admin/tsale-EDR-Telemetry
1
0
Fork 0
mirror of https://github.com/tsale/EDR-Telemetry synced 2026-06-08 17:58:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Initial Coverage for Cortex XDR Agent on Linux (#148)

Browse Source 
* Initial Coverage for Cortex XDR Agent on Linux

* Resolve Cortex XDR Linux telemetry conflicts

---------

Co-authored-by: tsale <kostastsale@gmail.com>
This commit is contained in:
Bertrand Le Bail
2026-05-14 01:12:25 +02:00
committed by GitHub
parent 56de511ddc
commit 3afe8902f5
1 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
EDR_telem_linux.json
+30
View File
@@ -4,6 +4,7 @@
"Sub-Category":"Process Creation",
"Auditd":"Yes",
"BitDefender":"Yes",
"Cortex XDR":"Yes",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -22,6 +23,7 @@
"Sub-Category":"Process Termination",
"Auditd":"No",
"BitDefender":"Yes",
"Cortex XDR":"Yes",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -40,6 +42,7 @@
"Sub-Category":"File Creation",
"Auditd":"Yes",
"BitDefender":"Yes",
"Cortex XDR":"Yes",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -58,6 +61,7 @@
"Sub-Category":"File Modification",
"Auditd":"Yes",
"BitDefender":"Yes",
"Cortex XDR":"Yes",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -76,6 +80,7 @@
"Sub-Category":"File Deletion",
"Auditd":"Yes",
"BitDefender":"Yes",
"Cortex XDR":"Yes",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"No",
@@ -94,6 +99,7 @@
"Sub-Category":"User Logon",
"Auditd":"No",
"BitDefender":"Yes",
"Cortex XDR":"Yes",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -112,6 +118,7 @@
"Sub-Category":"User Logoff",
"Auditd":"No",
"BitDefender":"Yes",
"Cortex XDR":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -130,6 +137,7 @@
"Sub-Category":"Logon Failed",
"Auditd":"No",
"BitDefender":"No",
"Cortex XDR":"Yes",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -148,6 +156,7 @@
"Sub-Category":"Script Content",
"Auditd":"No",
"BitDefender":"No",
"Cortex XDR":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -166,6 +175,7 @@
"Sub-Category":"Network Connection",
"Auditd":"Yes",
"BitDefender":"Yes",
"Cortex XDR":"Yes",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -184,6 +194,7 @@
"Sub-Category":"Network Socket Listen",
"Auditd":"Yes",
"BitDefender":"Yes",
"Cortex XDR":"Yes",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -202,6 +213,7 @@
"Sub-Category":"DNS Query",
"Auditd":"No",
"BitDefender":"No",
"Cortex XDR":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -220,6 +232,7 @@
"Sub-Category":"Scheduled Task",
"Auditd":"No",
"BitDefender":"No",
"Cortex XDR":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"No",
@@ -238,6 +251,7 @@
"Sub-Category":"User Account Created",
"Auditd":"No",
"BitDefender":"Yes",
"Cortex XDR":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -256,6 +270,7 @@
"Sub-Category":"User Account Modified",
"Auditd":"No",
"BitDefender":"No",
"Cortex XDR":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"No",
@@ -274,6 +289,7 @@
"Sub-Category":"User Account Deleted",
"Auditd":"No",
"BitDefender":"No",
"Cortex XDR":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -292,6 +308,7 @@
"Sub-Category":"Driver Load",
"Auditd":"Yes",
"BitDefender":"No",
"Cortex XDR":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -310,6 +327,7 @@
"Sub-Category":"Image Load",
"Auditd":"Yes",
"BitDefender":"Yes",
"Cortex XDR":"Yes",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"No",
@@ -328,6 +346,7 @@
"Sub-Category":"eBPF Event",
"Auditd":"Yes",
"BitDefender":"No",
"Cortex XDR":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -346,6 +365,7 @@
"Sub-Category":"Raw Access Read",
"Auditd":"Yes",
"BitDefender":"No",
"Cortex XDR":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"No",
@@ -364,6 +384,7 @@
"Sub-Category":"Process Access",
"Auditd":"Yes",
"BitDefender":"Yes",
"Cortex XDR":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"No",
@@ -382,6 +403,7 @@
"Sub-Category":"Process Tampering",
"Auditd":"Yes",
"BitDefender":"Yes",
"Cortex XDR":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"No",
@@ -400,6 +422,7 @@
"Sub-Category":"Service Creation",
"Auditd":"No",
"BitDefender":"No",
"Cortex XDR":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Partially",
@@ -418,6 +441,7 @@
"Sub-Category":"Service Modification",
"Auditd":"No",
"BitDefender":"No",
"Cortex XDR":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Partially",
@@ -436,6 +460,7 @@
"Sub-Category":"Service Deletion",
"Auditd":"No",
"BitDefender":"No",
"Cortex XDR":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"No",
@@ -454,6 +479,7 @@
"Sub-Category":"Agent Start",
"Auditd":"No",
"BitDefender":"Yes",
"Cortex XDR":"Yes",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -472,6 +498,7 @@
"Sub-Category":"Agent Stop",
"Auditd":"No",
"BitDefender":"Yes",
"Cortex XDR":"No",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -490,6 +517,7 @@
"Sub-Category":"MD5",
"Auditd":"No",
"BitDefender":"Yes",
"Cortex XDR":"Yes",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -508,6 +536,7 @@
"Sub-Category":"SHA",
"Auditd":"No",
"BitDefender":"Yes",
"Cortex XDR":"Yes",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
@@ -526,6 +555,7 @@
"Sub-Category":"Fuzzy Hash",
"Auditd":"No",
"BitDefender":"No",
"Cortex XDR":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Partially",
"CrowdStrike":"No",