Terminology Index

Glossary

2953 terms

Linked Cases

Connecting related investigation cases so analysts can see that separate alerts or incidents are part of the same activity, revealing broader patterns and the true scope of an attack that isolated cases would hide.

Linked cases tie together investigations that share indicators, assets, accounts, or timing, so what looked like separate, minor alerts are recognized as one coordinated campaign or a larger incident. Linking helps analysts see the bigger picture, avoid duplicated effort, and scope an attack accurately, and it preserves the connections for review and intelligence. It is a case-management practice that turns fragmented signals into a coherent understanding of related activity.

Introduced in: SOC Analyst Fundamentals

Examples

Linking separate alerts that share an indicator into one case view.
Recognizing several incidents as one campaign by connecting cases.
Avoiding duplicated work by tying related investigations together.

Caserelates_to Case Lifecyclerelates_to Cross-Source Correlationrelates_to Indicator Pivotingrelates_to Investigation Expansionrelates_to Network Evidencerelates_to Preparationrelates_to Learning Sharingrelates_to

Linkerd

A lightweight service mesh for Kubernetes that secures and manages communication between microservices, providing automatic mutual TLS and observability with a focus on simplicity and low overhead.

Linux Capabilities

A Linux feature that breaks root's all-or-nothing power into discrete privileges (capabilities) that can be granted individually, so a process can be given just the specific elevated rights it needs instead of full root.

Litigation Hold

A litigation hold is a counsel-directed process that preserves information within a defined scope when a legal preservation duty has arisen.

Living off the Land

Using built-in tools or normal system features to perform malicious actions.

Living-off-the-Land Hunting

Living-off-the-land hunting examines legitimate interpreters, utilities, services, and administration mechanisms used in suspicious context or behavior chains.

Local Admin Restriction

Limiting which users have local administrator rights on endpoints, removing unnecessary admin access so a compromised user account or malware cannot easily gain full control of the machine. A high-impact hardening measure.

Local Administrator Password Solution

A Microsoft solution (LAPS) that automatically sets a unique, random local administrator password on each Windows machine and stores it securely, preventing the widespread risk of shared or identical local admin passwords.

LocalService

A built-in low-privilege Windows service account used to run services that need minimal local rights and limited network access. Defenders recognize it as a normal low-privilege context, and abnormal behavior from it as suspicious.

Log Gaps

Missing or incomplete logging that leaves activity unrecorded, creating blind spots where attacks can occur undetected and investigations hit dead ends. Identifying and closing log gaps is essential to detection and visibility.

Log Integrity

Ensuring logs cannot be secretly altered or deleted, so they remain trustworthy for detection, investigation, and evidence. Attackers often try to tamper with logs to hide activity, making integrity protection important.

Log Integrity Evidence

Records and controls supporting a claim that logs were not altered or removed without authorization or detection.

Log Management Platforms

Systems that collect, store, index, and make logs searchable from across an environment, the backbone for centralizing telemetry so it can be used for detection, investigation, and compliance.

Log Retention

How long logs are kept before deletion, set to balance investigative and compliance needs against storage cost. Too short and evidence of slow or past attacks is lost; too long and costs and risk grow.

Log Retention Decision

A documented period and disposal rule based on investigation, recovery, legal, contractual, sensitivity, and cost requirements for a log source.

Log Schema Discovery

Log schema discovery samples real events and authoritative field documentation to confirm which fields, types, values, and null behaviors are available before a query is written.

Log Source Gaps

Specific log sources that are missing from a SIEM, systems or data feeds not being collected, leaving detection and hunting blind to activity there. Identifying them is key to knowing the limits of visibility.

Log Source Taxonomy

A structured classification of the log sources available in an environment, organizing them by type, system, and the visibility they provide, so analysts know what data exists and which source answers a given question.

Log Transport Integrity

Controls that authenticate and protect telemetry during transfer and reduce undetected alteration or source impersonation.

Logging Disabled

A cloud misconfiguration where audit or activity logging is turned off, leaving actions unrecorded so attacks and changes go undetected and uninvestigable. It is a serious gap attackers exploit and assessments flag.

Logging and Monitoring (Web)

Collection and review of web security events such as authentication, session, authorization, input rejection, administrative change, and sensitive operations with privacy-safe context.

The web form where users submit credentials to authenticate, a critical security surface, since it is a prime target for attacks like credential stuffing, brute forcing, and phishing, and must be hardened accordingly.

Logs

Records of events generated by systems, applications, and devices, the raw material of monitoring, detection, and investigation. Collecting, centralizing, and analyzing logs is foundational to security visibility.

Long Tail Analysis

An analytic technique that focuses on the rare, infrequent items in a dataset, the 'long tail', on the principle that uncommon activity is more likely to be malicious than the common bulk. Used in hunting and log analysis.

Long-Term Containment

Containment measures meant to hold during the extended period between initial response and full eradication, keeping an attacker constrained and the environment stable while investigation and remediation proceed.

Lookup Tables

Reference data sets used in SIEM queries to enrich or filter events, such as lists of known-good assets, threat indicators, or business context, so detections and investigations can match events against known values.

Loss Event Frequency

In FAIR risk quantification, how often a loss event is expected to occur in a given period, one of the two top-level factors (with loss magnitude) that combine to estimate risk.

Loss Event Frequency (LEF)

Loss Event Frequency is the probable frequency, within a stated timeframe, that a threat agent's action harms an asset in the way defined by the scenario.

Loss Magnitude

In FAIR risk quantification, the size of the loss when a loss event occurs, one of the two top-level factors (with loss event frequency) that combine to estimate risk, covering both primary and secondary losses.

Loss Magnitude (LM)

Loss Magnitude is the probable amount of loss resulting from the scoped loss event.

Loss Magnitude Estimation

The process of quantifying how large a loss would be in a FAIR analysis, estimating primary and secondary loss components with calibrated ranges, so the magnitude side of risk is grounded rather than guessed.

MAC

A message authentication code: a keyed tag that lets holders of the shared key verify message integrity and origin within that trust group; it is not a hardware address in this context.