From 3afe8902f5dbc8449df6a31c6527e5337d86a032 Mon Sep 17 00:00:00 2001 From: Bertrand Le Bail Date: Thu, 14 May 2026 01:12:25 +0200 Subject: [PATCH] Initial Coverage for Cortex XDR Agent on Linux (#148) * Initial Coverage for Cortex XDR Agent on Linux * Resolve Cortex XDR Linux telemetry conflicts --------- Co-authored-by: tsale --- EDR_telem_linux.json | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/EDR_telem_linux.json b/EDR_telem_linux.json index c200db6..0cf6163 100644 --- a/EDR_telem_linux.json +++ b/EDR_telem_linux.json @@ -4,6 +4,7 @@ "Sub-Category":"Process Creation", "Auditd":"Yes", "BitDefender":"Yes", + "Cortex XDR":"Yes", "Carbon Black Cloud":"Yes", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -22,6 +23,7 @@ "Sub-Category":"Process Termination", "Auditd":"No", "BitDefender":"Yes", + "Cortex XDR":"Yes", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -40,6 +42,7 @@ "Sub-Category":"File Creation", "Auditd":"Yes", "BitDefender":"Yes", + "Cortex XDR":"Yes", "Carbon Black Cloud":"Yes", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -58,6 +61,7 @@ "Sub-Category":"File Modification", "Auditd":"Yes", "BitDefender":"Yes", + "Cortex XDR":"Yes", "Carbon Black Cloud":"Yes", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -76,6 +80,7 @@ "Sub-Category":"File Deletion", "Auditd":"Yes", "BitDefender":"Yes", + "Cortex XDR":"Yes", "Carbon Black Cloud":"Yes", "C-Prot":"Yes", "CrowdStrike":"No", @@ -94,6 +99,7 @@ "Sub-Category":"User Logon", "Auditd":"No", "BitDefender":"Yes", + "Cortex XDR":"Yes", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -112,6 +118,7 @@ "Sub-Category":"User Logoff", "Auditd":"No", "BitDefender":"Yes", + "Cortex XDR":"No", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -130,6 +137,7 @@ "Sub-Category":"Logon Failed", "Auditd":"No", "BitDefender":"No", + "Cortex XDR":"Yes", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -148,6 +156,7 @@ "Sub-Category":"Script Content", "Auditd":"No", "BitDefender":"No", + "Cortex XDR":"No", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -166,6 +175,7 @@ "Sub-Category":"Network Connection", "Auditd":"Yes", "BitDefender":"Yes", + "Cortex XDR":"Yes", "Carbon Black Cloud":"Yes", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -184,6 +194,7 @@ "Sub-Category":"Network Socket Listen", "Auditd":"Yes", "BitDefender":"Yes", + "Cortex XDR":"Yes", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -202,6 +213,7 @@ "Sub-Category":"DNS Query", "Auditd":"No", "BitDefender":"No", + "Cortex XDR":"No", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -220,6 +232,7 @@ "Sub-Category":"Scheduled Task", "Auditd":"No", "BitDefender":"No", + "Cortex XDR":"No", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"No", @@ -238,6 +251,7 @@ "Sub-Category":"User Account Created", "Auditd":"No", "BitDefender":"Yes", + "Cortex XDR":"No", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -256,6 +270,7 @@ "Sub-Category":"User Account Modified", "Auditd":"No", "BitDefender":"No", + "Cortex XDR":"No", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"No", @@ -274,6 +289,7 @@ "Sub-Category":"User Account Deleted", "Auditd":"No", "BitDefender":"No", + "Cortex XDR":"No", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -292,6 +308,7 @@ "Sub-Category":"Driver Load", "Auditd":"Yes", "BitDefender":"No", + "Cortex XDR":"No", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -310,6 +327,7 @@ "Sub-Category":"Image Load", "Auditd":"Yes", "BitDefender":"Yes", + "Cortex XDR":"Yes", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"No", @@ -328,6 +346,7 @@ "Sub-Category":"eBPF Event", "Auditd":"Yes", "BitDefender":"No", + "Cortex XDR":"No", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -346,6 +365,7 @@ "Sub-Category":"Raw Access Read", "Auditd":"Yes", "BitDefender":"No", + "Cortex XDR":"No", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"No", @@ -364,6 +384,7 @@ "Sub-Category":"Process Access", "Auditd":"Yes", "BitDefender":"Yes", + "Cortex XDR":"No", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"No", @@ -382,6 +403,7 @@ "Sub-Category":"Process Tampering", "Auditd":"Yes", "BitDefender":"Yes", + "Cortex XDR":"No", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"No", @@ -400,6 +422,7 @@ "Sub-Category":"Service Creation", "Auditd":"No", "BitDefender":"No", + "Cortex XDR":"No", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"Partially", @@ -418,6 +441,7 @@ "Sub-Category":"Service Modification", "Auditd":"No", "BitDefender":"No", + "Cortex XDR":"No", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"Partially", @@ -436,6 +460,7 @@ "Sub-Category":"Service Deletion", "Auditd":"No", "BitDefender":"No", + "Cortex XDR":"No", "Carbon Black Cloud":"No", "C-Prot":"Yes", "CrowdStrike":"No", @@ -454,6 +479,7 @@ "Sub-Category":"Agent Start", "Auditd":"No", "BitDefender":"Yes", + "Cortex XDR":"Yes", "Carbon Black Cloud":"Yes", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -472,6 +498,7 @@ "Sub-Category":"Agent Stop", "Auditd":"No", "BitDefender":"Yes", + "Cortex XDR":"No", "Carbon Black Cloud":"Yes", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -490,6 +517,7 @@ "Sub-Category":"MD5", "Auditd":"No", "BitDefender":"Yes", + "Cortex XDR":"Yes", "Carbon Black Cloud":"Yes", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -508,6 +536,7 @@ "Sub-Category":"SHA", "Auditd":"No", "BitDefender":"Yes", + "Cortex XDR":"Yes", "Carbon Black Cloud":"Yes", "C-Prot":"Yes", "CrowdStrike":"Yes", @@ -526,6 +555,7 @@ "Sub-Category":"Fuzzy Hash", "Auditd":"No", "BitDefender":"No", + "Cortex XDR":"No", "Carbon Black Cloud":"No", "C-Prot":"Partially", "CrowdStrike":"No",