Glossary

These are the terms the rest of the documentation leans on. Where a term has more to it than a one paragraph definition, the entry links to the page that covers it in full.

Account

The technical and URL level name for what the console UI and this documentation call a facility. You will see “account” in API-adjacent contexts, such as the MCP server or a URL, and “facility” everywhere else.

Alert

A record that a rule matched observed activity: a network flow, a device behaviour, or a configuration state. An alert records what triggered it, the resource involved, and when. See Detection model.

Alert group

A cluster of related alerts (the same rule, the same or related resource, within a time window) that the console aggregates so you review one incident instead of dozens of individual alerts. See Detection model.

Baseline

The statistical profile the sensor learns for a resource: packet and byte rates, broadcast and multicast share, and the set of destinations and protocols it talks to. A significant deviation from the baseline can trigger detection rules once it has enough samples to be reliable. See Baselines and anomaly detection.

Benchmark

A compliance framework, such as IEC 62443-3-3 or NIS2, expressed as a set of controls the platform evaluates. A facility’s score against a benchmark is the share of its controls and evidence requirements that pass. See Risk model.

Control

A single security check that evaluates one resource for one condition, such as default credentials or outdated firmware. A failed control produces a finding. See Risk model.

Facility

A site or plant that Safetybits monitors: one deployment of the sensor, and everything discovered through it. This is the term the console UI uses; the technical and URL level name for the same thing is account.

Finding

The result of a resource failing a control: a rationale for why it is a problem, and a remediation for how to fix it. You can mute a finding with a reason, which stops it counting against your score without deleting the record. See Risk model.

Network flow

A summary record of communication between two endpoints: source and destination, ports, protocol, byte count, and timestamps. Flows are aggregated from the raw traffic the sensor observes. See Network traffic and flows.

Organization

The tenant that owns one or more facilities. An organization administrator can reach every facility in their organization; anyone else can only reach the facilities they have been explicitly granted access to.

Resource

A device Safetybits has discovered on your network: a PLC, a switch, a workstation, anything that sends or receives traffic on a monitored segment. Prefer this term over “device” or “asset”, which mean the same thing but appear inconsistently in older material. See Discovery and the inventory.

Rule

A definition of what to look for: a name, a type, a scope of which resources it evaluates, and parameters you can tune. A rule maps to MITRE ATT&CK for ICS tactics and techniques, and produces an alert when it matches. See Detection model.

Sensor

The component that runs in your facility. It discovers resources, evaluates detection rules, builds baselines, and reports what it finds to the console. See Architecture.

Snapshot

A point-in-time capture of a facility’s inventory, security posture, and network activity, taken roughly every eight hours. Compliance, vulnerability matching, and risk scoring run at snapshot time; you can also trigger one manually. See Snapshots and change detection.

Zone

A free text label you can put on a resource, such as “Line A” or “Zone 2”, to group it the way your facility is actually laid out. It is an annotation, not a separate object with its own rules or boundaries.