Glossary

The terms below appear throughout Hal’s documentation, portal, and reports. A few are easy to confuse, so the definitions are written to be precise about how Hal uses them.

SIEM

Security Information and Event Management, a system that collects log events from across your environment, stores them, and runs detection logic over them. Hal includes a SIEM as the foundation his analysis runs on.

SOC

Security Operations Center, the function that watches for security events around the clock and responds to them. Hal acts as an always-on SOC, monitoring every client every few minutes without a team to staff.

Identity

A person or account that signs in and shows up in the logs Hal monitors. The identity is Hal’s unit of monitoring and billing, what you pay for is measured in identities, not in tenants or clients. Hal also counts the servers and workstations running his collector, and each day’s billable count is the greater of the identities and what those hosts count as; the pricing page says how.

Watch

Post-incident monitoring you open in chat: a saved search for an account, address or activity pattern that Hal re-checks on a schedule for a bounded time. A hit is an alert like any other, on the Events page and by email. See the Watches guide.

Sentry

A standing read of a client’s higher-risk people. Hal reads every event that names a person under sentry each cycle and escalates what does not fit what is known about them. Added in chat; listed read-only on Memories → Sentry. See the Sentry guide.

Client

One of your MSP’s customer organizations. A single client can span more than one tenant, for example, a customer with both a Microsoft 365 directory and a separate Google Workspace runs as one client across two tenants. Client and tenant are not the same thing.

Tenant

One upstream directory or workspace that Hal connects to, such as a single Microsoft Entra directory or a single Google Workspace. A client can own several tenants (a one-to-many relationship), but each tenant belongs to exactly one client.

Source

A category of log data Hal ingests, Microsoft 365 audit logs, Microsoft Entra sign-ins, Google Workspace activity, server logs, and so on. Each source feeds events into the detection pipeline. Sources can be muted individually from the portal during planned work.

Collector

The one piece of software Hal puts on a Windows host: a userspace log shipper that reads the host’s event logs and forwards them to Hal over HTTPS. Installed with -syslog, the same collector also receives the syslog of the site’s network devices on the LAN and forwards it under the client it was installed for. See Windows endpoints and Network devices.

Escalation

An event, or set of related events, that survived triage and was investigated and written up as a security report. An escalation is a conclusion Hal reached, not a raw alert, it includes severity, scope, and remediation.

Remediation

The specific fix for what an escalation found, the concrete steps to close out the issue. Every Hal escalation ships with remediation, so an alert and its answer arrive together.

Sigma rule

A community-maintained detection rule written in an open, vendor-neutral format. Hal runs about 600 curated Sigma rules to flag known attack patterns before his models weigh in. See the detection pipeline.

Triage

The process of sorting incoming events into what’s routine and what warrants attention. Hal’s triage runs in cheap-first layers and passes anything serious through two independent model judgments before it becomes an escalation.