| Agent |
The Garrison program on an enrolled system that runs approved commands and reports health |
| Appliance |
The DGX Spark box (or boxes) running Garrison |
| Approval |
A proposed change waiting for, or decided by, a person |
| ATT&CK |
MITRE’s catalogue of attacker techniques; hunts are mapped to it |
| Baseline |
A device configuration you mark as correct; later pulls are compared with it |
| Case |
One or more related SIEM alerts, triaged together |
| Crown jewel |
A tag for business-critical systems: their alerts rank higher |
| Drift |
A difference between a device’s current configuration and its baseline |
| Enrichment |
Context Garrison adds to a case: the asset, previous sightings, related cases |
| Escalation |
A notification that a case is going unhandled |
| Finding |
A problem a scan, hunt or audit found, with evidence and a recommendation |
| Garry |
Garrison’s AI assistant |
| Hunt |
A hypothesis turned into a SIEM query, run on demand or on a schedule |
| MTTA / MTTR |
Mean time to acknowledge / to resolve a case |
| OAF |
Open Agent Fabric, the open-source AI platform Garrison runs on |
| Pair |
Two boxes joined by a QSFP cable, running a model across both |
| Read-only |
A step the appliance verifies cannot change anything; it runs without approval |
| Role |
A job for a system (log collector, scanner, jump host, threat-hunting console) |
| Scope |
The systems, tags or cloud accounts a chat, hunt or job acts on |
| Verdict |
The analyst’s conclusion on a case: benign, policy violation, suspicious, confirmed, inconclusive |
