Terminology

The Tenable Identity Exposure API and its interface name some concepts differently. The API reference uses the API's names, which appear in every path, property, and permission.

API Terms and Interface Terms

API Term	Interface Term	Description
infrastructure	Forest	An Active Directory (AD) forest that Tenable Identity Exposure monitors. Each infrastructure stores the service account used to connect to its domains.
directory	Domain	An AD domain that Tenable Identity Exposure monitors. Each directory belongs to an infrastructure.
checker	Indicator of Exposure (IoE)	A check that measures the security of your AD by detecting a type of misconfiguration.
attack type	Indicator of Attack (IoA)	A detection for an attack technique on your AD.
attack	Attack, or incident	An occurrence of an attack that an Indicator of Attack detected on a domain controller.
deviance	Deviance	A record of one AD object that an Indicator of Exposure flagged, for one reason. In the interface, each flagged reason on an object is a deviance, and an object with at least one is a deviant object.
reason	Reason	The attribute or condition that causes an Indicator of Exposure to flag an object.
AD object	AD object	A user, group, computer, or other LDAP object, or a Group Policy Object (GPO) file stored in SYSVOL, that Tenable Identity Exposure monitors.
event	Event, in the Trail Flow	A security-related change detected in a monitored domain, such as a password change or a new group member.
profile	Security profile	A customization of Indicators of Exposure and Indicators of Attack, so that different teams can review the same AD from different angles.
checker option	Indicator of Exposure customization	A setting that customizes how an Indicator of Exposure behaves in a security profile.
attack type option	Indicator of Attack customization	A setting that customizes how an Indicator of Attack behaves in a security profile.
alert	Exposure alert	A notification of new deviances in a security profile, shown under the bell icon.
email notifier	Email alert	A configuration that sends an email when Tenable Identity Exposure detects a deviance, an attack, or a health check status change.
syslog notifier	Syslog alert	A configuration that sends a message to a Syslog server, such as a security information and event management (SIEM) system.
score	Score	A rating of a directory's compliance from 0 to 100, based on the number and severity of its deviances.
relay	Secure Relay	The component that connects Tenable Identity Exposure SaaS to the domain controllers in your network.

For how the interface presents these concepts, see the Tenable One Identity Exposure SaaS User Guide.

Permission Entity Names

Role permissions use their own entity names, such as directory for domains and checker for Indicators of Exposure. For the mapping between those names and the entities on a role's Permissions Management pane, see Identity Exposure Permissions.