LATERAL

In the Ultra Transcenders books

DBX-DEPDBX-GENAI

Each book explains LATERAL in context, with comparison tables and the common traps.

Terms in this definition

• Event

  Table in Log Analytics where entries from Windows event logs are kept.

• FUNCTION

  Registered models count as functions in Unity Catalog, so this securable type governs them too: access is given through GRANT ... ON FUNCTION, and REST calls pass FUNCTION as securable_type.

• JOIN

  Combines rows from two or more tables in one SELECT, most often by pairing a primary key with the foreign key that refers to it.

• VARIANT

  A type for semi-structured data like JSON whose structure isn't fixed, available from Databricks Runtime 15.4. It is preferred to storing JSON as strings but can't serve as a partition column.

• explode

  Turns each element of a collection into its own row, in both SQL and Spark. It may be the cause when the Spark UI shows a DAG node taking in few rows and producing many more.

Related terms

• Contain user

  Stops a compromised account's network logons and lateral movement by pushing a policy to every onboarded device. Automatic attack disruption uses this Defender for Endpoint action, which you can reverse from the Action center or from the user's page.

• NATURAL join

  Joins two tables on every column name they share, and SELECT * lists each shared column just once. CROSS and LATERAL can't be added to it.

• Pass-the-ticket

  Also written PtT: a lateral movement method in which a stolen Kerberos ticket from one machine is replayed on a different one. Microsoft Defender for Identity has dedicated alerts for it.

• Risk prioritization (Defender for Cloud)

  Part of Defender CSPM that weighs attack paths, lateral movement, data sensitivity and internet exposure to label each recommendation's risk as Critical, High, Medium or Low. Without that plan, the label says Not evaluated.