Investigation and Evidence Glossary
This category should define terms used in detection, analysis, and investigation without providing detailed forensic procedures, legal strategy, or proprietary escalation workflows.
Use this category page to introduce the term family, list individual glossary entries, explain how the terms relate to insider risk exposure, and route readers to Foundations, Use Cases, Procedures, Tools, Standards, Metrics, Personas, and relevant IRCF™ pages.
Terms in this Category (7)
Alert Triage
Alert triage is the initial review of a signal or alert to determine relevance, urgency, context, and next action.
Behavioral Baseline
A behavioral baseline is an expected pattern of activity for a user, role, entity, system, or population used to identify meaningful deviations.
Case Management
Case management is the structured process for opening, documenting, routing, investigating, resolving, and learning from insider-risk matters.
Chain of Custody
Chain of custody is the documented record of how evidence is identified, collected, handled, transferred, stored, analyzed, and preserved.
Confidence Score
A confidence score is an expression of how much trust an analyst, program, or decision maker can place in a finding, assessment, or risk conclusion.
False Positive
A false positive is an alert, finding, or signal that appears concerning but is later determined not to represent the suspected risk or violation.
Legal Hold
A legal hold is a process used to preserve information that may be relevant to litigation, investigation, regulatory inquiry, or other legal obligation.