Appendix C. Glossary
This guide describes Lawliet 1.5.13.s (the current release). Screens, commands and procedures may change in later versions; the usage guide is updated with each release. Check the version your server runs under Settings > Platform or with ./lawliet version, and see the Releases page for what changed.
The words this guide and the console use, in alphabetical order. A term in bold inside an explanation has its own entry.
| Term | Meaning | More |
|---|---|---|
| Accept risk | Close a review item as a real problem you decided to live with. Needs a justification and is recorded with your name | 21 |
| Accept into baseline | Make a file's new state the approved state for FIM, so later verifications compare against it | 33.4 |
| Active defense | Operator-dispatched containment on a host: isolate, block, kill, quarantine, disable an account, reset credentials | 36 |
| Agent | The Lawliet program on a monitored host (Linux, Windows, macOS). It reports to the server and carries out signed instructions | 10 |
| Agent token | The secret each agent gets at enrolment and uses on every request. Not the enrolment secret | 16.5 |
| Air-gapped | A site with no internet connection. Lawliet installs, updates and licenses without one | 1.5 |
| Alert | What a detection rule raises when its condition is met. Worked through its review item | 31.3 |
| API key | A service-account key (lwk_...) for scripts. Governed by its scope, not by a role | 15.7 |
| Approval, approver | The second signature on a critical action, and the person who gives it | 15.6 |
| Artifact (forensics) | A piece of evidence in a case: a collected file, a triage package, a memory capture, collector output, an upload. Hashed on the host and verified on arrival | 34.4 |
| Asset profile | What a host is for: criticality, environment, owner, exposure, business processes. Drives risk scores | 38.1 |
| ATT&CK | The MITRE ATT&CK catalogue of attacker techniques. Rules and alerts are tagged with technique ids such as T1110 | 31.6 |
| Attestation | A person's recorded statement about a control a script cannot check, with a justification and an expiry. Reported apart from measured results | 25.1 |
| Audit trail | The tamper-evident record of who did what and when. Never edited or removed | 15.8 |
| Auto-contain | A honeypot setting that blocks the source address on the first trip without a second signature | 35.5 |
| Baseline (FIM) | The approved state of the watched files on a host: hashes, sizes, owners, permissions | 33.3 |
| Baseline (firewall) | The firewall version marked as approved. Later reads that differ show "drifted from baseline" | 29.7 |
| Break-glass | An emergency way back into a host after a lock-out-risky control, issued as a recovery artifact | 26.5 |
| Build id | A 16-character id naming exactly one build. Quote it to support; ./lawliet status shows it | 3.3 |
| Bundle | The release archive lawliet-docker-<version>-<customer>.tar.gz. Unpacked, it is the installation directory | 2.3 |
| Canary token | A decoy URL, DNS name or document that raises a trip when used | 35.1 |
| Case | A forensic investigation: its hosts, evidence, timeline, hunts and response actions | 34 |
| CEF, LEEF | Event formats many SIEMs read. Lawliet forwards in CEF, LEEF 2.0, RFC 5424 syslog or JSON | 39.7 |
| Chain of custody | The record of every access to a piece of evidence: who, when, what | 34.4 |
| Collection (AD) | A snapshot of a domain's objects and permissions, read over LDAPS, that the AD assessment analyses | 14.5 |
| Containment | An action that limits a suspect host, process, address, file or account. See active defense | 36 |
| Critical action | An action that needs a second signature while dual control is on | B.3 |
| Decoy | A honeypot: a bait file, fake service, fake login, canary or decoy account | 35 |
| Delta | A smaller update with only what changed since the installed build | 4.7 |
| Detection rule | A standing query over the collected logs that raises alerts | 31 |
| Directory sign-in | Console sign-in with Active Directory accounts over LDAPS, with groups mapped to roles | 14.2 |
| Discovery (DLP) | A scan for sensitive data at rest on a host | 32.4 |
| Discovery (network) | Probing an address range from the server to find hosts and services | 28.3 |
| DLP | Data loss prevention: finding sensitive data and watching it leave | 32 |
| Drift (compliance) | What changed between two scans of the same framework: regressions, new failures, improvements | 23.2 |
| Drill | A harmless test that proves a module works on a host (proof of protection) | 20.7 |
| Dry run | A preview that shows what would happen and changes nothing (hardening, network scans, playbooks) | 37.3 |
| Dual control | Same as four-eyes | 1.3 |
| Enrolment code | A one-purpose code inside an offline package that lets up to N hosts enrol until it expires | 16.6 |
| Enrolment secret | The shared secret agents present once to register. ./lawliet token --rotate replaces it | 16.6 |
.env | The configuration file in the installation directory: secrets, addresses, settings. Mode 600 | 3.23 |
| Evidence bundle | An audit-ready export of everything held for a scope (scan, host, case, period, module), as JSON or HTML | 27 |
| Exception | A control that is not met, taken out of scoring for a fixed period with a compensating control, approved by a second person | 25.2 |
| Execute now | The requester's final step after a critical action is approved | 15.6 |
| FIM | File integrity monitoring: watching files and registry keys for change against a baseline | 33 |
| Fingerprint (DLP) | A sample document whose edited copies a DLP policy can find | 32.3 |
| Fingerprint (installation) | The id that binds a licence to one installation. Shown by ./lawliet licence | 2.10 |
| Fix plan | The list of failed controls hardening can fix on one host, ranked by effect on the score | 22.4 |
| Four-eyes | A second person signs a critical action before it runs | 1.3 |
| Framework | A set of compliance controls, for example a CIS benchmark | 22 |
| GPO | A Group Policy object in Active Directory, used to roll out the Windows agent | 12.4 |
| Hardening | Changing a host's configuration so failed controls pass. Held for approval; reversible steps can be rolled back | 26 |
| Heartbeat | An agent's regular check-in. An agent with no recent heartbeat is offline | 10.3 |
| Heatmap | The control-by-scan grid of compliance results | 24.1 |
| Honeypot | See decoy | 35 |
| Hunt (IOC hunt) | A sweep of hosts for known indicators and YARA rules | 34.6 |
| Installation directory | The directory you run ./lawliet from, for example /opt/lawliet-1.5.13.s | 1.6 |
| IOC | Indicator of compromise: a hash, file name, path, address, domain, process or registry key that marks an attack | 34.6 |
| Isolate | Cut a host off the network except for its route to Lawliet | 36.2 |
| Kerberos | The Windows domain authentication protocol, used for remote deployment and Windows sign-in | 13.4, 14.4 |
| Keytab | The file holding the console's Kerberos service key, for Windows sign-in | 14.4 |
.lawliet.conf | The deployment choices ./lawliet records (mode, address, TLS state, rollback record). No secrets | 3.23 |
| Licence | The signed key that says which modules and how many agents this installation may use, bound to its fingerprint | 1.4 |
| LSO, RSO | Left and right security officer: two administrator roles whose critical actions are approved by each other | B.1 |
| Not assessed | A control with no usable answer in a scan. It counts against the score | 22.1 |
| Offline package | An agent installer with the server address, certificate and an enrolment code inside, for hosts with no route to the server at install time | 11.3 |
| Playbook | An automatic response to an alert, DLP incident or hunt hit. Containment steps still need a signature | 37 |
| Proof of protection | Per host and module, when protection was last shown to work by a drill | 20.7 |
| Recovery artifact | A one-time secret (SSH key, break-glass account, disk key, firewall rollback) issued before a lock-out-risky hardening control | 26.5 |
| Recovery codes | Ten one-time codes for signing in without the authenticator app | 15.1 |
| Recovery key | The installation-wide key that authorises removing any protected agent | 16.4 |
| Review queue | The shared work list every module feeds | 21 |
| Rollback (hardening) | Reversing the steps of a hardening run that have a rollback script | 26.3 |
| Rollback (platform) | Returning the server to the version before the last update, database included | 4.6 |
| Rollback window (firewall) | How long an armed restore waits on the device before it undoes an apply that was not confirmed | 29.6 |
| Sandbox data | A synthetic demonstration dataset, flagged and kept apart from real data | 39.9 |
| Scan (compliance) | A read-only check of hosts against one framework's controls | 22 |
| Schedule | A recurring compliance scan, discovery scan or report | 23.1 |
| Self-protection | Agent setting that stops local users, even administrators, removing or stopping the agent without a code | 16.2 |
| Shadowed rule | A firewall rule that never applies because an earlier rule matches all its traffic and decides differently | 29.4 |
| SIEM | Security information and event management. Lawliet both collects logs (Logs) and forwards events to your own SIEM | 30, 39.7 |
| Sigma | A shared format for detection rules. Lawliet translates Sigma rules into its own query language | 31.4 |
| Source (logs) | A sender of logs: an agent, a syslog sender or an HTTP shipper | 30.5 |
| Story | One host's signals from several modules on one timeline | 38.2 |
| Super-timeline | A case's events from every collection, in time order | 34.5 |
| Suppress | Close a review item as noise (justification required), or silence a detection alert's subject for a period | 21, 31.3 |
| TLS repair | ./lawliet tls repair: re-issue the self-signed certificate to cover the server's addresses, handing it to agents first | 6.5 |
| Trip | An interaction with a decoy. Always an alert | 35.4 |
| TRUSTED_HOSTS | The .env list of names and addresses the server answers to | 8.9 |
| Uninstall code | A one-hour code, bound to one host, that authorises removing a protected agent | 16.3 |
| Verify (FIM) | Re-hash the watched files on a host and report every difference from the baseline | 33.3 |
| WinRM | Windows Remote Management, used by remote deployment: HTTPS on 5986 (recommended) or plain HTTP on 5985 (insecure) | 12.8 |
| YARA | A rule language for matching file contents, used in hunts | 34.6 |