Glossary
Short definitions of every term you meet in the EyalSec dashboard and this guide, in alphabetical order, each with a link to the page that explains it fully.
A to C
The terms from A to C.
Activity log
A record of actions on your account, with the time, action, target, IP address, how you were signed in, and the outcome; see Activity log.
Advanced search
The panel on the events page for a precise time range, a scope, and field-by-field conditions, beyond the quick filters in the toolbar. See Advanced search.
Agent
The part of EyalSec that runs on your computer or server, watches your program, and sends events to the dashboard. Each product is an agent for one language or platform, for example es-python for Python programs.
API key
A token, starting with es2_, that lets a script use the EyalSec API on your behalf without a browser sign-in. It is shown only once when you generate it, can be read-only, and can be revoked at any time; see API keys.
Backup code
A one-time code, shown when you set up two-factor authentication, that you can type instead of your authenticator app's code if you lose the device. See Backup codes.
Blacklist and whitelist
The two text filters on the events toolbar. A whitelist shows only the events that match its pattern; a blacklist hides the ones that match. See Filtering events.
Blocked event
An event you chose to stop seeing with the row menu's Block actions (this sink, this source, or one of its impact tags). Block is offered on es-chromium; es-python's row menu writes a rule instead. Blocked events are listed on the es-chromium Filters page, where you can unblock them; see Blocked events.
Build version
A label identifying exactly which EyalSec build a machine is running. The Machines page compares it with the newest build and shows up to date or newer build available; reinstalling takes the newer one. See Build badge.
Call path
The plain name for the stack trace: the chain of function calls that led to the risky operation. An opened es-python event shows it under Call path; see Call path.
Clone warning
A clone badge on a machine means its install was seen from a second computer, or showed signs of tampering. The machine's events are refused until you reinstall it; see Machine badges.
Command line
The command that started the program that produced an event, for example es-python app.py --port 8080. It is sent with each event by default, with secret-looking values masked; see Sent with each event.
Conditional
A sanitization result meaning the value was cleaned, but in a way that is safe only in some situations. For example, text escaped for one part of a web page can still be dangerous in another part, or a value is cleaned and then handed to another program that may undo the cleaning. EyalSec cannot prove it safe, so the event stays visible and may be rated one level lower. An opened es-python event shows it as Only partly under Was it made safe?; see Was it made safe?.
Configure
The modal, opened from a machine's row or the Filters page, where you choose which sources a machine watches, what is sent with each event, and its rules. See Configure.
Count
The number on an event row saying how many times that same event happened. Repeats of an event are counted on one row instead of filling the list; what counts as "the same" is set by Unique event. See Events.
CVE
Short for Common Vulnerabilities and Exposures, the public naming scheme for known security flaws (for example CVE-2021-44228).
D to M
The terms from D to M.
Dashboard
The EyalSec website you sign in to. It also names its first page, which summarizes your machines and recent events; see Dashboard.
Data flow
The block in an event's detail that shows how the untrusted value was built up on its way to the sink. See Event detail.
Default rules
The two Don't send rules every account starts with (re and write). These broad rules drop matching events at the machine until you change or delete them; see Default rules.
Drop
The Don't send mode of a rule: the machine does not send matching events at all. A dropped event is never stored, cannot be recovered, does not count against your quota and is not billed. See Don't send.
es-python
es-python is the EyalSec Python runtime: you run your programs with es-python instead of python, and it reports untrusted data reaching a sink. You start a program with es-python app.py in place of python app.py; see Running es-python.
Event
An event is EyalSec's record that untrusted data reached a sink, with the operation, the line of code, the value and its origin. It is one finding: data from a source reached a sink in your program. Events appear on the events page; see How it works and Events.
Events list
The events page for one product. Each product your account has gets its own list in the sidebar, folded into an Events group when you have more than three. See Events.
Foreign code
Python code loaded from a file that another user on the computer can change. Loading it is a risk because that user could change what your program does. The source that reports it is shown as Files other users can change, with the technical name foreign. The same source also marks data your program reads from such a file. On the events list a code load reads "Data from a file other users can change was run as code". See foreign.
Handoff
A switch, shown as Follow into the browser (handoff), that lets a monitored web service tell the EyalSec browser which parts of a page came from the visitor's own input, so a flow can be followed from the server into the page. It marks no data, so no event is ever attributed to it and no rule can target it. A handoff sink is an operation that passes data to another program which may decode it first (a shell command, for example), which is why cleaning a value before such a sink is only ever conditional. See handoff.
Global
Settings that apply to every machine of a product in your account, set on the Filters page. A machine's own setting overrides the global one; see Scope.
Impact tag
A short colored tag on an event, such as sqli or xss, naming the kind of attack the finding could allow; the color is that tag's severity. You can filter the events list by tag; see Filtering.
Install command
The one-line command the dashboard gives you to run on a computer, which installs the agent and links it to that machine. It works once and expires; see Install.
Label
A name and color you create and attach to events to sort them, such as "fixed" or "needs review". Labels work across all your events lists; see Labels.
Machine
One place where an EyalSec product runs and reports to your account, registered on the dashboard: usually a computer, server or container, and for some products a service, project or browser PC. Events are recorded per machine; see Machines.
Machine limit
How many machines your plan lets you have for each product. See Machine limit.
Map
A layout of the es-python events list that draws your events as a graph from sources through files to sinks, instead of a table. See Events map.
Masking
Replacing values that look like secrets (passwords, tokens, keys, URL passwords) with [masked] before an event is sent. See Masking.
Mode
What a rule does with the events it matches: Show or Hide (only change what you see), Don't send (drop) or Raise (block). See Rules.
N to R
The terms from N to R.
Neutralized
The strongest sanitization result: EyalSec showed the value could not change what the risky operation does, for example because it contains none of the characters that operation treats as special, or because it was escaped by a function known to be safe for exactly that use. Only a neutralized event is suppressed. An opened es-python event shows it as Yes under Was it made safe?.
No plan yet
The state of a newly registered account before EyalSec sets up a plan: you can sign in, but you cannot add machines or see events. Contact sales to get set up; see No plan yet.
Note
Text you write and attach to one event, for example what you found when you looked into it. See Notes.
Old copy running
A warning on a machine meaning a program from an earlier install of that machine is still running. It can no longer send events; restart it under the current install. See Machine badges.
Origin
Where the untrusted data in an event came from, in more detail than the source: for example which connection or file it was read from, and for a file, who can change it. An opened es-python event shows it under Where it came from; see Where it came from.
Plan
What your account includes: which products, how many machines, how many events per month, and whether Raise is allowed. Plans are set up by EyalSec sales; see Plans.
Product
One of the two EyalSec agents: es-python, which watches Python programs, and es-chromium, the EyalSec browser. Each product is enabled per account and has its own events list; see Products.
Public ID
A machine's shareable identifier, used by the dashboard and the API to refer to it. It reveals nothing secret, unlike the machine's token. See Machines.
Quota
The number of events (rows) each events list shows per calendar month on your plan. Repeats of an event already shown do not use it. Events past the quota are still recorded but stay hidden unless the quota is raised, and each new month starts with fresh room; see Event quota.
Raise
Blocking: instead of only reporting, the agent stops the risky operation, in es-python by raising a RuntimeError at that spot. It is the rule mode that puts a machine in Report and Raise for the operations it matches, and it must be enabled on your plan; see Report and Raise.
Report
Report mode records each flow of untrusted data into a sink as an event on the dashboard and lets the program keep running. It is the default for every machine; see Report.
Report and Raise
Report and Raise mode records the event and also stops the operation, raising a Python RuntimeError instead of running it. You turn it on with a Raise rule; see Report and Raise.
Repr
Short for representation: the untrusted value itself, written out as text. An opened es-python event shows it twice, as Value when the data came in (repr created, how it looked when it entered the program) and Value when it was used (repr found, how it looked when it reached the sink). Comparing the two shows what your program did to it on the way. Some lists also show it in a Value column, and the whitelist and blacklist filters match against it; see Event detail.
Row menu
The menu you open by right-clicking an event, or with its ⋮ button, to label it, add a note, or block similar events. See Row menu.
Rule
A setting that decides what happens to events matching a pattern: show them, hide them, stop them being sent, or block the action. Rules can be global or per machine; see Rules.
Rule template
A saved set of rules you can apply to a machine or your global settings in one step. EyalSec provides some and you can make your own; see Rule templates.
Run
One start of a program, from launch to exit. es-python tags each event with its run, so you can pick a run on the events page and see only what that invocation did; see Runs.
S to Z
The terms from S to Z.
Sanitized
Data that your program made safe before using it, for example by escaping it or by passing it to a database as a parameter. EyalSec checks this for each event and reaches one of three results:
- Neutralized: the value provably could not cause harm where it was used. The event is suppressed.
- Conditional: it was cleaned, but the cleaning holds only in some situations. The event stays visible.
- Unknown: nothing showed that it was made safe. This is the default, and the event is unchanged.
An opened es-python event shows the result in plain words under Was it made safe? (technical term sanitization), and the other products in their Sanitization block. See Was it made safe? and Suppressed events.
Saved search
A set of events filters you saved under a name so you can load it again later. See Saved searches.
Severity
How serious an event is: critical, high, medium, low or info. EyalSec works it out from what the event shows, and you can filter by it; see Severity.
Sink
A sink is a dangerous operation where untrusted data can do harm, such as running a shell command, sending a database query or evaluating code. The event's sink label (for example os system) says which operation it was. On the es-python events list it is the end of the row's sentence ("... reached a system command"), with the label itself in the smaller line underneath; see How it works.
Socket-only
A badge on some older es-python machines that can watch only network data. New machines are never socket-only; see Machine badges.
Source
A source is a place where untrusted data enters a program, such as a network socket, a file, standard input or an environment variable. In the dashboard they are named in plain words with the technical key beside them: Network input (socket), Files read (file), Standard input (stdin) and so on. A machine you add starts with Network input and Files read on and every other source off. On the es-python events list the source is the start of the row's sentence ("Data from a network connection ..."); see How it works and Taint sources.
Stack trace
The chain of function calls that led to the risky operation, so you can find the line in your code. An opened es-python event shows it as Call path. See Call path.
Status
Where a machine is in its setup: created (registered, not installed), pending (install started), installed (working) or failed. See Status.
Suppressed
An event hidden from the normal list because EyalSec found the data was made safe before it was used. Suppressed events are still stored; the Show control on the events page reveals them. See Suppressed events.
Taint
EyalSec's word for untrusted data: data that came from outside your program, such as network input or a file someone else can write. Data that carries it is called tainted, and a taint source is where it enters (see source). EyalSec follows it through your program, including copies and pieces of it, to see whether it reaches a sink; see How it works.
Taint tracking
Taint tracking is a runtime technique that marks data from untrusted sources and follows it through every transformation until it reaches a dangerous operation. It is what es-python does while your program runs; see How it works.
Token
A machine's private credential, which its agent uses to prove which machine it is. It is never shown in the dashboard. Treat it like a password.
Two-factor authentication
A second step at sign-in, where you type a code from an authenticator app (or an emailed code, or a backup code) after your password. See Two-factor authentication.
Unique event
The setting that decides when a new detection is "the same" as an earlier one and only raises its count, and when it opens a new row. See Unique event.
Unset
A source or setting left without an explicit choice on a machine, so it follows the global setting (or the agent's own default). See Unset.
Untrusted data
Untrusted data, also called tainted data or taint, is any data a program received from outside, such as a network request or a file. It enters through a source; see How it works.