What is canonical understanding?
Canonical understanding is the shared, explainable security picture built from normalized observations and correlated stories—what teams defend in daily decisions.
What is canonical understanding?
Short answer
Canonical understanding is the shared, explainable security picture an organization can defend when prioritizing, investigating, and communicating risk—built from normalized observations, correlated stories, relationship context, and stated confidence where linkage is uncertain.
Explanation
Canonical data provides normalized records. Canonical understanding is the meaning analysts and managers act on: which entities are involved, which observations belong to the same story, and why that story matters now.
Normalization without correlation yields consistent fragments. Correlation without shared entity semantics yields unstable stories. Canonical understanding requires both—plus accountable judgment.
Term authority: Canonical Understanding (KID-GLS-0038).
Guide: Canonical Understanding (KID-CON-0123).