Glossary

Glossary of LinuxGuard terminology — agent, console, eBPF, enrollment, modules, compliance frameworks, and related security concepts.

This glossary defines key concepts used throughout LinuxGuard documentation.

Access Pattern

Recurring behavior profile for a user or service account. LinuxGuard establishes access pattern baselines over an observation period and surfaces deviations that may indicate compromised credentials or insider threat. See Identity Intelligence.

Active Response

Automated containment action executed by LinuxGuard when a playbook's trigger conditions are met. Active responses require triple opt-in (playbook enabled, scope confirmed, blast radius set) and produce an audited action history with automatic timeout-based rollback. See Active Response.

Attribution Confidence

Reliability level for process attribution showing how LinuxGuard identified the process behind a security event. HIGH confidence uses eBPF kernel-level tracing, MEDIUM uses /proc filesystem parsing, LOW uses fallback methods when primary sources unavailable. See Console Overview.

Authentication Event

A record of a login attempt (success or failure) with method, source IP, username, and timestamp. LinuxGuard collects authentication events from syslog, journald, and utmp/wtmp/btmp logs. See Console Overview.

Authentication Method

Login mechanism used for system access: password, publickey, keyboard-interactive, or GSSAPI. Captured during authentication event collection and displayed in the console. See Console Overview.

Baseline

Known-good reference state for a security-relevant object (account, group, SSH config, SSHD config, sudo defaults, sudo aliases, sudo rules). LinuxGuard captures baselines per server and surfaces deviations as drift events. The Baselines section of the console hosts the per-object-type baseline browsers and editing UI. See Baselines.

Behavioral Baseline

Statistical model of normal activity for a user or service account, learned over an observation period. LinuxGuard uses behavioral baselines to identify anomalous access that deviates from established norms. See Identity Intelligence.

Blast Radius

System-enforced limit on how many servers a playbook's containment action can affect in a single trigger event. Blast radius is configured as a hard cap during playbook setup and cannot be exceeded at runtime, even if more servers match the trigger condition. See Active Response.

Brute Force Detection

Automated detection of credential stuffing and targeted attack patterns in authentication events. LinuxGuard analyzes login attempts to identify suspicious patterns like many users from few IPs or one user from many IPs. See Console Overview.

CIS Benchmarks (Linux)

Distribution-specific configuration hardening guides published by the Center for Internet Security — Ubuntu, RHEL, SUSE, Alpine, and others — each versioned independently. Used as a configuration baseline reference and frequently cited in audit programs. Distinct from CIS Controls. See Audit & Comply.

CIS Controls v8.1

Prescriptive control set published by the Center for Internet Security (18 controls in v8 vs 20 in v7) covering defense-in-depth practices applicable across organization sizes. Distinct from CIS Benchmarks (which are distro-specific configuration guides). See Audit & Comply.

Compliance Score

Measure of adherence to security compliance frameworks with pass/fail/not-applicable check counts. LinuxGuard evaluates compliance at both fleet-wide and per-server levels against enabled frameworks. See Console Overview.

Config Drift

Unexpected changes to server configurations detected by comparing against baselines. Tracked across six component types: Accounts, Groups, Sudo, SSH, SSHD, and SSH Keys. See Console Overview.

Configuration File Write Detection

eBPF-based monitoring of writes to security-critical files including sudoers, sshd_config, passwd, shadow, and authorized_keys. This feature may not be visible until enabled by your LinuxGuard administrator. See Security Architecture.

Containment Action

Specific automated response step executed by a playbook: lock account, kill sessions, disable SSH key, or revoke sudo. Each containment action is reversible (except kill sessions) via automatic timeout rollback or manual console rollback. See Active Response.

Control Mapping

Documented relationship between an agent or console capability and a specific framework requirement. LinuxGuard publishes per-framework control mappings using the three-tier vocabulary (Satisfies / Supports / Out of scope), each with an evidence pointer and a version pin. See Audit & Comply.

Credential Stuffing

Brute force pattern where attacker tries many usernames from one or few source IPs. Indicates the attacker is testing credential lists against the system. See Console Overview.

Cron Job

Scheduled task defined in user or system crontab files, executed at specified intervals. LinuxGuard inventories cron jobs as part of NHI automation monitoring. See Console Overview.

DegradedNoEBPFArch

Agent status indicating the host architecture has no eBPF-based monitoring available. Always returned on ARMv7; may also occur on RISC-V, depending on build support for that platform. Behavioural detections requiring eBPF are unavailable in this status; auth-event, file-monitor (read-path), and config-drift collectors continue running. See Multi-Architecture Support.

Delivery Channel

Mechanism through which LinuxGuard sends alert notifications: webhook (HTTP POST to a custom endpoint), syslog (RFC 3164 or RFC 5424 UDP/TCP/TLS forwarding), or Splunk HEC (native Splunk HTTP Event Collector integration). Each notification rule specifies one delivery channel. See Alerting & SIEM Integration.

Detractor

Risk factor that increases a posture score, such as no password expiry, unencrypted SSH key, or weak authentication configuration. Detractors have configurable weights affecting overall score calculation. See Console Overview.

Distroless

Container image built without a shell, package manager, or general-purpose userland — only the binary, its runtime libraries, and minimum required CA certs/timezone data. The LinuxGuard distroless image (linuxguard/agent) ships only linuxguard-agent and linuxguard-init-shim. Reduces attack surface and image size; trade-off is no in-container debugging shell. See Distroless image reference.

DORA (Digital Operational Resilience Act)

EU Regulation (EU) 2022/2554, effective 2025-01-17. Direct-effect regulation applicable to EU financial entities (banks, insurance, investment, crypto-asset service providers) and their critical third-party ICT providers. No member-state transposition required. See Audit & Comply.

Downward API

Kubernetes mechanism that exposes Pod and Node metadata to a container through environment variables or volume-mounted files. LinuxGuard reads LINUXGUARD_NODE_NAME (Node name) and LINUXGUARD_POD_UID (Pod UID) via valueFrom.fieldRef to bind a containerised agent to its workload identity. See Downward API integration.

Drift

Difference between an object's current observed state and its baseline. LinuxGuard surfaces drift as events that progress from initial detection through investigation to resolution, each with field-level diffs. Tracked across accounts, groups, SSH config, SSHD config, sudo defaults, sudo aliases, sudo rules, and SSH keys. See Baselines.

eBPF Access Monitoring

Kernel-level tracing of file access to track file read/write activity with process attribution. LinuxGuard uses eBPF to capture file access events at the kernel layer without requiring kernel modules. See Security Architecture.

eBPF Probe

The kernel-level eBPF instrumentation LinuxGuard uses to observe system activity on a given architecture. LinuxGuard ships this instrumentation per supported architecture; on an architecture where it is not available (always on ARMv7; possibly on RISC-V), the agent falls back to DegradedNoEBPFArch and runs without that capability. See Multi-Architecture Support.

Ephemeral Mode

Containerised agent mode enabled by --ephemeral. Skips on-disk state persistence (TLS material lives in tmpfs at --tls-cache), re-enrols on every container start using a TOTP enrollment token, and exits cleanly on SIGTERM with code 143. Designed for short-lived workloads and immutable infrastructure where the agent must not write to the host filesystem. See Ephemeral mode.

Environment

Named server grouping (e.g., production, staging, development) assigned during enrollment using the --environment flag. Environments help organize servers and filter console views by deployment stage. See Agent Commands.

EU AI Act

EU Regulation (EU) 2024/1689, entered into force 2024-08-01. Direct-effect regulation laying down harmonised rules on artificial intelligence. Distinguishes four risk tiers (prohibited, high-risk, limited risk with transparency obligations, minimal risk) plus general-purpose AI models. Phased applicability: prohibited AI from 2025-02-02; GPAI obligations from 2025-08-02; high-risk AI under Annex III from 2026-08-02; high-risk AI embedded in regulated products under Annex I from 2027-08-02. LinuxGuard's per-framework mapping is scoped to host-layer record-keeping (Art 12) and cybersecurity (Art 15) requirements for customers operating high-risk AI systems on Linux infrastructure. See Audit & Comply.

Evidence Location

Canonical pointer set identifying where compliance evidence for a control is retrieved (agent log, support bundle, console Evidence tab, signals, drift events, SUDO execution audit, compliance history, compliance reports, bundle manifest). Per-framework mapping pages cite a row of the Evidence Location table rather than restating evidence pointers per page. See Compliance Expansion § Evidence Location.

Exfiltration Detection

Pattern recognition for data theft via local copy or network transfer. LinuxGuard analyzes file system events to identify potential data exfiltration activities. See Console Overview.

Factor Weight

Configurable importance assigned to individual detractors and mitigators in posture scoring. Administrators can adjust weights to match organizational priorities. See Console Overview.

FedRAMP

U.S. federal cloud-service authorization program operated by the GSA. LinuxGuard documents control mapping against FedRAMP Rev 5 baselines (May 2023). Cloud service providers serving federal agencies use FedRAMP to obtain an Authority to Operate (ATO). See Audit & Comply.

FFIEC CAT

Federal Financial Institutions Examination Council Cybersecurity Assessment Tool (2017), used by U.S. financial institutions and their regulators to evaluate cybersecurity preparedness. FFIEC IT Handbook booklets may also be referenced in audit programs. See Audit & Comply.

File Baseline

Known-good state of a file including hash, permissions, and ownership used to detect changes. LinuxGuard compares current file state against baselines to identify configuration drift. See Console Overview.

File Monitoring

Real-time tracking of file system changes (create, modify, delete, rename) and access events. Administrators configure which files and folders the agent monitors via console settings. See Console Overview.

Fleet Aggregation

Method for combining server scores into fleet-level scores. Configurable in posture scoring settings to match organizational risk tolerance. See Console Overview.

Framework Version Pin

Explicit version, effective date, and last-verified date attached to a per-framework compliance mapping page. Per-framework pages cite the corresponding row in the Audit & Comply hub framework version pin reference. A stale last_verified date blocks publication. See Audit & Comply.

GDPR

EU General Data Protection Regulation, Regulation (EU) 2016/679, effective 2018-05-25. Applies to controllers and processors handling personal data of EU residents. IP addresses are PII under EU case law, which is relevant to log shipping and SIEM forwarding decisions. See Audit & Comply.

GeoIP Enrichment

Agent-side IP geolocation identifying source country and region for authentication events. LinuxGuard enriches login events with geographic information to help identify suspicious access patterns. See Console Overview.

HIPAA

U.S. Health Insurance Portability and Accountability Act. LinuxGuard documents control mapping against HIPAA 45 CFR §164 (Privacy, Security, and Breach Notification Rules) — covered entities and business associates handling protected health information cite specific CFR sections rather than "HIPAA" generally. See Audit & Comply.

HITRUST CSF

HITRUST Common Security Framework, versioned annually (v11.x current as of 2026-05-31). Unified control framework commonly adopted by healthcare organizations consolidating HIPAA, NIST, ISO/IEC 27001, and other framework requirements into a single assessment program. Pin a specific minor version per audit period. See Audit & Comply.

Hub Page

Top-level index page for one of the nine IA groups (Get Started, Install, Configure, Operate, Deploy at Scale, Respond, Audit & Comply, Reference, Concepts). Each hub introduces the group, links to its child spoke pages (usually via a card grid), and serves as the landing page for the corresponding SUMMARY.md section. Hub pages do not contain task content; spokes do. See the IA framework decision record for the full hub catalogue.

IA Shell

The on-disk directory structure of the nine top-level IA groups plus their hub READMEs. The IA shell is created independently of page content so migrations and new authoring can target the final layout without race-conditioning the GitBook build. The v4.0 IA shell replaces the v3.0 Diataxis four-quadrant tree (tutorials/, how-to/, reference/, explanation/). See IA Framework.

Identity

Unified representation of a user or service account aggregated across all enrolled servers. LinuxGuard builds an identity by linking authentication events, SSH keys, sudo rules, and NHI automation entries from every server where the account appears. See Identity Intelligence.

ISO/IEC 27001:2022

Joint ISO/IEC standard for information security management systems. The 2022 revision restructured Annex A controls from 114 (in :2013) to 93 controls across four themes. Transition deadline for :2013-certified organizations is 2025-10-31. See Audit & Comply.

Lifecycle Phase

One of the nine canonical operational phases used to organise LinuxGuard documentation: Get Started, Install, Configure, Operate, Deploy at Scale, Respond, Audit & Comply, Reference, Concepts. A page lives in exactly one lifecycle phase based on when in the agent's lifecycle the reader needs it. See Lifecycle-First Hybrid.

Lifecycle-First Hybrid

Information architecture adopted in v4.0. Nine top-level groups arranged by the lifecycle phase the reader is in (Get Started → Install → Configure → Operate → Deploy at Scale → Respond → Audit & Comply → Reference → Concepts), plus three footer pages (Troubleshooting, Support, Changelog). Replaces the v3.0 Diataxis four-quadrant model (Tutorials, How-to Guides, Reference, Explanation). Optimises for "I'm in phase X, what do I need to do?" navigation. See IA framework decision record.

LoginUID

Original login user identity that survives sudo/su privilege escalation, preserving non-repudiation. LinuxGuard attributes actions to the actual user even when a process is running as root. See Security Architecture.

Mitigator

Positive factor that decreases a posture score, such as strong authentication or encrypted SSH keys. Mitigators have configurable weights reducing risk scores for servers with good security practices. See Console Overview.

Multi-Arch Manifest

OCI Image Index (also called a "fat manifest") that references one per-platform manifest under a single image tag. docker pull linuxguard/agent:latest from an amd64 host pulls the amd64 manifest; the same command on arm64 pulls the arm64 manifest. LinuxGuard publishes a multi-arch manifest covering amd64, arm64, armv7, riscv64, s390x, and ppc64le; eBPF availability per platform is documented separately in the per-capability matrix. See OCI multi-arch manifest.

NHI Automation

Non-Human Identity scheduled tasks (cron jobs, systemd timers) that run without direct user interaction. LinuxGuard inventories NHI automation to provide visibility into automated system activities. See Console Overview.

NIS2

EU Directive (EU) 2022/2555, effective 2024-10-17. Network and Information Security Directive (second iteration), applicable to essential and important entities operating in the EU. Member-state transposition varies — the specific transposing national law applies to each customer jurisdiction. See Audit & Comply.

NIST CSF 2.0

U.S. National Institute of Standards and Technology Cybersecurity Framework version 2.0, published 2024-02-26. Voluntary risk-management framework commonly used as a parent framework that organizations map their other compliance work back to. CSF 1.1 is still widely cited externally — note the version distinction when customers cross-reference. See Audit & Comply.

Non-Human Identity (NHI)

Service account, API credential, or automated process that accesses systems without direct user interaction. LinuxGuard automatically identifies and classifies NHIs across your infrastructure to give visibility into automated system activity that would otherwise go unmonitored. See Identity Intelligence.

Notification Rule

Console-configured rule that sends an alert through a delivery channel when specified trigger conditions are met. Notification rules support severity filters, throttle windows, quiet hours, and scope filters; a rule with no conditions forwards all signals. See Alerting & SIEM Integration.

OCI Manifest

Container image manifest in Open Container Initiative format. For a single architecture, the manifest lists the image's config and layer digests. For multi-architecture images, the OCI Image Index references one manifest per platform (see Multi-Arch Manifest). Inspect with docker manifest inspect <image> or crane manifest <image>. See OCI multi-arch manifest.

Orphaned Key

SSH public key that remains authorized on a server after the associated user account has been deleted or disabled. LinuxGuard detects orphaned keys by cross-referencing authorized_keys entries against active account lists. See Identity Intelligence.

Out of scope (compliance vocabulary tier)

Third tier of the LinuxGuard compliance vocabulary contract. A control marked Out of scope concerns a framework domain that LinuxGuard does not address (physical access, application-layer authentication, key management, contract management, employee training, etc.). Per-framework mapping tables list out-of-scope controls explicitly — silence is interpreted as an implicit Satisfies claim. See Audit & Comply § Three-tier vocabulary contract.

PCI-DSS v4.0.1

Payment Card Industry Data Security Standard, version 4.0.1 (effective 2024-06-01). PCI-DSS v3.2.1 retired 2024-03-31; control mapping pages cite v4.x requirement numbers. Applies to organizations processing, storing, or transmitting payment card data. See Audit & Comply.

Playbook

Console-configured automation rule that defines trigger conditions and one or more containment actions to execute when a security signal matches. Playbooks require explicit opt-in at three levels (playbook enabled, scope defined, blast radius set) before they become active. See Active Response.

Posture Score

Composite score (0-100, lower is better) evaluating security posture across accounts, groups, sudo, SSHD configuration, and SSH keys. Posture scores use configurable detractors, mitigators, and weights. See Console Overview.

Presigned Upload

Two-phase support-bundle upload flow: the agent POSTs /v1/support/bundle/upload-url to obtain a presigned S3 PUT URL, PUTs the bundle bytes directly to S3, then POSTs /v1/support/bundle/register to record the bundle metadata. The bundle bytes never traverse the LinuxGuard API; only the metadata round-trip does. See Support Bundles.

Process Attribution

Identifying which process, user, and command caused a security event. LinuxGuard uses eBPF and kernel data to provide reliable attribution with confidence levels (HIGH/MEDIUM/LOW). See Console Overview and Security Architecture.

PSS (Pod Security Standard)

Kubernetes namespace-level admission policy with three profiles: privileged (unrestricted, required for the LinuxGuard host-level DaemonSet), baseline (minimally restrictive — disallows known privilege escalations), restricted (heavily restricted — forbids running as root, host namespaces, host paths). Each LinuxGuard container deployment manifest declares the PSS profile it works under so platform teams can validate against their namespace policies. See Kubernetes DaemonSet.

Redaction Summary

JSON block emitted at the start of every rotated agent log segment and embedded in the support-bundle manifest. Lists, per redacted attribute key, the count of redactions applied since the last rotation. Allows operators to verify that the attribute-key regex (^(api_key|enroll_token|.*_token|.*_secret)$) is matching expected fields. Does NOT track PII because PII redaction is out of scope (LOG-04). See Log Management.

Satisfies (compliance vocabulary tier)

First tier of the LinuxGuard compliance vocabulary contract. A control marked Satisfies means LinuxGuard, as deployed per documented configuration, materially fulfills the control requirement — the customer must still demonstrate operational evidence to an auditor. Every Satisfies claim cites a specific agent feature, a specific evidence pointer, and a specific framework requirement number with version. See Audit & Comply § Three-tier vocabulary contract.

Score Band

Configurable threshold ranges for interpreting posture scores. Administrators define score band boundaries in posture scoring configuration to match organizational risk appetite. See Console Overview.

Scope Statement

One-paragraph declaration at the top of every per-framework compliance mapping page stating what the page is scoped to address and what is out of scope. Per-framework pages instantiate (not paraphrase) the scope statement template so procurement and audit reviewers can compare pages mechanically. See Audit & Comply.

Sensitive Group

POSIX group whose membership grants privileged access (wheel, sudo, docker, lxd, kvm, disk, adm, and configurable additions). LinuxGuard tracks membership of sensitive groups as part of the Groups baseline and surfaces additions/removals as drift events. See Baselines.

Shared Responsibility

Canonical statement appearing verbatim on every per-framework mapping page: LinuxGuard is a security monitoring agent and console; compliance with any framework requires customer-side controls in addition to LinuxGuard's capabilities; the mapping is informational and not a substitute for an independent audit by a qualified assessor. Frames the LinuxGuard / customer / out-of-scope responsibility layers. See Audit & Comply § Shared responsibility.

Signal Deduplication

Grouping identical security signals within a time window, preserving occurrence counts. LinuxGuard deduplicates signals to reduce noise while maintaining visibility into repeated events. See Console Overview.

SOC 2 (TSC 2017 rev 2022)

AICPA Service Organization Control 2 attestation framework, based on the Trust Services Criteria 2017 (revised 2022). Service organizations produce SOC 2 reports for customers — common scope is the Security TSC; expanded scope adds Availability, Confidentiality, Processing Integrity, and Privacy. Distinguish Type I (point-in-time design) vs Type II (operating effectiveness over a period) in reporting language. See Audit & Comply.

StateRAMP

U.S. state-government cloud authorization program drawing on FedRAMP Rev 5 baselines, scoped to state and local government cloud service providers. Counterpart to FedRAMP at the state level. See Audit & Comply.

Support Bundle

Compressed archive (.tar.zst) collected by linuxguard-agent support-bundle collect containing the agent log, rotated log segments (newest-first, trimmed to a 180 MB pre-compress cap), the redacted config snapshot, the bundle manifest, and lightweight host metadata. Default path is /var/lib/linuxguard/support/<unix_timestamp>.tar.zst; sha256 + size are printed to stderr. Used for support escalation and offline diagnosis. See Support Bundles.

Supports (compliance vocabulary tier)

Second tier of the LinuxGuard compliance vocabulary contract. A control marked Supports means LinuxGuard provides telemetry, controls, or evidence that contributes to satisfying the control requirement, but full satisfaction depends on additional customer-side controls (IAM, network segmentation, key management, etc.). Every Supports claim explicitly states what the customer must implement to achieve full satisfaction. See Audit & Comply § Three-tier vocabulary contract.

Systemd Timer

Modern systemd-based scheduling mechanism as an alternative to cron for automated tasks. LinuxGuard inventories systemd timers as part of NHI automation monitoring. See Console Overview.

Targeted Attack

Brute force pattern where attacker targets one username from many source IPs. Indicates a distributed attack on a single account. See Console Overview.

TOTP Enrollment Token

Time-based one-time password used to bootstrap a container or ephemeral agent into a tenant. Read from LINUXGUARD_ENROLL_TOKEN (preferred — immediately unset from the process environment to avoid /proc/<pid>/environ leakage) or --enroll-token. Requires --tenant-id to scope the enrolment. A hash of the token is tagged on the resulting workload identity for renewal tracking. See Enrollment tokens.

Webhook

HTTP endpoint that receives LinuxGuard alert payloads as JSON POST requests. Webhooks include an HMAC-SHA256 signature in the X-LinuxGuard-Signature header for payload verification. See Alerting & SIEM Integration.

Workload Identity

Tenant-scoped identifier for an ephemeral or containerised agent instance, distinct from a server identity. In Kubernetes-aware deployments LinuxGuard derives the workload identity from LINUXGUARD_POD_UID (via Downward API) or sha256(--workload-id) when an explicit ID is passed. The workload identity binds collected telemetry to the workload (pod, job, ephemeral task) rather than to a long-lived host. See Downward API integration.

Zero Trust Enforcement

Console pillar that surfaces security signals enriched with identity context and tracks configuration drift with who-changed-it attribution. Zero Trust Enforcement connects behavioral anomalies to the specific identities involved, enabling identity-aware incident response. See Console Overview.

---

Related: Console Overview | Security Architecture | Agent Commands | Audit & Comply