The modern SOC, defined.
Plain-English definitions for the terms we use across the platform and this site. No jargon for jargon's sake.
Agentic SOC
A security operations model where reasoning agents do the default investigation and response work, with humans supervising the contested and high-impact calls.
SOAR
Security Orchestration, Automation, and Response. Traditionally playbook-driven; Soarcery replaces the brittle playbooks with agents.
Verdict spread
The full set of per-engine verdicts and confidences for an indicator, kept intact instead of averaged into one score.
Confidence spread
A single value expressing how much the engines disagree. A high spread marks the verdict contested and routes it to a human.
Autonomy dial
A per-use-case control for what runs automatically versus what requires human approval.
Human-on-the-loop
A model where automation acts within bounds and a human supervises and approves the consequential moves.
Enrichment
Adding context to an indicator, such as reputation, ownership, or related activity, to inform the verdict.
Indicator
An observable such as a file hash, URL, domain, IP, or account involved in an alert.
MTTR
Mean time to respond. A lagging measure of how fast a SOC contains threats.
Trigger
What starts a workflow run: manual, schedule, webhook, email, or form.
Run
A single execution of a workflow, with its own evidence and audit trail.
Reversible action
A response designed to be undone, so an automated step is never a one-way door.
Agentic SOAR
Orchestration, automation, and response where reasoning agents, not pre-built playbooks, investigate and drive the response, within human-set autonomy limits and with a full audit trail. The category Soarcery builds.
Agentic SOC analyst
An AI agent that works tier-1 alerts the way a human analyst would, then closes or escalates with evidence attached. In agentic SOAR it also executes the gated response.
Agent washing
Marketing a rules engine or a summarizer as an autonomous agent. The test is simple, ask what it did last week, who approved it, and where the trail is.
Approval gate
The queue where consequential actions wait for an explicit, recorded human decision, with the evidence and blast radius attached.
Reasoning trace
The readable record of how an agent reached a conclusion, the steps considered, the evidence weighed, and the dissent noted. One click on every Soarcery verdict.
Human-in-the-loop
A model where a human approves each action before it runs. Compare human-on-the-loop, where automation acts within bounds and humans supervise the consequential moves.
Receipt
Our word for the complete, replayable record of a case, every step, tool call, cost, confidence, and approver. If a vendor cannot show one, they are selling trust without evidence.
Familiar
The conversational front door at the heart of Soarcery, rendered as a dragon. You state an outcome in plain English; it plans first, showing the steps, the tools, and its assumptions, then builds and casts the work across your stack once you approve. It plans and recommends but never disposes, so anything consequential routes to the Seal. Automation without authoring.
Spell
The response the Familiar builds and casts across your stack, mapped to MITRE D3FEND. A Spell can contain, isolate, evict, or restore, and is reversible by design. It is planned first and shown before it runs, and consequential steps stop at the Seal.
Spellbook
Your saved Spells. Every Spell you build and approve is saved and versioned, ready to run again on demand, with its plan-first, Seal-gated behavior intact.
Bazaar
The catalog of prebuilt Spells you can adopt for common outcomes, such as alert triage or phishing response, instead of starting from a blank prompt. Read a Spell's plan, tune it to your stack, and it lands in your Spellbook.
The Seal
A deterministic policy gate that lives outside the model and decides what the Familiar may do on its own and what must wait for a human. Anything destructive or high-blast-radius stops at the Seal with its rationale and a reversible plan, so the AI is never above the law.
Case
A stitched, entity-correlated timeline of the signals that share an entity, worked end to end by the Familiar from alert to sealed response.
Tools
The connected security and IT systems the Familiar reads from and acts through, such as SIEM, EDR, identity, email security, and ticketing. If it has an API, it connects, with no rip-and-replace.