* Update C-Prot macOS telemetry coverage
Consolidates C-Prot macOS telemetry updates from PRs #182-#190 into one OS-scoped change set.
* fix: adjust C-Prot macOS telemetry statuses
Keep Raw Device Access accepted based on direct raw device access evidence, but leave Process Access and Process Injection Or Tampering as No because the submitted evidence is detection/prevention-oriented rather than direct telemetry.
---------
Co-authored-by: Hermes Agent <hermes-agent@users.noreply.github.com>
* Initial Coverage for Cortex XDR Agent on Linux
* Resolve Cortex XDR Linux telemetry conflicts
---------
Co-authored-by: tsale <kostastsale@gmail.com>
- Include 'partially_value_explanations_linux.json' in GitHub Actions workflow triggers.
- Update .gitignore to include .env.yaml.
- Remove outdated macOS telemetry investigation report.
- Add example environment configuration file for Cloud Function.
- Implement deployment script for EDR Telemetry Updater Cloud Function.
- Create main function for handling webhook triggers and updating Supabase database.
- Update requirements.txt to include additional dependencies for Supabase client.
- Removed "Script Execution" and "Background Task Registration Change" from MACOS_CATEGORIES_VALUED in compare.py.
- Added new EDR product explanations for BitDefender, Qualys, CrowdStrike, and ESET Inspect in partially_value_explanations_macOS.json.
- Created a new macOS EDR Telemetry Investigation Report detailing the accuracy and completeness of the telemetry JSON against vendor documentation, highlighting critical issues and recommendations.
* Update EDR_telem_linux.json
Updated Linux Service Modification
* Update EDR_telem_linux.json
Updated C-Prot User Account Management
* Update EDR_telem_linux.json
C-Prot Linux Driver Load
* Fix missing newline at end of EDR_telem_linux.json
---------
Co-authored-by: Kostas <kostastsale@gmail.com>
* Update EDR_telem_linux.json
Updated Linux Service Modification
* Update EDR_telem_linux.json
Updated C-Prot User Account Management
* Fix missing newline at end of EDR_telem_linux.json
---------
Co-authored-by: Kostas <kostastsale@gmail.com>
* ESET USB events+file open
* Update ESET Inspect telemetry description for sensitive file tracking
---------
Co-authored-by: Kostas <kostastsale@gmail.com>
* mass updates to Cortex XDR - Windows coverage
* Update Cortex XDR telemetry status for device control and named pipe events
Change Virtual Disk Mount, USB Device Unmount, and USB Device Mount from Yes to Partially (requires Device Control in block mode). Change Volume Shadow Copy Deletion and Pipe Connection from Yes to No.
* Update Cortex XDR status in telemetry categories
---------
Co-authored-by: tsale <kostastsale@gmail.com>
- Update MACOS_TELEMETRY_GENERATOR_GUIDE.md to reflect OpenDirectory.framework usage for UserAccountEvents instead of direct dslocal plist writes
- Clarify kext load/unload expectations on modern hardened macOS systems
- Revise CodeSignTrust description to focus on signature/trust enrichment validation via trusted vs tampered sample execution
- Update ProcessAccess to document task_for_pid as primary mechanism
- Add recommended
- Add MACOS_CATEGORIES_VALUED dictionary with macOS-specific telemetry categories
- Update determine_categories() to detect macOS files and return appropriate category set
- Update display_results() to show "macOS" OS type for macOS input files
- Simplify generate_scores() scoring logic by removing redundant try-except block
- Skip replacements in "Telemetry Feature Category" and "Sub-Category" columns when converting CSV→JSON
- Skip header row and first two columns when converting JSON→CSV
- Refactor replace functions to use proper JSON parsing and line-by-line CSV processing
- Add mitre_att&ck_mappings.json and partially_value_explanations_linux.json to workflow triggers
- Implement platform detection logic to determine if changes affect Windows, Linux, or both based on modified files
- Refactor database update calls to handle platform-specific updates separately when only one platform is affected
- Update workflow to use detected platform instead of manual input for
* Updates for MDE on Windows and Linux
* Update MDE Linux service telemetry status from Partially to No and remove explanation
---------
Co-authored-by: tsale <kostastsale@gmail.com>
Kostas