Glossary

Terms marked 0.8.0 exist only in 0.8.0.

Async observation. A record of an io_uring or AIO request, which the kernel carries out apart from the system call that submitted it. See Async observations.

Attach to process. Tracing a process that is already running in the guest, and its future children, without stopping or signalling it. See What gets traced.

Base. A read-only template a VM is created from: a guest kernel, a root filesystem and a record of the guest revision. Antinomie offers BusyBox, Debian 13 Minimal and a Debian 13 desktop. See Bases and the container builder.

Boot. One start of a VM, from Start to Stop. Each boot has its own recording, holding its runs and captures. See VMs, bases, boots, runs and captures.

bubblewrap. The sandbox (bwrap) Antinomie runs its analysis workers and TShark in, with no network and only their input visible. See How Antinomie works.

Capture all. Tracing all of userspace in the guest instead of one program.

Capture status. How completely the recorder obtained a captured value, such as COMPLETE, NOT_RESIDENT or COPY_FAULT. See Capture statuses.

Cloud VPS profile 0.8.0. A stealth profile that makes the VM an instance of a cloud provider, with a fake metadata service and canary credentials. See Cloud VPS profiles.

Container builder 0.8.0. Building a base in a pinned Debian 13 container with Podman or Docker. See Bases and the container builder.

Core (process core). A dump of one guest process’s memory and registers, taken on exit or on demand. See Memory and core dumps.

Custody log 0.8.0. A per-sample log of everything done to or by a sample, each entry chained to the one before by SHA-256, so a change is found. Its last hash is the head hash. See Custody log.

Defang. Rewriting indicators so they cannot be clicked, such as hxxp://example[.]com. Reports defang HTML and PDF only, when you ask.

Digest 0.8.0. A small summary Triage keeps beside a finished run (highest tier, rules, techniques, indicators), which the sample window adds up.

Disk dump. A standalone sparse copy of a VM’s filesystem made in the Disks tab. See Disks.

Drop new telemetry. The transport mode in which the guest never waits for the host and counts what did not fit. See Telemetry transport settings.

Earlier bytes (before-image) 0.8.0. The content a file had when the run started, read from the disk the boot started from and kept in the recording. See File Reconstruction.

Evidence bundle 0.8.0. The .zip an export can write next to a report: packet captures, dropped files in an inner AES-256 zip (password infected), the custody record and a manifest. See Report export.

Finding. A row of Suspicious activity: behaviour a rule recognised, with a tier, a category and an ATT&CK reference. A finding is a lead, not a verdict. See Rules.

Full pack. An archive of every managed analysis tool that you build on a connected computer for an offline one. See Command line.

Guest. The system inside the VM, where the sample runs.

Guest revision (contract revision). The version of what a base’s kernel offers the host: 17 for 0.7.x, 18 for 0.8.0. See Compatibility.

Host. Your computer, which runs QEMU and the Antinomie app.

InetSim route. A route on which every name resolves to a fake address and every connection reaches a fake service; nothing leaves the computer.

Isolated, Routed, NAT, Disconnected. The four network modes of a VM. See Network isolation.

Library. The sidebar section with Base images, Detection rules, Analysis tools and, in 0.8.0, Samples. See Library.

Lineage 0.8.0. The graph of where a sample came from and what it dropped, downloaded or ran, across its runs.

Never drop. The default transport mode, in which a system call waits for room up to a deadline rather than lose its record.

Object store. The packed files (objects/) in which a run keeps the bytes it captured, read back by Triage and the Syscall Trace. See Data folders and run layout.

Recording. Everything saved from one boot: runs, captures, terminal output and the evidence beside them. A run can be reopened from it at any time.

Recording quota. The most one boot may save, 4 GiB by default. See Limits and quota.

Route. Where a Routed VM’s traffic goes for one run: None (drop), InetSim, Internet, Tor, VPN (WireGuard) or SOCKS5 proxy. See Network routes.

Run. One program launch and its descendants, recorded from start to end.

Sample 0.8.0. A file kept in the sample library, identified by its SHA-256 and stored as an encrypted archive. See The sample library.

Sigma event journal. The normalised events of a run that Sigma rules are matched against. See Sigma event journal.

Snapshot (checkpoint). A saved disk, or disk and memory, state of a VM to go back to. See Snapshots.

Stealth profile. The hardware identity a VM shows its guest: firmware strings, CPU, disk, network card, MAC address. See Stealth profile.

Tier. How strong a finding is: HIGH, MEDIUM, LOW or INFO. See Tiers and categories.

TRL, UIL, STL. The loss counters: transport, user interface and storage loss. See Loss counters.

Triage. The view that turns a run’s calls, records and packets into processes, files, network, detections and findings. See Triage.