system behavior
163585·updated Sep 1, 2026The observable and operational characteristics of a computing system — encompassing its processes, configurations, resource usage, and responses to inputs — that collectively define how it functions at runtime. In security and compliance contexts, it is used as a reference baseline: controls are designed to preserve expected system behavior (e.g., by restricting commands that could alter it) or to detect when behavior deviates from that baseline, which may indicate compromise, misconfiguration, or unauthorized privileged action. Authority documents treat nominal or "typical" system behavior as a well-defined pool from which execution profiles are drawn, against which anomalous activity is measured. Frameworks such as CIS Benchmarks use the phrase directly, noting that hardening configurations "can significantly alter system behavior," and post-compromise threat models describe attackers modifying kernel parameters or device interfaces to alter system behavior in ways that are difficult to distinguish from legitimate administration.
Source
such as executing commands that could modify system behavior. Restrictingthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: compositional.
- Method of and system for detecting an anomalous operation of a computer system
- Scripting Endpoint Hardening for MSPs: CIS Benchmarks via PowerShell | NinjaOne
- OAMAC: Origin-Aware Mandatory Access Control for Practical Post-Compromise Attack Surface Reduction
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
The aggregate observable and operational conduct of a computing system — encompassing how it executes processes, enforces access decisions, handles data, and responds to inputs under both normal and adversarial conditions. It is distinguished from individual component states or user actions by treating the system as a whole actor whose runtime conduct (commands executed, privileges exercised, data flows produced) can be authorized, constrained, monitored, or subverted. Security engineering uses it as the object of protection: the goal is to sustain intended and authorized system behavior despite adversity. In practice, controls such as least privilege, configuration management, and access enforcement are applied precisely to bound what the system is permitted to do — ensuring that processes operate at privilege levels no higher than necessary and access systems only as required to accomplish organizational missions. Restricting commands that could *modify* system behavior is therefore a canonical control objective, because unauthorized change to that conduct is itself the threat.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- system behaviors
- possessive
- system behavior's
- pluralpossessive
- system behaviors'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- The observable and operational characteristics of a computing system — encompassing its processes, configurations, resource usage, and responses to inputs — that collectively define how it functions at runtime. In security and compliance contexts, it is used as a reference baseline: controls are designed to preserve expected system behavior (e.g., by restricting commands that could alter it) or to detect when behavior deviates from that baseline, which may indicate compromise, misconfiguration, or unauthorized privileged action. Authority documents treat nominal or "typical" system behavior as a well-defined pool from which execution profiles are drawn, against which anomalous activity is measured. Frameworks such as CIS Benchmarks use the phrase directly, noting that hardening configurations "can significantly alter system behavior," and post-compromise threat models describe attackers modifying kernel parameters or device interfaces to alter system behavior in ways that are difficult to distinguish from legitimate administration.DR-088 backfill from the noun definition column