From dcc73514c557c6cc00a231b352c6e4767f474fd0 Mon Sep 17 00:00:00 2001
From: Kostas <kostastsale@gmail.com>
Date: Sun, 28 Dec 2025 11:58:24 -0800
Subject: [PATCH] Add C-Prot telemetry coverage to Linux EDR telemetry matrix
 (#151)

---
 EDR_telem_linux.json                    | 32 ++++++++++++++++++++++++-
 partially_value_explanations_linux.json | 29 +++++++++++++++++++++-
 2 files changed, 59 insertions(+), 2 deletions(-)

diff --git a/EDR_telem_linux.json b/EDR_telem_linux.json
index 8f4c332..f351290 100644
--- a/EDR_telem_linux.json
+++ b/EDR_telem_linux.json
@@ -5,6 +5,7 @@
     "Auditd":"Yes",
     "BitDefender":"Yes",
     "Carbon Black Cloud":"Yes",
+    "C-Prot":"Yes",
     "CrowdStrike":"Yes",
     "ESET Inspect":"Yes",
     "Elastic":"Yes",
@@ -22,6 +23,7 @@
     "Auditd":"No",
     "BitDefender":"Yes",
     "Carbon Black Cloud":"No",
+    "C-Prot":"Yes",
     "CrowdStrike":"Yes",
     "ESET Inspect":"Yes",
     "Elastic":"Yes",
@@ -39,6 +41,7 @@
     "Auditd":"Yes",
     "BitDefender":"Yes",
     "Carbon Black Cloud":"Yes",
+    "C-Prot":"Yes",
     "CrowdStrike":"Yes",
     "ESET Inspect":"Yes",
     "Elastic":"Yes",
@@ -56,6 +59,7 @@
     "Auditd":"Yes",
     "BitDefender":"Yes",
     "Carbon Black Cloud":"Yes",
+    "C-Prot":"Yes",
     "CrowdStrike":"Yes",
     "ESET Inspect":"Yes",
     "Elastic":"Yes",
@@ -73,6 +77,7 @@
     "Auditd":"Yes",
     "BitDefender":"Yes",
     "Carbon Black Cloud":"Yes",
+    "C-Prot":"Yes",
     "CrowdStrike":"No",
     "ESET Inspect":"Yes",
     "Elastic":"Yes",
@@ -90,6 +95,7 @@
     "Auditd":"No",
     "BitDefender":"Yes",
     "Carbon Black Cloud":"No",
+    "C-Prot":"Yes",
     "CrowdStrike":"Yes",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -107,6 +113,7 @@
     "Auditd":"No",
     "BitDefender":"Yes",
     "Carbon Black Cloud":"No",
+    "C-Prot":"Yes",
     "CrowdStrike":"Yes",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -124,6 +131,7 @@
     "Auditd":"No",
     "BitDefender":"No",
     "Carbon Black Cloud":"No",
+    "C-Prot":"Yes",
     "CrowdStrike":"Yes",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -141,6 +149,7 @@
     "Auditd":"No",
     "BitDefender":"No",
     "Carbon Black Cloud":"No",
+    "C-Prot":"No",
     "CrowdStrike":"Yes",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -158,6 +167,7 @@
     "Auditd":"Yes",
     "BitDefender":"Yes",
     "Carbon Black Cloud":"Yes",
+    "C-Prot":"Yes",
     "CrowdStrike":"Yes",
     "ESET Inspect":"Yes",
     "Elastic":"Yes",
@@ -175,6 +185,7 @@
     "Auditd":"Yes",
     "BitDefender":"Yes",
     "Carbon Black Cloud":"No",
+    "C-Prot":"Yes",
     "CrowdStrike":"Yes",
     "ESET Inspect":"No",
     "Elastic":"Yes",
@@ -192,6 +203,7 @@
     "Auditd":"No",
     "BitDefender":"No",
     "Carbon Black Cloud":"No",
+    "C-Prot":"Yes",
     "CrowdStrike":"Yes",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -209,6 +221,7 @@
     "Auditd":"No",
     "BitDefender":"No",
     "Carbon Black Cloud":"No",
+    "C-Prot":"Yes",
     "CrowdStrike":"No",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -226,6 +239,7 @@
     "Auditd":"No",
     "BitDefender":"Yes",
     "Carbon Black Cloud":"No",
+    "C-Prot":"No",
     "CrowdStrike":"Yes",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -243,6 +257,7 @@
     "Auditd":"No",
     "BitDefender":"No",
     "Carbon Black Cloud":"No",
+    "C-Prot":"No",
     "CrowdStrike":"No",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -260,6 +275,7 @@
     "Auditd":"No",
     "BitDefender":"No",
     "Carbon Black Cloud":"No",
+    "C-Prot":"No",
     "CrowdStrike":"Yes",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -277,6 +293,7 @@
     "Auditd":"Yes",
     "BitDefender":"No",
     "Carbon Black Cloud":"No",
+    "C-Prot":"Pending Response",
     "CrowdStrike":"Yes",
     "ESET Inspect":"Yes",
     "Elastic":"No",
@@ -294,6 +311,7 @@
     "Auditd":"Yes",
     "BitDefender":"Yes",
     "Carbon Black Cloud":"No",
+    "C-Prot":"Yes",
     "CrowdStrike":"No",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -311,6 +329,7 @@
     "Auditd":"Yes",
     "BitDefender":"No",
     "Carbon Black Cloud":"No",
+    "C-Prot":"Yes",
     "CrowdStrike":"Yes",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -328,6 +347,7 @@
     "Auditd":"Yes",
     "BitDefender":"No",
     "Carbon Black Cloud":"No",
+    "C-Prot":"Yes",
     "CrowdStrike":"No",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -345,6 +365,7 @@
     "Auditd":"Yes",
     "BitDefender":"Yes",
     "Carbon Black Cloud":"No",
+    "C-Prot":"Yes",
     "CrowdStrike":"No",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -362,6 +383,7 @@
     "Auditd":"Yes",
     "BitDefender":"Yes",
     "Carbon Black Cloud":"No",
+    "C-Prot":"Yes",
     "CrowdStrike":"No",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -379,6 +401,7 @@
     "Auditd":"No",
     "BitDefender":"No",
     "Carbon Black Cloud":"No",
+    "C-Prot":"Yes",
     "CrowdStrike":"Partially",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -396,6 +419,7 @@
     "Auditd":"No",
     "BitDefender":"No",
     "Carbon Black Cloud":"No",
+    "C-Prot":"Pending Response",
     "CrowdStrike":"Partially",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -413,6 +437,7 @@
     "Auditd":"No",
     "BitDefender":"No",
     "Carbon Black Cloud":"No",
+    "C-Prot":"Yes",
     "CrowdStrike":"No",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -430,6 +455,7 @@
     "Auditd":"No",
     "BitDefender":"Yes",
     "Carbon Black Cloud":"Yes",
+    "C-Prot":"Yes",
     "CrowdStrike":"Yes",
     "ESET Inspect":"No",
     "Elastic":"Yes",
@@ -447,6 +473,7 @@
     "Auditd":"No",
     "BitDefender":"Yes",
     "Carbon Black Cloud":"Yes",
+    "C-Prot":"Yes",
     "CrowdStrike":"Yes",
     "ESET Inspect":"Yes",
     "Elastic":"Yes",
@@ -464,6 +491,7 @@
     "Auditd":"No",
     "BitDefender":"Yes",
     "Carbon Black Cloud":"Yes",
+    "C-Prot":"Yes",
     "CrowdStrike":"Yes",
     "ESET Inspect":"Yes",
     "Elastic":"Yes",
@@ -481,6 +509,7 @@
     "Auditd":"No",
     "BitDefender":"Yes",
     "Carbon Black Cloud":"Yes",
+    "C-Prot":"Yes",
     "CrowdStrike":"Yes",
     "ESET Inspect":"Yes",
     "Elastic":"Yes",
@@ -498,6 +527,7 @@
     "Auditd":"No",
     "BitDefender":"No",
     "Carbon Black Cloud":"No",
+    "C-Prot":"Partially",
     "CrowdStrike":"No",
     "ESET Inspect":"No",
     "Elastic":"No",
@@ -509,4 +539,4 @@
     "Sysmon":"Yes",
     "Uptycs":"No"
   }
-]
+]
\ No newline at end of file
diff --git a/partially_value_explanations_linux.json b/partially_value_explanations_linux.json
index fbf69b5..9427d44 100644
--- a/partially_value_explanations_linux.json
+++ b/partially_value_explanations_linux.json
@@ -6,6 +6,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -20,6 +21,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -34,6 +36,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -48,6 +51,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":{"Partially":"Although the file is modified, the event is recorded as FileCreated instead of FileModified, misrepresenting the actual action and preventing analysts from distinguishing between file creation and modification."},
@@ -62,6 +66,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -76,6 +81,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -90,6 +96,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -104,6 +111,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -118,6 +126,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -132,6 +141,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -146,6 +156,7 @@
       "Qualys":{"Partially":"Only available through the specific endpoint page in the console (not searchable)"},
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":{"Partially":"Only available through the specific endpoint page in the console (not searchable)"},
       "MDE":"",
@@ -160,6 +171,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -174,6 +186,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -188,6 +201,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -202,6 +216,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -216,6 +231,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -230,6 +246,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -244,6 +261,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -258,6 +276,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -272,6 +291,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -286,6 +306,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -300,6 +321,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -356,6 +378,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -370,6 +393,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -384,6 +408,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -398,6 +423,7 @@
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot":"",
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",
@@ -407,11 +433,12 @@
     },
     {
       "Telemetry Feature Category":"",
-      "Sub-Category":"IMPHASH",
+      "Sub-Category":"Fuzzy Hash",
       "SentinelOne (Complete)":"",
       "Qualys":"",
       "Uptycs":"",
       "CrowdStrike":"",
+      "C-Prot": {"Partially":"Available only for file manipulation events."},
       "Sysmon":"",
       "LimaCharlie":"",
       "MDE":"",