Product and scope
- Nova
- Hansec's platform for cloud security, threat detection, incident investigation and response.
- Customer workspace
- The approved Nova boundary for one customer and its accessible security information.
- Organization
- An additional business grouping used where a customer separates divisions, environments, or managed customers.
- Connection
- An approved link that lets Nova receive evidence from or perform a supported interaction with another system.
- Source
- The provider, environment, or system from which evidence originates.
Evidence and assessment
- Evidence
- A source record, observed fact, or retained supporting item used in a security assessment.
- Event
- A record describing activity or state at a point in time.
- Finding
- An assessed condition that may need review, ownership, or correction.
- Alert
- A security signal produced when defined or assessed behavior needs attention.
- Observed
- Supported directly by eligible source evidence.
- Inferred
- A conclusion drawn from evidence rather than a directly observed fact.
- Simulated
- A modeled or tested possibility that must not be presented as observed activity.
- Confidence
- How strongly the available evidence supports a stated assessment under its current scope.
- Priority
- The relative need for attention based on the available impact, evidence, urgency, and context.
Coverage and workflow
- Coverage
- The intended scope for which eligible evidence was available and assessed.
- Freshness
- How recent the latest successful evidence is compared with the expected source timing.
- Stale
- Older than expected and potentially no longer representative of the environment.
- Partial
- Some intended evidence was assessed while a stated portion was unavailable or incomplete.
- Not assessed
- There is not enough approved evidence to make the stated assessment.
- Investigation
- Owned work that brings relevant evidence, assessment, decisions, and activity together.
- Response controls
- Permissions, policies and approvals that determine whether a response action may run, with a record of its result.
- Outcome
- The recorded resolution, accepted risk, supported action, or other reviewed end state.
Languages and engines
- NQL
- Nova's language for narrowing eligible event evidence during search.
- NovaQL
- Nova's language for defining and reviewing detection rules.
- Qyronis
- The Nova engine for behavior observation and explainable change from available baselines.
- NovaSignal
- The Nova engine for explainable prioritization and confidence.
- NADE
- The Nova engine that identifies gaps in detection coverage and proposes improvements for review.
- Velora
- The Nova investigation engine that helps analysts understand related activity and decide what to check next.
- VFP
- Controlled-preview pattern intelligence where that capability is included.
- RAZE
- The Nova engine that explores possible attack scenarios and the evidence needed to test them.
- DRX
- The Nova engine that coordinates supported response actions under customer policies and approvals.