the available source records behind the endpoint data.

Example: A current reported build alongside an older Failed update observation can produce an evidence-comparison warning. Both observations may be real but describe different moments. A recent local retrieval does not prove the endpoint was scanned at that instant. The assessment reason and timestamps are essential parts of the result.

Scores, severity and investigation relationships

Heimdal Risk Score

What it is: The score returned by Heimdal TAC risk APIs and retained in HIA's risk state for the relevant entity/asset. HIA does not calculate this number from its Evidence counter.

How to read it: Check the source, fetched time, expiry and risk status where available. Pending or missing means a score has not been established; it is not zero risk. HIA's inspected source does not define Heimdal's internal scoring formula, so this reference does not invent one. A displayed score alone does not prove it was retrieved just now.

Operational Priority

What it is: HIA's local work-priority label, calculated from available Heimdal risk, security-event counts, module diversity and retained exposure. It is a rule-based classification, not a percentage and not a replacement for the Heimdal Risk Score.

Calculation: Rules are evaluated in order; the first matching rule wins. "Critical/High events" and "modules" refer to the input event set. Priority Assets uses its selected event window; an investigation uses its associated events. Exposure is retained current context and does not become historical when the event window changes.

Example and limits: Risk 82 plus one High event produces Immediate. One High event without other qualifying inputs produces Elevated. Normal means no rule triggered on available inputs, not that the endpoint is safe. The displayed reasons explain contributing inputs; not every listed reason independently changes the category.

Exposure items (in Operational Priority)

Calculation: The endpoint exposure helper counts distinct software names whose retained patch status is not "up to date", plus distinct Microsoft patch names whose status is not Installed/up-to-date. Total exposure items is the sum of those two counts. This is not the PowerBI assignment metric or a unique-CVE total.

Critical CVEs are counted distinctly within each source using CVSS ≥ 9, then the two source counts are added. The same CVE appearing in both sources can therefore contribute twice. Maximum CVSS is the highest available value across them. These details matter when comparing this panel with another CVE widget.

Severity

Describes the level attached to security evidence. The correlation worker maintains an investigation's severity using the highest event severity seen when attaching evidence. It is not an average and is separate from Operational Priority. A later lower-severity event does not lower the stored maximum.

Correlation evidence score

A rule-based weight expressing why an event was linked to an investigation. Candidate scoring adds:

• 5 for the same entity
• 20 for time proximity within five minutes, otherwise 10 within thirty minutes
• Matching assets: endpoint 50, identity 40, firewall 45, other 30
• Matching indicators: hash 80, IP 25, domain 20, CVE 15, other 10

Matching contributions accumulate. Candidate investigations are restricted by entity and the configured correlation window. A best score of at least 40 attaches to an existing candidate; otherwise a new investigation starts with score zero.

Correlation confidence label

The stored investigation score is the maximum attachment score, not the sum or average. Labels:

• Very high: 90 or more
• High: 70–89
• Medium: 40–69
• Low: below 40

Example: same entity + matching endpoint + within five minutes = 5 + 50 + 20 = 75, classified High. These are weights, not a 75% probability of attack; scores can exceed 100.

First Seen and Last Seen (investigation assets)

The earliest and latest event times accumulated for that asset in the investigation. They do not establish that the device is currently online. The Last seen value in Endpoint Inventory has a different source meaning and must be read in the inventory context.

ATT&CK Stages

The investigation displays the stored attack-chain stage count alongside chain confidence. These summarize mapped behavioral evidence. Stages, techniques, mapped event counts and chain confidence are different quantities. A stage count is not the number of successful attack steps or proof of a completed compromise; this reference does not assign it a probability formula.

Entity threat assessment and coverage

Threat Assessment by Entity

Scope and source: Cyber Operations uses retained normalized security evidence for the authorized selected entities and selected event window. Future-dated events are excluded. Qualifying detections/findings exclude Application Control, audit, PEDM and recognized patch/vulnerability findings. DNS blocks alone do not become detections in this assessment.

Classification:

Known qualifying threats retain their severity even when coverage becomes stale.

Interpretation: No current threats observed describes that window and the monitored sources. It is not a clean bill of health, a patch-compliance result, or proof that every possible threat was detectable.

Open groups

Events linked to one investigation count as one group per entity. Otherwise, repeated evidence is grouped by asset, event name/type and category. Latest symptom/source states are considered; resolved investigations and explicitly remediated/dismissed symptoms are excluded. Contained investigations remain open, and another unresolved symptom can keep a group represented.

Affected endpoints

The distinct endpoint count within the qualifying evidence for this assessment. It answers how many endpoints are represented, not how many events occurred. One endpoint can contribute several groups.

Example: Ten repeated observations linked to one investigation can produce one open group; they do not automatically produce ten incidents. Unlinked summary and detailed observations can still form separate provisional groups, so complete cross-source deduplication is not established. Click the group count to inspect the records behind the same entity/window calculation.

Configured sources current and Coverage

Calculation: Expected security routes come from enabled modules and their bulk-safe route definitions. A route's freshness threshold is twice its configured ongoing interval, with a 15-minute minimum; a missing interval uses the 30-minute fallback. The latest attempt must meet the success/completion/time conditions. A nonempty run also requires normalized evidence collected since that run began. Unassessed routes prevent an unsupported clear status.

Example and limits: "3 / 4 configured security sources" means three expected sources meet the current-status checks. It does not mean 75% of threats were detected or 75% of devices were scanned. A successful empty response can be current; a failed, unfinished or stale run cannot. This check does not prove every upstream record/page was available and normalized.

Endpoint hardware and Windows values

Hardware data

Retained hardware measurements such as CPU cores, installed RAM and disk capacity come from device enrichment. RAM/disk in GiB are capacity values, not utilization percentages. Unknown means missing or unusable evidence, not zero capacity.

Hardware Baseline

Compares measured values against configured requirements, with customer overrides where configured. Documented defaults are 8 GiB RAM, 256 GiB disk and four CPU cores; a zero threshold disables that requirement. A known failure can establish Below baseline even when another measurement is unknown. Missing evidence never establishes a pass. This is not full Windows 11 compatibility certification.

Devices enriched

The progress percentage is enriched devices ÷ total devices × 100, displayed to one decimal place. Enriched includes partial hardware results; unavailable devices remain in the estate total.

Example: 80 / 100 = 80.0%, but some of those 80 may have incomplete hardware information.

Estimated remaining

Based on recent progress observed while the page is open: remaining devices × elapsed sample time ÷ increase in enriched devices. It requires a live worker, at least 30 seconds of samples and positive progress, and is suppressed for specified failure/unavailable conditions.

Example: 20 remaining and five newly enriched in 60 seconds gives about 240 seconds before display rounding. This is not a completion SLA.

Check result, Request hardware refresh and Retrieve device snapshot

• Check result reloads the saved result.
• Request hardware refresh queues collection work.
• Retrieve device snapshot queues an explicit point-in-time snapshot. Displayed utilization is not continuous monitoring, and retrieval time is not proof of the source measurement time.

Reported full build and Security baseline build

Source and calculation: Microsoft Patch Baseline compares the reported full Windows build with cached Microsoft release history for the matched product and servicing path. Heimdal patch-status strings do not calculate this independent build comparison. The build revision, product identity, freshness and matching evidence must be sufficient.

Status values:

• Current – the recognized build meets the assessed security baseline in that path.
• Behind – a recognized security baseline is later.
• Ahead of security baseline – a recognized newer preview build.
• Unknown, Insufficient data, Unsupported branch – cases that cannot be assessed are preserved as such.

End of support is a lifecycle judgment and remains distinct from OS patch level.

Limits: Current does not prove all .NET, Defender, driver or application updates are installed. It does not validate local Windows Update applicability or an actual installation date. Confidence reflects match/context quality, not probability of being secure. Read the displayed reason, inventory retrieval, metadata retrieval and last-evaluated times.

Monthly security releases behind

Calculation: Counts distinct later monthly "B" security-release dates in the matched servicing path. It does not count every KB, every installation attempt or calendar months elapsed.

Example: Three later qualifying monthly releases gives 3, even if many CVEs or package variants relate to those releases.

Heimdal comparison

Separately compares retained update evidence for the selected baseline KB with the build assessment.

• Review required – disagreement requiring interpretation.
• Ambiguous – conflicting update states.
• Consistent evidence – agreement within the available observations.
• Older patch information differs – eligible older evidence identified under the documented timestamp rules.

None of these is a complete compliance certificate.

Potential security exposure (Potential CVEs)

Exact product/KB/fixed-build matches to cached Microsoft metadata are deduplicated across known later security releases. "Covered releases / gap releases" describes metadata coverage. PARTIAL means only part of the history supports the count. The detail list is limited to examples; the total can exceed the visible list.

Interpretation: No matched rows can mean unknown rather than zero vulnerabilities. Exact server product identity and known-exploited enrichment remain limited. A potentially relevant CVE is not proof of local exploitability. This count is different from the Operational Priority exposure helper above.

Report Builder, charts and dashboard values

Dataset, Dimension, Metric and Grain

• Dataset chooses the available data family.
• Dimension answers "group by what?"
• Metric answers "count or measure what?"
• Grain specifies what one counted item represents.

Fields offered by the catalog determine which combinations work.

PowerBI example: Dataset = Windows Patch Status — Update Details; dimension = Update / Version Title; metric = Endpoint / Update Entries; grain = retained endpoint/update assignment. Patch A on two servers contributes 2. Patch B on one of those servers contributes 1. Total assignments = 3; distinct servers = 2. The metric derives update identity from software/title; it is not a guaranteed one-row-per-KB count.

Pie percentages and status totals

Calculation: A category's percentage is its included assignments ÷ the assignments represented in that pie × 100. In the example above, Patch A is 2 / 3 ≈ 66.7%. Counts must share entity scope, device class, status filters, metric and coverage before comparison. Check category limits before interpreting a visible pie as the complete population.

Status mapping: The agreed base is Installed + Pending + Available. Available supplies the customer's "Not installed" meaning; Error supplies "Failed". Confirm live raw API strings before filtering. Failed uses its own widget/denominator and is outside the base total. Unknown values are not silently reclassified.

Consequence: A device can appear under several patches and statuses. Adding grouped distinct-device totals can count the same device repeatedly. Do not label an assignment percentage as "percentage of devices patched".

Group by, Secondary group by and Pivot

Calculation: Group by calculates the metric per primary category. Secondary group by divides each category by one more supported dimension. Pivot arranges those results in rows/columns; Multi-Line and Stacked Bar present the same grouped values differently.

Example: Day × Severity with event count: Monday/High = 4 means four retained matching events, not four devices. The two-axis path admits reviewed record-count metrics; it rejects arbitrary sums, averages and distinct counts, including the PowerBI assignment metric. No inferred row/column totals are added.

Bounds: Up to 12 secondary series; Pivot up to 200 rows and 12 columns; supported time charts up to 1,000 buckets, with a bounded result transfer. Overflow is an explicit error, not a silently omitted category. Zero-filled cells mean no matching retained records for admitted categories/buckets, not complete monitoring.

Time field, Reporting window and Drilldown

• Time field determines which recorded timestamp groups/filters events. UTC Hour/Day/Week/Month buckets use Coordinated Universal Time; a local date near midnight can fall in a different UTC day. Source timestamps may have documented fallback behavior.
• Reporting window: A rolling window moves with execution time; an absolute window uses fixed boundaries. Current-state patch reports do not become historical monthly installation reports by selecting a month or changing a title.
• Drilldown: A supported clicked cell opens records matching its server-validated category/time interval and original constraints. The end boundary is exclusive. Authorization and original filters are retained. Unknown/unsafe/non-reversible categories may not be clickable. Pagination limits visible rows; one page is not necessarily all evidence.

Save, Save As, Composite and Saved report scope

• Save updates the opened report definition. Save As creates a separate named report. A dashboard widget references the canonical saved definition, so changes can affect its referencing widgets.
• Composite combines several configured widgets. Filters belong to each widget; changing one is not a shared PowerBI-style slicer. Separate status widgets are the accepted customer reproduction.
• Saved report scope: The widget uses the report's saved scope and reporting window under the applicable authorization path. The dashboard selector does not overwrite its analytical definition. Check this footer before comparing it with a dashboard-native widget.

Last calculated, Refresh and Scheduled delivery

• Last calculated is when HIA last successfully computed the result from local data, not when Heimdal last observed the endpoint. A refresh can produce a newly calculated result from unchanged old source observations.
• Refresh is manual or configured periodic recalculation; it does not trigger Heimdal/Microsoft collection. Failure keeps the previous result and its original calculation time. Hidden tabs pause queued automatic work; each open dashboard has its own queue. Do not infer a global refresh guarantee from the chosen interval.
• Scheduled delivery: A saved schedule is configuration, not evidence that a recipient received a correct attachment. Verify execution history and receipt.

Collection and delivery status in administration

Collection Scope, Last completed window and Lag

• Collection Scope selects which authorized entities/sources are collected. It does not activate or license Heimdal endpoint modules. An Operational View selects data to analyze and does not grant permission to it.
• Current page/cursor shows work in progress; Last completed window records a completed collection interval. A successful page does not prove the whole window is complete.
• Lag describes delayed progress and must be interpreted with configured cadence, quota/cooldown and errors. A recent worker heartbeat only shows activity, not full data freshness.

Queue states: Pending, Processing, Deferred, Delivered and Dead letter

These labels describe a particular background job or delivery queue, not Windows patch status. Counts concern queue records and may include separate deliveries of the same event to different destinations.

Delivered does not prove downstream indexing or analyst review. At-least-once delivery permits duplicates when acceptance occurs before HIA records success, so a replay may deliver a record again.

Supporting terminology

The following vocabulary supports the screen explanations above and the wider installation, security and operations guides. Where a word has several meanings, the screen-specific entry above takes precedence for interpreting a displayed value.

People and release status

CCSA

Cybersecurity Solutions Architect. In this pack, the audience demonstrating HIA and explaining its technical and operational boundaries.

HIA

Heimdal Intelligence Appliance: a locally operated collection, analysis and reporting layer for authorized Heimdal data. Heimdal Cloud remains authoritative for Heimdal-originated state.

RC1

Release Candidate 1. A candidate for acceptance, not a declaration that installation, updates, security or capacity are fully verified. The displayed application version alone does not identify its exact source.

Implemented

Functionality exists in the inspected source. Final functional verification may still be pending, and a specific design finding may still require a correction.

Pass, Fail, Blocked and Not run

Pass means an exercised check matched expectations; Fail means it did not; Blocked means a prerequisite prevented the check; Not run means no result exists. None should be substituted for another.

As-is community project

Availability without an official support-service commitment. This does not imply an SLA or certification.

Source and installation

GitHub repository

The source-code and documentation project. Access to Heimdal or the VM does not automatically grant GitHub access.

Branch and commit

A branch is a movable development pointer; a full commit SHA identifies one Git revision. Record the exact commit used, not only the branch name.

Checksum / SHA-256

A file-content fingerprint used to compare exact bytes. A matching checksum alone does not establish a publisher's identity or execution permission.

Container and image

An image supplies packaged software; a container is an instance running from it. A tag can move. Record actual image identity when establishing a recoverable release baseline.

Docker Compose

The deployment definition coordinating HIA services, networks, volumes and dependencies. Separate services do not automatically have isolated database privileges.

Persistent mount

A filesystem location retained outside a container's disposable writable layer. /data holds important HIA runtime state; host controller state also exists elsewhere.

Fresh installer, resume and updater

The fresh installer initializes a new appliance. Resume continues an interrupted installation with the same source/configuration. An updater changes an existing appliance; the fresh installer must not be used as one.

Migration manifest and ledger

The manifest declares installation SQL and order; the ledger records applied files/hashes. Missing historical proof is not permission to replay SQL.

Installed State

The combined identity and condition of source, images, configuration, schema/ledger and lifecycle/security state. A version label is only one part.

Identity and scope

API

Application Programming Interface: a defined way for software systems to exchange requests and data.

API Connection

A Heimdal credential/environment domain used to collect data. Multiple connections can coexist without a global API key.

PROD and RC API environment

Upstream production and release-candidate environments. Choose the environment authorized for the test. The RC API environment is not the same as HIA's RC1 designation.

Entity

The customer or organizational identity that owns data. Retain entity identity when analyzing multiple customers.

Collection Scope

The policy selecting entities and sources to ingest. It changes collection, not merely the visible chart.

Operational View

The entities an analyst selects to analyze together, independently of credential topology. It does not itself grant access.

RBAC and ACL

Role-Based Access Control and Access Control List. HIA combines role permissions with entity-specific grants/denials for authorized operations.

Effective scope

The applicable report/view selection constrained by authorization. Saved-report widgets keep saved report scope; scheduled execution has a separate unresolved authority finding.

Entra, SSO and OIDC

Microsoft Entra ID can authenticate users through Single Sign-On using OpenID Connect. This is distinct from a future Graph functional module.

MFA, TOTP and WebAuthn

Multi-Factor Authentication; time-based one-time passwords; and browser-based public-key authentication such as security keys. Availability does not prove a particular user's setup or recovery has been tested.

JIT provisioning

Just-in-time account creation at first external sign-in. Group-to-role mapping at creation is not continuous role synchronization.

Data and reporting

Telemetry and normalized evidence

Upstream observations and their locally structured representation. Derived assessments retain the limits of the supplied evidence.

Coverage and freshness

Coverage describes which sources/entities/windows have evidence; freshness describes age. Recent data does not prove complete history.

Current state and event history

Current state records the latest retained condition. Event history records observations over time. A patch snapshot is not proof of installation within a month.

Observation time and calculation time

When a source observation was recorded versus when HIA calculated a result. Neither automatically establishes installation time.

Dataset

The family of data selected for a report, such as Windows patch details or security threat events. It determines which fields and calculations are available. Think of it as the report's source table, even when HIA combines several internal tables.

Field

One named piece of information in a record, such as device type, update title, severity or event time. Some fields can be displayed, some filtered and some grouped; the reporting catalog defines the allowed uses.

Dimension

A field used to divide a result into categories; it answers "by what?" For a patch distribution, Update / Version Title is the dimension: each title becomes a slice. Device Type could separate Server from Workstation. A dimension is not the number being counted and has nothing to do with a widget's screen size.

Metric or measure

The quantity calculated for each category; it answers "how many?" or "how much?" In the PowerBI reproduction, Endpoint / Update Entries is the metric and update title is the dimension. Only metrics offered for the selected dataset and report form are permitted.

Grain

What one underlying row or counted item represents. One security event, one device and one device/update assignment are three different grains. Changing grain changes the meaning of the total, even if a chart looks identical.

Category

One value of a dimension. For Device Type, Server is a category; for Severity, High may be a category. The dimension is the field; the category is one of its values.

Group by / primary grouping

Combine records sharing the selected dimension value and calculate a metric for each group. Grouping by update title produces a count for each title. Filtering to Server first restricts the records used in all those groups.

Secondary grouping

Split each primary group by a second, different dimension. For example, Day followed by Severity gives daily event counts separated by severity. This is the documented two-dimensional reporting path; it does not mean adding another independent chart.

Aggregation / aggregated result

Combining multiple records into summary values, such as counts per update title. An aggregated chart hides individual rows; a detailed report lists them. A supported grouping is required before combining totals from different sources.

Record count and distinct count

Record count counts matching rows. Distinct count counts unique identities under a defined key. If one device has three update assignments, there are three assignments but only one distinct device. Distinct device counts across patch groups can overlap and must not simply be added.

Denominator and percentage

The denominator is the total against which a share is calculated. If a pie contains 20 assignments and one patch has five, that slice is 5 / 20 = 25%. Filtering changes the denominator. Failed remains separate from the agreed Installed + Pending + Available base in the customer example.

Filter and filter operator

A condition selecting which records participate, such as Device Type equals Server or Hostname contains LAP. "Equals" and "contains" are operators. Combining a patch filter and an asset filter selects their intersection, not the union.

Regex (regular expression)

A text-matching pattern. For example, ^(Installed|Pending|Available)$ matches exactly those three strings. Use this only when raw values and catalog support are confirmed. Regex filtering and regex-derived grouping are different capabilities; the two-axis path does not admit regex grouping.

Reporting catalog and metric governance

The approved list of datasets, fields, metrics, filters and compatible visualizations. It prevents a plausible-looking report from silently using an unsupported calculation. Finding a field in an API response does not automatically make it reportable.

Summary and Detailed Records

Summary presents grouped calculations; Detailed Records presents supporting rows and selected columns. Their totals reconcile only when scope, filters, grain and coverage match.

Visualization

The presentation of a report result, such as Table, Pie / Donut, Line or Stacked Bar. Changing the picture does not make an incompatible metric valid.

Axis and series

An axis provides chart positions, such as days along the bottom. A series is one sequence of values, such as High-severity counts over those days. Multiple series can share the same time axis.

Multi-series and Stacked Bar

Multi-series charts compare several sequences; Stacked Bar displays category contributions as segments of each bar. For admitted counts, Day × Severity can show how severity categories contribute to each day. A stacked view is not permission to add overlapping distinct counts.

Pivot

A grid with one dimension down the rows, another across the columns, and a metric in each cell. Example: rows = Day, columns = Severity, cells = number of events. Current HIA two-axis Pivot admits reviewed record-count metrics; arbitrary sums, averages and distinct assignment/device counts are not admitted. Row and column totals are not automatically inferred.

Cell

One intersection in a Pivot, such as Monday × High severity. It contains the metric for that exact combination. Supported drilldown opens records matching that combination and the original report constraints.

Rolling window and absolute window

A rolling window moves with the run time, such as the last seven days. An absolute window has fixed start/end boundaries. Use the dataset's documented time meaning; neither option turns current patch state into installation history.

Zero, missing, unknown and stale

Zero means the admitted calculation found no matching retained records. Missing means evidence is absent; unknown means a conclusion cannot be established; stale means evidence is too old for its purpose. These states are not interchangeable. Zero-filled chart cells do not prove complete collection.

Raw value, identifier and display label

A raw value or stable ID identifies a stored category/object; a label is the readable text shown to the user. Two devices can share a hostname. A renamed label must not silently change the identity counted or authorized.

Slicer and shared selection

A slicer is a visual filter control, familiar from PowerBI. A shared selection would update several charts together. HIA Composite filters belong to individual widgets; separate status widgets are the accepted RC1 approach for this example.

Widget, dashboard and layout

A widget is one visible chart, table or panel; a dashboard arranges widgets; layout controls their size and position. These presentation choices are separate from analytical dimensions and authorization.

Canonical report and report reference

The saved report is the maintained definition of its dataset, scope and calculation. A dashboard reference points to that report rather than keeping an independent hidden copy. Editing the saved definition can therefore affect every widget that references it.

Palette and semantic color

A palette supplies chart colors. A semantic color consistently represents a meaning, such as a status category. A color is a presentation aid, not evidence of risk or a replacement for a label.

CSV, XLSX and PDF

CSV is text arranged as separated values; XLSX is a spreadsheet workbook; PDF preserves a page layout. Export support and layout differ by report type; always verify the generated result.

Pagination

Splitting a long result into pages. Ten visible rows are not necessarily the whole dataset. Report-detail pagination and upstream API collection pagination are separate operations.

Endpoint/update assignment

One retained device-to-update association. One patch on two devices contributes two assignments; three patches on one device contribute three. This is not a unique-device count.

OSU and KB

OS Update data in the Heimdal patch context; and a Microsoft Knowledge Base identifier. Update title and KB identity are not always interchangeable.

Available and Error

The agreed dashboard meanings behind "Not installed" and "Failed" in the PowerBI recipe. Verify actual raw API values before using those strings as filters. Error is shown separately from the Installed + Pending + Available base.

Saved report and Composite report

A canonical persisted analytical definition; and a report containing multiple sections/widgets. Composite filters are per widget, not automatically shared slicers.

Save and Save As

Save updates the opened object. Save As creates a separately named report.

Time bucket and UTC

A controlled Hour/Day/Week/Month interval using Coordinated Universal Time. A bucket count represents retained matching records, not independently verified incidents.

Drilldown

Opening supporting detail for a selected result. Supported cells are validated against the server result and original filters/authorization.

Cardinality limit

A bound on buckets, categories, series or cells. An overflow requires reducing the request; it is not silently converted into zero.

Dashboard refresh

Recalculation from local data. It does not force a Heimdal collection cycle or change a saved report's scope.

SIEM, SOC and CEF

Security Information and Event Management, Security Operations Center, and Common Event Format. HIA can deliver to configured destinations; choosing a preset does not provision the receiving system.

AI Activity and Ask Heimdal Data

AI Activity analyzes retained indicators; Ask translates supported questions into governed data requests using optional local AI. Neither proves what a user submitted to an AI service.

Worked example: from question to chart

Question: "Which patches account for the retained Server update assignments?"

1. Select Windows Patch Status — Update Details as the dataset.
2. Filter Device Type to the confirmed Server value.
3. Use Update / Version Title as the dimension and Endpoint / Update Entries as the metric.
4. Choose Pie / Donut as the visualization.

Suppose Patch A appears on Server One and Server Two, and Patch B appears on Server One. At assignment grain the counts are A = 2 and B = 1, total = 3. At unique-device grain there are only two servers. These totals answer different questions. A filter to Installed would recompute the result using only confirmed Installed assignments.

Pivot example: Choose security threat events, Day as the primary grouping, Severity as the secondary grouping, and event count as the metric. A cell containing 4 means four retained events for that day/severity under the selected scope and filters. It does not mean four distinct devices or four confirmed incidents. The patch assignment metric above is not admitted by this two-axis path.

Collection and evidence interpretation

Collection topology and credential domain

Topology describes how API Connections map to entities for data collection. A credential domain is the connection holding the credentials for that mapping. It answers "which key retrieves this customer's data?", not "which customers may this analyst see?"

Global SOC, Connection View and Custom Operational View

Global SOC selects authorized enabled entities; a Connection View selects authorized entities mapped to one connection; a Custom View stores an explicit selection. Dynamic membership is recalculated from current mappings, while static membership stores chosen entities. Both remain constrained by user permissions.

Ingestion, normalization and enrichment

Ingestion receives data. Normalization converts it into consistent local fields. Enrichment adds related context, such as Microsoft vulnerability information. Added context must retain its source and must not overwrite the meaning of the original observation.

Raw payload and provenance

A raw payload is the data received from a source. Provenance records where evidence came from and how it was derived. A local calculation or public metadata match should not be presented as an authoritative Heimdal statement.

Collector, realtime and backfill

Collection workers obtain upstream data. Realtime handles ongoing recent collection; it does not guarantee instantaneous visibility. Backfill retrieves older windows. Both are affected by source availability, quota, pagination and configured scope.

Cursor, checkpoint and lease

A cursor identifies the next page or position. A checkpoint records durable progress so work can resume. A lease temporarily assigns work to one worker and can expire after a crash. Progress saved after one page is not proof that the full window completed.

Quota, rate limit and concurrency

A quota limits attempts in a time window; a rate limit restricts request frequency; concurrency limits simultaneous requests. Eight requests per minute is different from four requests in flight. HIA shares admission among supported clients within one appliance.

Cooldown, retry and backoff

Cooldown delays new attempts after a limit or failure. A retry repeats a failed attempt. Backoff increases the delay between attempts; jitter adds a small variation so workers do not all retry together. Repeated attempts do not establish success.

Cadence, lag and TTL

Cadence is the intended frequency of work. Lag is how far processing trails the desired/current point. Time To Live (TTL) is how long cached evidence remains eligible for reuse before refresh. None of these guarantees that every device was refreshed on time.

Source coverage and processing coverage

Source coverage asks whether the relevant upstream data exists and was collected. Processing coverage asks whether retained data passed through the intended analysis. Successful processing of one source does not establish full coverage of all sources.

Finding, detection, control action and incident

A finding is an observed condition needing attention; a detection is a source-reported security observation; a control action records an intervention such as a block; an incident is an assessed security situation. A detection or block alone does not prove compromise.

Heimdal Risk Score and Operational Priority

The first is an upstream risk value when supplied. The second is HIA's local ranking of work using available context. They must not be substituted for one another or described as the same score.

Correlation and correlation confidence

Correlation links observations through defined relationships. Confidence expresses the strength of that linkage, not certainty that activity is malicious or attribution to an attacker.

MITRE ATT&CK, TTP and attack chain

ATT&CK organizes adversary behavior into tactics and techniques. TTP means tactics, techniques and procedures. A mapping or chain connects observed evidence to those behaviors; mapping confidence and progression do not establish compromise or attacker identity.

DNS and forensic snapshot

Domain Name System activity concerns name resolution. A forensic snapshot is explicitly captured investigative context at a point in time. Bounded DNS enrichment and snapshots do not establish continuous monitoring of all device activity.

NGAV

Next-Generation Antivirus. In reporting, NGAV detections are a source-specific dataset; a detection count measures retained observations under its defined contract.

NLI, LLM and Ollama

A Natural-Language Interface lets a user ask in ordinary language; a Large Language Model interprets/generates text; Ollama provides the local model runtime. Ask Heimdal Data uses governed supported requests. Model output is not an independent authority for database meaning or security conclusions.

Assets, patches and lifecycle

Endpoint, server, workstation and asset

An endpoint is a managed device. Server and Workstation are device classes when confirmed by source data. Asset is a broader inventory term. Unknown device class must not be guessed from its hostname.

OS build and baseline

An operating-system build identifies a specific release level. A baseline is a chosen comparison target. The documentation uses "baseline" for hardware requirements, Windows builds and release identity; always identify which meaning applies.

Patch applicability and supersedence

Applicability asks whether an update is relevant to a device/product. Supersedence means an update replaces another under an evidenced relationship. A larger version number or similar title alone is not proof that an outstanding patch is resolved.

Patch Tuesday and release date

Patch Tuesday refers to Microsoft's regular monthly update cycle. Release date is when an update was published. Neither is a verified installation timestamp on a particular endpoint.

Installed event and installation time

An Installed event records a reported status observation. Its timestamp must not automatically be labeled the moment installation completed. The customer reproduction uses retained current patch state, not a historical monthly installation total.

CVE, CVSS and severity

Common Vulnerabilities and Exposures gives a vulnerability an identifier. Common Vulnerability Scoring System describes technical severity using a defined scoring method. Severity labels express an assessment. None alone proves exploitability, compromise or business risk in the customer's environment.

Advisory and update impact

An advisory supplies information about a product/version issue. Update impact estimates what a proposed version change would address under available matching evidence. An uncertain product/version match must remain qualified.

Lifecycle, end of support and warranty

Lifecycle describes a product's release/support stages. End of support means a defined support period has ended. Warranty is a separate device/service entitlement. A published lifecycle date does not prove the customer has an active support agreement.

GB, GiB, CPU and vCPU

GB uses decimal bytes; GiB uses powers of 1024. CPU is the processor; vCPU is a virtual processor allocation. Capacity and utilization differ: installed RAM is not current RAM usage. Planning VM sizes are not measured scale guarantees.

Security, network and integration

Authentication and authorization

Authentication establishes who is requesting access. Authorization determines what that identity may do and which entities it may access. Successful sign-in is not permission to view all customer data.

Permission, role and entity grant

A permission allows an operation; a role groups permissions; an entity grant constrains the customer data to which access applies. Hiding a menu does not enforce these controls on the server.

Session, token, API key and secret

A session retains sign-in context. Tokens and API keys are credentials used by software. Secret is the broader class of confidential authentication/encryption material. A GitHub token, Heimdal key and HIA session serve different systems and are not interchangeable.

Passphrase and passkey

A passphrase is a memorized password made from words. A passkey uses a public/private-key authentication mechanism, typically unlocked on a device. They are different credential types with different recovery considerations.

CA, certificate chain, SAN and mTLS

A Certificate Authority issues certificates; a chain links a certificate to trusted issuers; Subject Alternative Name lists covered hostnames/addresses. Mutual TLS also authenticates the client using a certificate. Encryption alone does not prove the intended peer's identity.

Ingress, egress, reverse proxy and origin

Ingress is incoming traffic; egress is outgoing traffic. A reverse proxy receives browser traffic and forwards it to the application. Origin identifies the web scheme, host and port. Forwarded client-address headers are trustworthy only under the configured proxy policy.

Listener, port and exposure

A listener accepts connections on an address/port. Exposure describes where it can actually be reached. A saved port preference is not proof of an active listener or a router/firewall rule.

DMZ, firewall and CIDR

A demilitarized zone is a network segment with controlled access between other networks. A firewall filters traffic. CIDR expresses an IP network range, such as 192.0.2.0/24. HIA planning and account network restrictions do not themselves configure the perimeter firewall.

SSH, HTTPS, SMTP and webhook

SSH provides remote command access. HTTPS carries web requests over TLS. SMTP transports email. A webhook sends a structured HTTP request to a receiver. Each needs its own reachable endpoint and appropriate authentication.

HTTP status codes

401 usually indicates missing/invalid authentication, 403 denied access, 404 a missing resource, 429 throttling, and 5xx a server-side failure. An HIA API 401 does not establish that the reporting feature is absent.

Syslog, CEF and JSON payload

Syslog is a log-message transport/format family; CEF is a structured security-event format; JSON represents named fields and values. Receiver parsing and mapping are separate from successfully sending bytes.

Delivery queue, dead letter and replay

A queue holds work awaiting delivery. A dead letter has exhausted its allowed attempts. Replay submits retained work for another attempt. Fix the cause and consider duplicates before replaying.

At least once and deduplication

At-least-once delivery permits duplicates after retries or interruptions. Deduplication recognizes repeated event identities at the receiver. A successful TCP send does not prove that a SIEM indexed the event.

Audit and execution authority

Audit records who did what, when and under which scope/outcome. Execution authority is permission to perform a particular action now. An audit row or cryptographic match alone is not current permission to act.

Architecture, storage and verification

Frontend, backend and worker

The frontend is the browser interface; the backend validates requests and performs server work; a worker performs background jobs. Separate processes can still share one trust boundary.

PostgreSQL, Redis and schema

PostgreSQL is the relational database; Redis is a separate data service used by the application. A schema defines/organizes database objects. Redis state is not the authority for Heimdal product data.

Primary key, foreign key and identity collision

A primary key identifies a row; a foreign key relates it to another row. A collision occurs when distinct real objects map to the same supposed identity. Keeping a customer label in a report does not itself fix an insufficient storage key.

Transaction, atomicity and durability

A transaction groups database changes. Atomicity means they take effect together or not at all. Durability means committed state survives relevant failures. A database transaction does not automatically cover file replacement, container images or external API actions.

Idempotency

Repeating an operation has the same intended effect as performing it once. Retrying an elevation or delivery is not automatically safe; the operation must have an explicit identity and duplicate-handling contract.

Trust boundary and least privilege

A trust boundary separates components with different authority. Least privilege gives each component only what it needs. Several containers sharing database credentials are not automatically isolated from each other's data.

Retention, archive and purge

Retention controls how long data is kept; archiving moves retained evidence to longer-term storage; purging deletes it from a location. Verify-before-purge requires checking the archive before deleting source records. Archive coverage and backup recoverability are separate questions.

RPO and RTO

Recovery Point Objective is the intended maximum tolerable data loss measured in time. Recovery Time Objective is the intended restoration duration. They are targets until a representative recovery exercise demonstrates achievable results.

Rehearsal, fixture, smoke test and acceptance

A rehearsal exercises an operational procedure in isolation. A fixture supplies controlled test data. A smoke test checks basic operation. Acceptance determines whether the exact release meets agreed criteria. Synthetic success does not prove live data correctness or whole-appliance recovery.

Artifact, signature and quorum

An artifact is a delivered file/package. A signature can establish a cryptographic match to a key under a defined verification policy. A quorum requires a specified number of qualifying approvals/signatures. Test-key verification is not current production trust; signature quorum and dual-administrator approval are separate.

Fail closed and quarantine

Fail closed means denying a dependent action when required evidence is absent or invalid. Quarantine keeps recovered or questionable state blocked pending reconciliation. Restoring an old approval must not make it actionable again.

Operations and future extensions

TLS and trusted proxy

Transport Layer Security protects the connection; a trusted proxy policy determines how forwarded origin/client identity is interpreted. Neither configures a perimeter firewall by itself.

Backup, restore and rollback

Capturing recoverable state, recovering it, and returning from a failed change. A database transaction does not atomically restore all filesystem and host state.

Quiescence

A controlled period in which relevant writers stop changing state so consistent capture or transition is possible.

Preflight

Checking prerequisites before an operation. Passing an update intake/preflight check does not apply an update or authorize execution.

Portable package

A source ZIP carrying complete required/target component inventories. The receiving appliance verifies compatibility and binds its own runtime images. SHA-256 intake checks integrity; authenticated preparation authorizes work.

Recorded release

The locally accepted complete manifest, verified against actual source and runtime state; not merely the displayed application version.

Additive migration

A supported compatible schema addition retained with new data during application recovery. It is not permission for arbitrary or destructive SQL.

Worker & Schedules

Read-only scoped overview of collection and available scheduler observations. Existing schedulers retain their authoritative configuration.

Core and Extension

Core is the current appliance application and its trusted workers. A future Extension adds functionality through declared interfaces, permissions and lifecycle. The current collection module catalog is not a production extension loader.

Modified Core

Core bytes outside a recognized release identity, with potential compatibility/stability consequences. The agreed future extension policy keeps execution blocked for unsupported modified Core.

PEDM and Consumed

Privileged Elevation and Delegation Management; and a request already used. Existing telemetry remains in RC1; the Advanced PEDM conditional-elevation extension is Under Development. Restoring an old record must never restore an old approval.

Graph and Firewall provider

Future functional integrations with Microsoft Graph and the remote Firewall Integration Appliance. They are distinct from current Entra sign-in, Microsoft metadata and exposure planning.

Contract version and capability

Version of a declared integration interface, and an explicitly permitted operation. Core, Module and Contract versions must not be conflated in the future module lifecycle.

ISRA

Optional Independent Security Recovery Authority in the future design. LOCAL mode cannot prove detection of a rollback of all local state; activated external authority must not silently fall back to LOCAL during an outage. A co-restored container is not independent.

Compliance framework

A defined assessment standard and parameters, such as BSI, CIS Controls, Cyber Essentials or CAF. Compliance reporting remains future-version roadmap work; RC1 does not claim conformity.

Documentation coverage and further reading

This glossary supports the whole RC1 reading path and its maintained technical references. It defines reader-facing vocabulary rather than every internal code identifier. Related entries are grouped so a non-specialist can learn the concepts together.

• Installation, tester and Quick Start: Installation, Tester Guide, Quick Start
• Reporting and customer examples: User and reporting, PowerBI reproduction, two-dimensional reporting, refresh and coverage
• Team guidance and release status: CCSA Guide, feature register, release verification
• Architecture, security and operations: Architecture, review findings, administration, Entra, Secure Networks, outbound connectivity
• Collection and intelligence: shared quota, coverage, historical coverage, entity assessment, device assets, patch assessment
• Integration and future modules: outbound SIEM, Extension boundaries

Earlier terminology manuals inform stable vocabulary such as credential domains, Operational Views and evidence confidence. Their historical feature-status labels do not override RC1: for example, the current Security Timeline is documented as implemented even where an older glossary called a unified timeline future work.