Glossary

The terms below appear throughout Hal’s documentation, portal, and reports. A few are easy to confuse, so the definitions are written to be precise about how Hal uses them.

SIEM

Security Information and Event Management — a system that collects log events from across your environment, stores them, and runs detection logic over them. Hal includes a SIEM as the foundation its analysis runs on.

SOC

Security Operations Center — the function that watches for security events around the clock and responds to them. Hal acts as an always-on SOC, monitoring every client every few minutes without a team to staff.

Identity

A person or account that signs in and shows up in the logs Hal monitors. The identity is Hal’s unit of monitoring and billing — what you pay for is measured in identities, not in tenants, clients, or devices.

Client

One of your MSP’s customer organizations. A single client can span more than one tenant — for example, a customer with both a Microsoft 365 directory and a separate Google Workspace runs as one client across two tenants. Client and tenant are not the same thing.

Tenant

One upstream directory or workspace that Hal connects to, such as a single Microsoft Entra directory or a single Google Workspace. A client can own several tenants (a one-to-many relationship), but each tenant belongs to exactly one client.

Source

A category of log data Hal ingests — Microsoft 365 audit logs, Microsoft Entra sign-ins, Google Workspace activity, server logs, and so on. Each source feeds events into the detection pipeline. Sources can be muted individually from the portal during planned work.

Stream

A single feed of events from one source within one client, routed and labeled so Hal can monitor it on its own. A client typically has a few streams, one per connected source.

Escalation

An event, or set of related events, that survived triage and was investigated and written up as a security report. An escalation is a conclusion Hal reached, not a raw alert — it includes severity, scope, and remediation.

Remediation

The specific fix for what an escalation found — the concrete steps to close out the issue. Every Hal escalation ships with remediation, so an alert and its answer arrive together.

Sigma rule

A community-maintained detection rule written in an open, vendor-neutral format. Hal runs about 600 curated Sigma rules to flag known attack patterns before its models weigh in. See the detection pipeline.

Triage

The process of sorting incoming events into what’s routine and what warrants attention. Hal’s triage runs in cheap-first layers and passes anything serious through two independent model judgments before it becomes an escalation.