Supplementary Workbook for "Living-off-the-Land Detection in Enterprise Environments: A Systematic Review of Telemetry, Detection Rules, and SIEM–SOAR Integration"

Supplementary materials for the systematic review of Living-off-the-Land detection. Contains the frozen review protocol, complete database search exports and query logs, the deduplication log, title/abstract screening decisions with exclusion reason codes, tier assignments with retrieval status, item-level reporting-completeness scores, the structured extraction records, and evidence locators for all quantitative claims. Provided so that the PRISMA flow and every reported figure can be independently audited. Package contents are described in README.txt.