Supplementary Materials (v2) for "Living-off-the-Land Detection, Detection Engineering, and SIEM–SOAR Integration: An Integrative Mapping Review"

Revised supplementary materials (version 2) for the integrative mapping review of Living-off-the-Land (LotL) detection, detection engineering, and SIEM–SOAR integration. This version supersedes the first release (2026-07-28) and matches the revised manuscript submitted to Security and Privacy (Wiley). The package contains the master screening and extraction workbook, the raw database search exports (IEEE Xplore CSV and ScienceDirect RIS), and the search-history screenshots. Together they let a reader reproduce the full PRISMA 2020 flow. 413 records identified, 398 screened, a 128-publication mapping corpus, and a 41-publication detailed-synthesis subset and trace every reported figure to a source. Changes since version 1: PRISMA counts reconciled to record-level data; all 271 legacy title/abstract exclusions re-examined against abstracts (259 confirmed, 12 corrected; abstract retrieval AI-assisted, final adjudication by the researcher); four records restored to the mapping tier and two promoted to the detailed-synthesis subset after full-text reading; structured extraction completed for all core studies; and a new per-study nine-dimension reporting-gap sheet added. The absence of an independent second reviewer is stated as a limitation.