system behavior

The observable and operational characteristics of a computing system — encompassing its processes, configurations, resource usage, and responses to inputs — that collectively define how it functions at runtime. In security and compliance contexts, it is used as a reference baseline: controls are designed to preserve expected system behavior (e.g., by restricting commands that could alter it) or to detect when behavior deviates from that baseline, which may indicate compromise, misconfiguration, or unauthorized privileged action. Authority documents treat nominal or "typical" system behavior as a well-defined pool from which execution profiles are drawn, against which anomalous activity is measured. Frameworks such as CIS Benchmarks use the phrase directly, noting that hardening configurations "can significantly alter system behavior," and post-compromise threat models describe attackers modifying kernel parameters or device interfaces to alter system behavior in ways that are difficult to distinguish from legitimate administration.