Glossary

Observable — An atomic, reusable piece of evidence (IP, hash, domain, username, etc.) stored in a shared registry that persists across cases. See the observable-centric model.

Sighting — A record of an observable being seen at a point in time. Re-seeing the same value adds a sighting to the existing observable rather than creating a new one.

Event schema — A first-class definition of the shape and meaning of a class of events (fields + identifiers), with a DRAFT → ACTIVE → DEPRECATED lifecycle. See event schemas.

Case — An investigation, moving through the status machine OPEN → IN_PROGRESS → RESOLVED → CLOSED (with REOPENED). Carries tasks, comments, tags, attachments, and sequence steps.

Sequence step — An ordered entry documenting the investigation timeline within a case.

Alert — An inbound event (e.g. from a SIEM webhook) that may be triaged and linked to a case.

Tenant — An isolated workspace. Users, cases, schemas, and observables are scoped to a tenant.

System user — A user with no tenant (tenant_id = NULL) who can operate across all tenants. Contrast with a tenant user, pinned to one tenant.

Role / permission — Access is governed by roles (built-in SUPER_ADMIN / ADMIN / USER, plus custom roles) made of granular permissions like cases:update. See the permission matrix.

CTI — Cyber Threat Intelligence. External providers (VirusTotal, AbuseIPDB, MISP, Shodan, GreyNoise, OTX) used to enrich observables.

Enrichment — Querying CTI providers for a verdict on an observable; can drive auto-tagging.

Playbook — A reusable, ordered set of ACTION/DECISION steps applied to a case to standardize an investigation. See playbooks.

Milestone — A metric-based goal (e.g. cases_resolved) tracking analyst activity.

Audit log — The append-only record of who did what, with outcome and context. See audit & events.

Module bus — The in-process event bus over which domain modules communicate (not HTTP).

SSE (Server-Sent Events) — The streaming channel that delivers live case updates and analyst presence to the browser.

Optimistic concurrency — The mechanism that returns 409 Conflict when two users edit the same case, preventing silent overwrites.

Source type — Where ingested data originates: WINDOWS, LINUX, or NETWORK.

Air-gap — Operating with no internet connectivity. Ticketra supports fully offline deployment.