Elastio Glossary
Definitions for the platform, its detection methods, and the evidence behind provable recovery.
52 terms
A
AgentlessArchitecture
Elastio deploys without installing agents on production workloads. All analysis happens through API-level access to snapshots, storage volumes, and backup repositories. No kernel modules. No sidecars. No performance impact on production.
Air-GappedArchitecture
A deployment mode where Hunt operates in an environment with no outbound internet connectivity. Hunt runs as a single binary against storage volumes across block, file, and object storage. No cloud connection required. Used in regulated environments, classified networks, and high-security deployments.
Air-Gapped BackupIndustry Context
A recovery copy isolated from production through physical or logical separation. Isolation protects access to the copy; analysis establishes what it contains. Hunt can provide recovery intelligence for isolated copies where the deployment and read path support analysis.
Artifact TablesDetection
The evidence Hunt collects during analysis, queryable through standard SQL in the Hunt CLI: file paths and timestamps, executables and their signing status, offline Windows registry hives, encryption markers, persistence mechanisms, credential harvesting indicators, and timeline data. Artifact tables enable post-incident analysis without re-hunting the environment.
AttestationMetrics
A timestamped, evidence-backed record that a specific asset or recovery point was analyzed and found clean or compromised at a given point in time. Attestations are the audit artifacts Elastio produces. Used for compliance reporting, board evidence, and regulatory response.
B
Backup ConnectorArchitecture
The integration component that connects Hunt to backup vendor repositories. Provides read-only access to backup data managed by Veeam, Rubrik, Cohesity, Commvault, Veritas, AWS Backup, and Azure Backup. Mounts backup recovery points for Deep File Inspection without modifying or disrupting the backup environment. Enables third-surface coverage.
Backup DataData Surfaces
The third data surface. Recovery points created and managed by backup vendors. Examples: Veeam backup jobs, Commvault data agents, Cohesity protection groups, Rubrik SLA domains, AWS Backup vaults, Azure Backup vaults. Elastio hunts across backup data from any supported vendor.
Backup Integrity ValidationIndustry Context
Analysis of recovery data for encryption, malware, corruption, or tampering. Hunt records the findings and completed checks so teams can evaluate recovery points before an incident. Backup completion and data integrity answer different questions; application recovery still requires validation after restore.
Blast RadiusMetrics
The total scope of assets, data, and recovery points affected by a detected threat. Measured after Hunt findings are correlated across all three data surfaces. Blast radius determines how far back recovery must go and how many assets require remediation.
C
Clean BoundaryMetrics
The observed transition between analyzed clean recovery points and points with detected threats. It helps narrow recovery selection. It does not establish that every earlier copy is clean or that the first detection is the exact time the attacker entered.
Clean Recovery PointIndustry Context
A recovery copy with completed analysis supporting its clean status for the checks performed. Review the copy identity, scope, results, and analysis time before use. The combined Elastio clean definition requires Pursuit to find no attack and Hunt to find no ransomware in the same copy. Copy age and protection requirements are assessed separately.
Cloud ConnectorArchitecture
The compute component deployed inside the customer’s cloud account that runs Hunt. Connects to cloud-native storage APIs (EBS, S3, FSx, Azure Blob, IBM COS) to mount snapshots and volumes for analysis. No agents on production workloads. No data leaves the customer environment. All compute, storage, and hunt state remain inside the customer’s cloud account. Supports AWS, Azure, and IBM Cloud.
Continuous HuntPlatform
Recurring analysis governed by a policy defining asset scope, detection rules, and schedule or event trigger. Hunt analyzes available data and recovery copies and records completed results over time. Teams review failures and partial coverage alongside findings. Continuous analysis does not imply uninterrupted live monitoring or that every source has been successfully analyzed.
CoverageMetrics
The assets and data sources included in analysis, together with evidence that the required checks completed. A policy assignment alone does not prove completed analysis or a clean result. Review exclusions, failed jobs, and partial coverage when assessing recovery evidence.
Custom HuntsDetection
Customer-defined detection rules that extend Hunt beyond its built-in hunts. Each rule uses a read-only SQL Hunt Query over snapshot evidence such as files, executables, and registry records. Queries can search file contents and call optional YARA rules. Create a rule or clone an Elastio-authored rule, refine it in Tuning, then activate and attach it to a policy. Active matches produce findings. A rule must be attached to a policy to run.
Cyber RecoveryIndustry Context
Restoring systems and data after a cyberattack using a recovery source supported by security evidence. Hunt provides recovery intelligence by identifying infection, damage, and clean recovery points. Pursuit checks for attacker activity in the selected system copy. Recovery tooling performs the restore; the team validates the applications and services.
Cyber ResilienceIndustry Context
An industry term for an organization’s ability to anticipate, withstand, recover from, and adapt to cyberattacks. It reaches past prevention to include detection, response, and proven recovery. Elastio addresses the half that is hardest to evidence: proving the organization can restore from data that is clean.
Cyber VaultArchitecture
An isolated environment that protects recovery copies through controls such as access separation and immutability. Hunt adds recovery intelligence through read-only analysis of vaulted copies. Existing vault controls protect the copies; analysis establishes whether their contents support a clean recovery decision. Deployment and read-path requirements vary by environment.
D
Data ClassificationDetection
A built-in Hunt function that identifies sensitive information such as personal, health, and payment-card data, plus credentials. It adds context for impact assessment and response priorities. Classification alone does not prove theft or a clean recovery result. View availability depends on the enabled product features.
Data ExfiltrationIndustry Context
The unauthorized transfer of data out of an organization. Pursuit investigates evidence of data collection, staging and transfer recorded in the analyzed system. A finding can help responders establish what happened; it does not by itself establish that theft was prevented.
Data SurfacesData Surfaces
The three categories of data Elastio covers. Always in this order: Live Data, Replicated Data, Backup Data. A solution that only hunts backup data leaves the other two surfaces uncovered. Threats that stage in live data or replicated data before reaching backups are invisible to backup-only detection.
Deep File InspectionDetection
Hunt analysis of file contents for evidence of ransomware, malware, and damage. It combines known-family matching, detection of unfamiliar ransomware, and comparison across copies, alongside other Hunt checks. Findings connect detected threats to affected files. Analysis scope and completion determine what the result covers.
DORA (Digital Operational Resilience Act)Industry Context
The EU Digital Operational Resilience Act sets requirements for managing ICT risk and testing operational resilience in the financial sector. Elastio’s recovery evidence can support resilience assessments and reporting. It does not by itself establish regulatory compliance.
Double ExtortionIndustry Context
A ransomware tactic where attackers both encrypt an organization’s data and threaten to publish stolen data unless a ransom is paid. Pursuit reports the data staging and exfiltration activity that precedes double-extortion payloads.
Dwell TimeIndustry Context
The time between an attacker’s initial access and detection. Some attackers leave system artifacts before encrypting data. Pursuit investigates those artifacts; Hunt analyzes data and recovery copies for threats and damage. Analysis findings do not by themselves establish the exact time initial access occurred.
E
ElastioPlatform
The Ransomware Security Platform. Pursuit investigates active compromise in systems. Hunt provides recovery intelligence across data and its copies. Their combined analysis supports provable recovery. AI Attack Readiness connects that evidence to protection requirements and business recovery commitments.
Elastio ConsoleArchitecture
The control plane for configuring analysis policies, reviewing findings and recovery evidence, and managing recovery commitments. Console hosting and analysis deployment are separate choices. Deployment-specific documentation identifies where analysis runs and what findings, metadata and other information are transmitted.
Elastio HuntPlatform
The recovery intelligence layer for data and its copies. Hunt analyzes live data, replicas, and existing recovery copies for ransomware, malicious encryption, known malware, and file-system damage. Data classification identifies sensitive information; Custom Hunts add environment-specific detection. Findings, analysis scope and time, and recovery history help teams select a clean recovery point. Pursuit adds investigation for attacker activity in the same copy.
Elastio MCP ServerPlatform
An implementation of Anthropic’s Model Context Protocol that connects AI assistants directly to your data through Elastio. Enables natural language queries against findings, recovery status, and hunt orchestration. Available at mcp.elastio.com.
Elastio PursuitPlatform
The product that investigates attacker activity from snapshots and machine images outside the running host. Pursuit analyzes code, configuration, and system records for persistence, defense evasion, credential theft, lateral movement, and evidence of data theft. In Elastio’s seven-stage attack model, Pursuit focuses on stages 3–5 to support response before theft and encryption. These are Elastio’s explanatory stages, not MITRE ATT&CK stage numbers.
F
File System VerificationDetection
A built-in Hunt check for file-system corruption or tampering that could affect recovery. It provides integrity evidence for the analyzed copy. It does not replace testing that restored applications and services work.
H
Hunt Detection ModelsPlatform
Three ransomware models work together within Hunt. Deterministic matching recognizes reverse-engineered ransomware families. The zero-day ransomware model detects known and unfamiliar variants, including those without a known-family match. Temporal analysis compares successive copies to detect gradual encryption. These are distinct from the five built-in hunts: Zero-Day Ransomware Detection, Encryption Detection, Malware Signature Detection, File System Verification, and Data Classification. Performance figures and their benchmark definitions belong on How We Measure.
I
Immutable BackupIndustry Context
A copy protected from alteration or deletion for a defined retention period. Immutability does not establish whether the contents were already infected when the copy was created. Hunt analyzes the contents for ransomware, malware, and damage to support clean recovery decisions.
Indicator of Compromise (IOC)Industry Context
Observable evidence that a system or dataset has been compromised, such as known malicious file hashes, suspicious registry entries, or ransomware artifacts found within backup snapshots. Custom Hunts run customer-defined and Elastio-managed IOC rules via SQL, YARA, and regex against the full data estate continuously. When a new indicator emerges, Hunt re-hunts what you already stored and reports whether you are affected anywhere.
Inference ThresholdMetrics
A term used in earlier Elastio material to contrast indirect signals with analysis of file contents. It is not a standardized accuracy threshold. Detection claims should identify the method, corpus, and measurement definition. Hunt combines several methods; comparison across copies and encryption analysis are part of that approach.
L
Last Known CleanMetrics
The most recent recovery point with analysis evidence supporting a clean result. It can be older than the latest backup. Review which checks completed and when; a Hunt-only clean result must not be presented as paired Pursuit and Hunt evidence.
Live DataData Surfaces
The first data surface. Production workloads, cloud storage, and file services in their current running state. Examples: EC2 instances, S3 buckets, Azure Blob Storage, EFS, FSx ONTAP, NAS volumes. Elastio hunts live data without agents and without impacting production performance.
M
Malicious PersistenceDetection
What an attacker leaves behind so the compromise survives a reboot: registry Run keys, scheduled tasks, WMI subscriptions, and services. Pursuit reports malicious persistence from off-host analysis of VM boot drives, snapshots, and machine images, and every finding is traceable to the artifact it was found in: file path, registry key, hash.
N
NYDFS Cybersecurity RegulationIndustry Context
New York Department of Financial Services regulation (23 NYCRR 500) requiring financial services companies to maintain cybersecurity programs including regular testing of incident response and recovery plans. Elastio’s attestation output provides timestamped, evidence-backed records of recovery point integrity for NYDFS compliance reporting.
P
Point-in-Time RecoveryIndustry Context
The ability to restore data to a specific moment in time. Effective point-in-time recovery requires knowing which recovery points are clean. Hunt identifies the Last Known Clean and the clean boundary per asset, so recovery targets the most recent proven-clean state rather than the most recent copy.
Private CloudArchitecture
The customer-hosted deployment mode for the Elastio Console. The entire Elastio platform, including the Console, runs inside the customer’s own cloud account. Used for environments with data residency requirements, regulatory constraints, or network isolation policies that prohibit SaaS connectivity. All platform components remain under the customer’s direct control.
Provable RecoveryPlatform
Recovery supported by evidence for the selected copy and the applicable recovery requirements. A copy is proven clean when Pursuit finds no attack in the system and Hunt finds no ransomware in the data. The evidence identifies the copy, analysis scope, completion, and time. Readiness also considers clean-copy age, backup coverage, and required protections such as immutability and isolation. Customer tooling performs the restore, and the team validates recovered applications.
Proven DataPlatform
Data whose analysis results are recorded for a defined source, scope, and time. Hunt records findings or a clean result, together with analysis completion, to support recovery decisions. A Hunt-only clean result does not establish the absence of attacker persistence in the system; Pursuit supplies that investigation.
R
R-RPOMetrics
The age of the latest recovery point proven clean under the required analysis. R-RPO makes clean-copy age an evidence-backed recovery control: a recent backup does not meet the target if it contains a threat. R-RPO is distinct from RPO, the tolerated data-loss window, and RTO, the time allowed to restore service.
Ransomware SecuritySecurity Control
The category Elastio operates in: detecting the attack already inside your systems, and proving which recovery points are clean. Recovery is proven continuously rather than tested periodically or assumed. It requires analysis inside the file, coverage across all three data surfaces, and evidence behind every recovery decision. Elastio delivers it with two products, Pursuit and Hunt.
Recovery IntelligencePlatform
Evidence that helps security and recovery teams decide which copy to trust. Hunt provides findings, analysis scope and completion, timestamps, and recovery history across data and its copies. Teams use this evidence to identify clean points, assess their age, and select a recovery source. Recovery intelligence supports the decision; provable recovery also requires system-compromise checks and the applicable recovery requirements.
Recovery Point Objective (RPO)Industry Context
The maximum acceptable data-loss window following a disruption. R-RPO measures the age of the latest recovery point proven clean under the required analysis. Comparing that age with the recovery target shows whether the clean copy is recent enough.
Recovery Time Objective (RTO)Industry Context
The maximum acceptable downtime before systems must be restored after an incident. Knowing which recovery points are clean before an incident eliminates discovery work during a ransomware response, directly reducing RTO. Continuous coverage means the Last Known Clean is already known when the incident starts, not determined during it.
Replicated DataData Surfaces
The second data surface. Snapshots, versioned objects, and disaster recovery copies that exist as replicas of live data. Examples: EBS snapshots, AMIs, S3 versioning, Azure snapshots, DRS. These are not backups. They are point-in-time copies managed by cloud infrastructure.
S
SaaSArchitecture
The Elastio-hosted deployment mode for the Elastio Console. Zero infrastructure to provision or manage. The Console, dashboards, policy management, and findings storage are operated by Elastio. Hunt and all connectors remain inside the customer’s cloud environment. No customer data is transmitted to Elastio infrastructure.
SEC Cybersecurity Disclosure RulesIndustry Context
U.S. Securities and Exchange Commission rules requiring public companies to disclose material cybersecurity incidents and describe their risk management processes. Elastio’s audit trail and attestation output provide the evidence layer for SEC disclosure: timestamped findings, clean boundaries, and recovery decisions logged with full context.
T
Three-Surface CoverageData Surfaces
The requirement that detection reaches all three data surfaces: live data, replicated data, and backup data. A solution that operates on one surface leaves the other two unanalyzed. This is the architectural gap Elastio closes.
No terms match that search.