Glossary

The terms and acronyms you will meet across the opentide docs, defined once. Where a concept has a deeper page, it is linked.

Objects and content

Object : A typed unit of detection content — a threat, objective, or rule — stored as YAML under objects/. Every object carries a metadata block. See Object model.

Threat (TVM — Threat Vector Model) : A description of what you defend against: an actor, technique, or attack surface, with impact and viability ratings. Schema identifier threat::1.0.

Objective (DOM — Detection Objective Model) : A detection goal and the signals that satisfy it. An objective references the threats it covers. Schema identifier objective::1.0.

Rule (MDR — Managed Detection Rule) : A deployable detection, carrying per-platform query configurations and a status. A rule references the objective it implements, or one signal under that objective, via detection_model. Schema identifier rule::1.0.

Signal : A discrete piece of evidence inside an objective (e.g. "suspicious logon"), with methodology, entities, and data requirements.

Chaining : The reference graph between objects. Rules point at objectives or their signals (detection_model); objectives point at threats (objective.threats). Coverage flows the opposite way: threats are covered by objectives, which are implemented by rules. See Object model.

Coverage : What detection exists for a given threat or ATT&CK technique, derived by walking the chaining graph. Reported by opentide info and generate docs.

Versioning and schema

Schema revision (metadata.schema) : The structural revision an object conforms to, e.g. rule::1.0. Selects the validation model and generated JSON Schema. See Schema revision.

Instance version (metadata.version) : The business/semantic version of a specific object's content. Git is the authoritative change history. Never used to pick a schema file.

UUID : The stable identifier for an object. Cross-object references use UUIDs, so renaming or moving files never breaks the graph.

Vocabulary : A canonical, controlled list of allowed values for a field (e.g. severities, ATT&CK techniques, TLP levels), published in the specifications and bundled with opentide.

Deployment and operations

Platform : A SIEM or EDR target opentide deploys to (e.g. Sentinel, Splunk, CrowdStrike). Some platforms also support query validation. See Platforms.

Status : A rule block's lifecycle label, e.g. DEVELOPMENT. The set is configuration (deployment.toml); each status maps to a strategy. The default statuses, STAGING and PRODUCTION included, are names like any other: only the strategy they map to matters.

Strategy : What deploy does with a rule in a given status: INERT, PREVIEW, RELEASE, UNIVERSAL, DISABLEMENT or DELETION. Fixed by the deployment spec. A run deploys --strategy PREVIEW or --strategy RELEASE, and a tenant's strategies say which runs reach it. See Statuses, strategies and tenants.

Staging : Deploying rules in a non-production state for verification before they go live.

Promotion : Advancing rules from a lower status to a higher one (typically STAGING → PRODUCTION), individually or in bulk via opentide deploy.

Run strategy (--strategy) : The strategy a deploy carries out: PREVIEW (the pull or merge request job) or RELEASE (the default-branch job, which also disables and deletes retired rules). It replaced deployment plans (--plan, DEPLOYMENT_PLAN), removed in 0.17.0. See Statuses, strategies and tenants.

Tenant strategies (strategies, manual) : The run strategies a tenant accepts, in its platform file; both when omitted. manual = true keeps a tenant to the rules that list it. They replaced the tenant deployment key.

Visibility : Configuration controlling which objects are exposed/deployed in a given context. Validated by a generated visibility schema.

Playbook-map : A mapping that associates detections with response playbooks. Produced by the legacy opentide export playbook-map command (not by the default opentide generate pipeline).

TLP (Traffic Light Protocol) : The sharing-sensitivity classification on metadata.tlp (e.g. clear, green, amber, red).

Tooling and automation

Generate : opentide generate — compile specs + objects into schemas, templates, the IDE router, and indexes. See generate.

Document : opentide generate docs — render human wiki pages from loaded objects. See generate docs.

Registry : The in-memory index of loaded objects and generated artifacts that the SDK exposes (Opentide.Rules, Opentide.Objectives, …). See SDK registry.

MCP (Model Context Protocol) : The protocol opentide's agent server speaks, exposing tools and resources to AI editors. See MCP.

SDK : The Python API (from opentide import Opentide) for embedding the engine in your own code. See SDK.

CoreTide : The predecessor to opentide, distributed via git submodules. Migrating from it? See the migration guide.