# authorship: generated by API Evangelist tooling. Stamped 2026-08-18 # on the file's own generator header (roadmap#64). An unmarked file is # NOT assumed to be ours -- absence of evidence was never stamped. method: generated name: Secureworks Vocabulary description: >- Vocabulary and taxonomy for Secureworks and the Taegis XDR cybersecurity platform covering threat detection, incident response, security operations, and API integration concepts. created: '2026-05-02' modified: '2026-05-02' terms: - term: XDR definition: >- Extended Detection and Response - a security platform that collects and correlates telemetry across endpoints, network, cloud, and identity sources to detect and respond to threats comprehensively. tags: [Technology, Security Operations] - term: Alert definition: >- A security notification generated by Taegis XDR when suspicious or malicious activity is detected. Alerts include severity, MITRE mapping, affected assets, and status (open, in progress, closed, suppressed). tags: [Core Entity, Detection] - term: Investigation definition: >- A structured container in Taegis XDR for correlating related alerts and tracking the analysis and response to a security incident from detection to resolution. tags: [Core Entity, Incident Response] - term: Endpoint Asset definition: >- A device (workstation, server, or cloud instance) monitored by the Taegis XDR agent, providing telemetry on processes, network connections, and file activity. tags: [Core Entity, Endpoint] - term: Taegis definition: >- The Secureworks security operations platform providing XDR, managed detection and response (MDR), and vulnerability detection and response (VDR) capabilities. tags: [Product, Platform] - term: GraphQL definition: >- The query language used for all Taegis XDR API operations. Clients send POST requests with query or mutation strings to the /graphql endpoint. tags: [Technology, API] - term: MITRE ATT&CK definition: >- A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. Taegis XDR maps alerts to ATT&CK tactics and techniques. tags: [Framework, Threat Intelligence] - term: Countermeasure definition: >- A Taegis XDR automated or analyst-initiated response action such as endpoint isolation, process termination, or network blocking. tags: [Response, Security Operations] - term: Collector definition: >- A Taegis XDR integration component that ingests telemetry from third-party security tools, cloud services, and on-premises infrastructure into the Taegis platform. tags: [Integration, Data Ingestion] - term: Playbook definition: >- An automated workflow in Taegis XDR that orchestrates response actions across security tools based on alert conditions, reducing manual analyst effort. tags: [Automation, Response] - term: Client Credentials definition: >- OAuth2 machine-to-machine authentication credentials (client_id and client_secret) used by applications and scripts to authenticate to the Taegis XDR API. tags: [Authentication, API] - term: MDR definition: >- Managed Detection and Response - a security service where Secureworks analysts monitor, triage, and respond to threats on behalf of customer organizations. tags: [Service, Security Operations] - term: VDR definition: >- Vulnerability Detection and Response - a Secureworks service that identifies, prioritizes, and tracks remediation of vulnerabilities in customer environments. tags: [Vulnerability Management, Product] - term: Threat Intelligence definition: >- Contextual information about adversaries, malicious infrastructure, and attack techniques. Taegis XDR includes threat intelligence APIs for enriching alerts with indicator data. tags: [Intelligence, Detection]