Glossary

Legal Communication

Communicating with and through legal counsel during an incident, ensuring legally sensitive matters, disclosure, evidence, liability, are handled with legal guidance and sometimes under privilege, so the response is legally sound.

Legal and HR Coordination

Working with legal and human-resources teams when writing policies, so policies are enforceable, compliant with law and employment rules, and aligned with how the organization handles people-related matters.

Lessons Learned

A review after an incident that identifies improvements to people, process, and technology.

Lessons from Practice

Insights drawn from real-world security operations experience, what actually works, common pitfalls, and hard-won judgment, that complement theory by grounding blue-team skills in how things play out in practice.

Let's Encrypt

A free, automated certificate authority that issues TLS certificates at no cost, making HTTPS easy and ubiquitous. Its automation (via the ACME protocol) lets sites obtain and renew certificates without manual effort.

Likelihood

How probable it is that a threat will affect a system or asset.

Likelihood Estimation

Judging how probable it is that a risk will occur, a core part of risk assessment that, paired with impact, determines a risk's level so it can be prioritized and treated appropriately.

Linked Cases

Connecting related investigation cases so analysts can see that separate alerts or incidents are part of the same activity, revealing broader patterns and the true scope of an attack that isolated cases would hide.

Linkerd

A lightweight service mesh for Kubernetes that secures and manages communication between microservices, providing automatic mutual TLS and observability with a focus on simplicity and low overhead.

Linux Capabilities

A Linux feature that breaks root's all-or-nothing power into discrete privileges (capabilities) that can be granted individually, so a process can be given just the specific elevated rights it needs instead of full root.

Living off the Land

Using built-in tools or normal system features to perform malicious actions.

Local Admin Restriction

Limiting which users have local administrator rights on endpoints, removing unnecessary admin access so a compromised user account or malware cannot easily gain full control of the machine. A high-impact hardening measure.

Local Administrator Password Solution

A Microsoft solution (LAPS) that automatically sets a unique, random local administrator password on each Windows machine and stores it securely, preventing the widespread risk of shared or identical local admin passwords.

LocalService

A built-in low-privilege Windows service account used to run services that need minimal local rights and limited network access. Defenders recognize it as a normal low-privilege context, and abnormal behavior from it as suspicious.

Log Gaps

Missing or incomplete logging that leaves activity unrecorded, creating blind spots where attacks can occur undetected and investigations hit dead ends. Identifying and closing log gaps is essential to detection and visibility.

Log Integrity

Ensuring logs cannot be secretly altered or deleted, so they remain trustworthy for detection, investigation, and evidence. Attackers often try to tamper with logs to hide activity, making integrity protection important.

Log Management Platforms

Systems that collect, store, index, and make logs searchable from across an environment, the backbone for centralizing telemetry so it can be used for detection, investigation, and compliance.

Log Retention

How long logs are kept before deletion, set to balance investigative and compliance needs against storage cost. Too short and evidence of slow or past attacks is lost; too long and costs and risk grow.

Log Source Gaps

Specific log sources that are missing from a SIEM, systems or data feeds not being collected, leaving detection and hunting blind to activity there. Identifying them is key to knowing the limits of visibility.

Log Source Taxonomy

A structured classification of the log sources available in an environment, organizing them by type, system, and the visibility they provide, so analysts know what data exists and which source answers a given question.

Logging Disabled

A cloud misconfiguration where audit or activity logging is turned off, leaving actions unrecorded so attacks and changes go undetected and uninvestigable. It is a serious gap attackers exploit and assessments flag.

Login Form

The web form where users submit credentials to authenticate, a critical security surface, since it is a prime target for attacks like credential stuffing, brute forcing, and phishing, and must be hardened accordingly.

Logs

Records of events generated by systems, applications, and devices, the raw material of monitoring, detection, and investigation. Collecting, centralizing, and analyzing logs is foundational to security visibility.

Long Tail Analysis

An analytic technique that focuses on the rare, infrequent items in a dataset, the 'long tail', on the principle that uncommon activity is more likely to be malicious than the common bulk. Used in hunting and log analysis.

Long-Term Containment

Containment measures meant to hold during the extended period between initial response and full eradication, keeping an attacker constrained and the environment stable while investigation and remediation proceed.

Lookup Tables

Reference data sets used in SIEM queries to enrich or filter events, such as lists of known-good assets, threat indicators, or business context, so detections and investigations can match events against known values.

Loss Event Frequency

In FAIR risk quantification, how often a loss event is expected to occur in a given period, one of the two top-level factors (with loss magnitude) that combine to estimate risk.

Loss Magnitude

In FAIR risk quantification, the size of the loss when a loss event occurs, one of the two top-level factors (with loss event frequency) that combine to estimate risk, covering both primary and secondary losses.

Loss Magnitude Estimation

The process of quantifying how large a loss would be in a FAIR analysis, estimating primary and secondary loss components with calibrated ranges, so the magnitude side of risk is grounded rather than guessed.

MAC Addresses

Hardware addresses assigned to network interfaces that identify devices on a local network segment, used for delivery at the data-link layer. They are local in scope, unlike IP addresses, which route across networks.

MD5

An older cryptographic hash function (128-bit) once widely used but now broken for security: collisions can be created practically, so MD5 must not be used for integrity guarantees or signatures, though it still appears as a non-security checksum.