admin/tsale-EDR-Telemetry
1
0
Fork 0
mirror of https://github.com/tsale/EDR-Telemetry synced 2026-06-08 17:58:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add C-Prot telemetry coverage to Linux EDR telemetry matrix (#151)

Browse Source
This commit is contained in:
Kostas
2025-12-28 11:58:24 -08:00
committed by GitHub
parent a552fbc765
commit dcc73514c5
2 changed files with 59 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
EDR_telem_linux.json
+31 -1
View File
@@ -5,6 +5,7 @@
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
@@ -22,6 +23,7 @@
"Auditd":"No",
"BitDefender":"Yes",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
@@ -39,6 +41,7 @@
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
@@ -56,6 +59,7 @@
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
@@ -73,6 +77,7 @@
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"No",
"ESET Inspect":"Yes",
"Elastic":"Yes",
@@ -90,6 +95,7 @@
"Auditd":"No",
"BitDefender":"Yes",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"No",
@@ -107,6 +113,7 @@
"Auditd":"No",
"BitDefender":"Yes",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"No",
@@ -124,6 +131,7 @@
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"No",
@@ -141,6 +149,7 @@
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"C-Prot":"No",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"No",
@@ -158,6 +167,7 @@
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
@@ -175,6 +185,7 @@
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"Yes",
@@ -192,6 +203,7 @@
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"No",
@@ -209,6 +221,7 @@
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"No",
"ESET Inspect":"No",
"Elastic":"No",
@@ -226,6 +239,7 @@
"Auditd":"No",
"BitDefender":"Yes",
"Carbon Black Cloud":"No",
"C-Prot":"No",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"No",
@@ -243,6 +257,7 @@
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"C-Prot":"No",
"CrowdStrike":"No",
"ESET Inspect":"No",
"Elastic":"No",
@@ -260,6 +275,7 @@
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"C-Prot":"No",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"No",
@@ -277,6 +293,7 @@
"Auditd":"Yes",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Pending Response",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"No",
@@ -294,6 +311,7 @@
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"No",
"ESET Inspect":"No",
"Elastic":"No",
@@ -311,6 +329,7 @@
"Auditd":"Yes",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"No",
@@ -328,6 +347,7 @@
"Auditd":"Yes",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"No",
"ESET Inspect":"No",
"Elastic":"No",
@@ -345,6 +365,7 @@
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"No",
"ESET Inspect":"No",
"Elastic":"No",
@@ -362,6 +383,7 @@
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"No",
"ESET Inspect":"No",
"Elastic":"No",
@@ -379,6 +401,7 @@
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"Partially",
"ESET Inspect":"No",
"Elastic":"No",
@@ -396,6 +419,7 @@
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Pending Response",
"CrowdStrike":"Partially",
"ESET Inspect":"No",
"Elastic":"No",
@@ -413,6 +437,7 @@
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Yes",
"CrowdStrike":"No",
"ESET Inspect":"No",
"Elastic":"No",
@@ -430,6 +455,7 @@
"Auditd":"No",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"Yes",
@@ -447,6 +473,7 @@
"Auditd":"No",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
@@ -464,6 +491,7 @@
"Auditd":"No",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
@@ -481,6 +509,7 @@
"Auditd":"No",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"C-Prot":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
@@ -498,6 +527,7 @@
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"C-Prot":"Partially",
"CrowdStrike":"No",
"ESET Inspect":"No",
"Elastic":"No",
@@ -509,4 +539,4 @@
"Sysmon":"Yes",
"Uptycs":"No"
}
]
]
partially_value_explanations_linux.json
+28 -1
View File
@@ -6,6 +6,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -20,6 +21,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -34,6 +36,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -48,6 +51,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":{"Partially":"Although the file is modified, the event is recorded as FileCreated instead of FileModified, misrepresenting the actual action and preventing analysts from distinguishing between file creation and modification."},
@@ -62,6 +66,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -76,6 +81,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -90,6 +96,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -104,6 +111,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -118,6 +126,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -132,6 +141,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -146,6 +156,7 @@
"Qualys":{"Partially":"Only available through the specific endpoint page in the console (not searchable)"},
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":{"Partially":"Only available through the specific endpoint page in the console (not searchable)"},
"MDE":"",
@@ -160,6 +171,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -174,6 +186,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -188,6 +201,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -202,6 +216,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -216,6 +231,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -230,6 +246,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -244,6 +261,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -258,6 +276,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -272,6 +291,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -286,6 +306,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -300,6 +321,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -356,6 +378,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -370,6 +393,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -384,6 +408,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -398,6 +423,7 @@
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot":"",
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",
@@ -407,11 +433,12 @@
},
{
"Telemetry Feature Category":"",
"Sub-Category":"IMPHASH",
"Sub-Category":"Fuzzy Hash",
"SentinelOne (Complete)":"",
"Qualys":"",
"Uptycs":"",
"CrowdStrike":"",
"C-Prot": {"Partially":"Available only for file manipulation events."},
"Sysmon":"",
"LimaCharlie":"",
"MDE":"",