Term	Meaning
Active Response	Durable, catalogued containment or one-shot endpoint action
Agent Config	Versioned per-OS agent collection/telemetry settings
AMTD	Invinsense Automated Moving Target Defense (Morphisec integration)
Artifact	Server-compiled policy output delivered to an endpoint
ASR	Microsoft Defender Attack Surface Reduction rules
Audit mode	Evaluate and report policy without blocking
Base group	The single group resolving a device’s base policy
Base policy	Platform trust envelope and policy options
CIP	Windows binary policy artifact format
CIS benchmark	Configuration-assessment benchmark imported as a content source
ClickHouse	High-volume event/analytics database
Control identifier	Stable device-group-owned GUID used in generated WDAC identity
Device override	Time-boxed device-level divergence from group mode
Discovery Scan	Endpoint scan converting observed files into rule candidates
EPSS	Exploitation prediction score used to prioritise vulnerabilities
EventHub	Console-facing real-time hub
FIM	File Integrity Monitoring
GBD	Global Block Domain / tenant-wide blocklist
Gatekeeper	macOS application assessment control
Group scope	Per-user device-group visibility grants
JIT	Just-in-Time, temporary approved elevation
KQL	UEC’s Kusto-inspired list-search grammar
Live Response	Catalogued interactive command execution on a device
MCP	Model Context Protocol connector
MDE	Microsoft Defender for Endpoint
NATS JetStream	Asynchronous event transport
OCSF	Open Cybersecurity Schema Framework
Other group	Organisational group that cannot hold WDAC assignments
Policy variant	Immutable named policy snapshot
PostgreSQL	Authoritative domain database
Protector	AMTD endpoint protection agent
Ring	Ordered staged rollout target
SignalR	Real-time bidirectional transport
SiPolicy XML	WDAC XML policy representation
Supplemental policy	Additive trust bound late to a device’s base
UEBA	User and Entity Behavior Analytics
WDAC	Windows Defender Application Control
XProtect	macOS built-in threat protection technology