[
  {
    "Telemetry Feature Category":"Process Activity",
    "Sub-Category":"Process Creation",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Process Activity",
    "Sub-Category":"Process Termination",
    "BitDefender":"",
    "Carbon Black": {"Partially":"Only observed as file operations."},
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Process Activity",
    "Sub-Category":"Process Access",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":{"Partially":"Only for LSASS.exe process"},
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":{"Partially":"Only for LSASS.exe process"},
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "Process Activity",
    "Sub-Category":"Image\/Library Loaded",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Process Activity",
    "Sub-Category":"Remote Thread Creation",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "Process Activity",
    "Sub-Category":"Win32 API Telemetry",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":{"Partially":"Only for a limited set of APIs as documented in: https://github.com/tsale/EDR-Telemetry/pull/130#issuecomment-3266387350"},
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":{"Partially":"Only for a limited set of APIs (e.g., SetWindowsHookEx, GetAsyncKeyState, etc.)"},
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "Process Activity",
    "Sub-Category":"Process Tampering Activity",
    "BitDefender":"",
    "Carbon Black":{"Partially":"Only via cross-process."},
    "Cortex XDR":{"Partially":"Needs the tamper protection enabled."},
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Qualys":"",
    "SentinelOne":{"Partially":"Only provides cross process info like remote thread creation and process handles, it doesn't give much more detail beyond that."},
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "Process Activity",
    "Sub-Category":"Process Call Stacks",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike": "",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""

  },
  {
    "Telemetry Feature Category":"File Manipulation",
    "Sub-Category":"File Creation",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":{"Partially":"Only for binaries created on disk."},
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":{"Partially":"Only tracks via dedicated event the renaming of Portable Executables (PE) and compressed files."}
  },
  {
    "Telemetry Feature Category": "File Manipulation",
    "Sub-Category":"File Opened",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":{"Partially":"Only file related events that is deems suspicious based on some proprietary criterias."},
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":{"Partially":"Generated only on specific files that may contain sensitive information such as browser related databases, credential storages etc."},
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":{"Partially":"Visibility on File Read only"},
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":{"Partially":"Only tracks via dedicated event the opening of compressed files."}
  },
  {
    "Telemetry Feature Category": "File Manipulation",
    "Sub-Category":"File Deletion",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "File Manipulation",
    "Sub-Category":"File Modification",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "File Manipulation",
    "Sub-Category":"File Renaming",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":{"Partially":"Events are reported as a delete+write."},
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR": {"Partially":"Tracked as file modification event."},
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard": {"Partially":"Only tracks via dedicated event the renaming of Portable Executables (PE) and compressed files."}
  },
  {
    "Telemetry Feature Category":"User Account Activity",
    "Sub-Category":"Local Account Creation",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "User Account Activity",
    "Sub-Category":"Local Account Modification",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":{"Partially":"Only contains modification from a user added to a group."},
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "User Account Activity",
    "Sub-Category":"Local Account Deletion",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "User Account Activity",
    "Sub-Category":"Account Login",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":{"Partially":"Only tracks when user is seen first time per endpoint."},
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "User Account Activity",
    "Sub-Category":"Account Logoff",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Network Activity",
    "Sub-Category":"TCP Connection",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Network Activity",
    "Sub-Category":"UDP Connection",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "Network Activity",
    "Sub-Category":"URL",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":{"Partially":"Only if activity is generated by a NON-Browser application."},
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":{"Partially":"Depends on Firewall / IPS settings / policy; if only IPS is enabled URL will just logged malicious connections, but not clean connections"},
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":{"Partially":"Mainly when the URL is fetched via HTTP/S GET and not from a modern browser."}
  },
  {
    "Telemetry Feature Category": "Network Activity",
    "Sub-Category":"DNS Query",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Network Activity",
    "Sub-Category":"File Downloaded",
    "BitDefender":{"Partially":"Only tracks downloads of executables."},
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":{"Partially":"Only for documents and binaries."},
    "Cylance":" ",
    "ESET Inspect":{"Partially":"Only for binaries created on disk."},
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":{"Partially":"Only if the activity is generated via Chrome browser[https://doc.limacharlie.io/docs/documentation/0b189c00533e5-reference-events#http_request]"},
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":{"Partially":"Limited to certain processes."},
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Hash Algorithms",
    "Sub-Category":"MD5",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Hash Algorithms",
    "Sub-Category":"SHA",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Hash Algorithms",
    "Sub-Category":"IMPHASH",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Hash Algorithms",
    "Sub-Category":"JA3/JA3s",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Registry Activity",
    "Sub-Category":"Key\/Value Creation",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":{"Partially":"Tracks only only specific keys (ASEP = 'AutoStarting Entry Point')."},
    "Cybereason":{"Partially":"By default, only RUN keys and some registry values that are commonly abused."},
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Registry Activity",
    "Sub-Category":"Key\/Value Modification",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":{"Partially":"Tracks only only specific keys (ASEP = 'AutoStarting Entry Point')."},
    "Cybereason":{"Partially":"By default, only RUN keys and some registry values that are commonly abused."},
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Registry Activity",
    "Sub-Category":"Key\/Value Deletion",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":{"Partially":"By default, only RUN keys and some registry values that are commonly abused."},
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Schedule Task Activity",
    "Sub-Category":"Scheduled Task Creation",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Schedule Task Activity",
    "Sub-Category":"Scheduled Task Modification",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Schedule Task Activity",
    "Sub-Category":"Scheduled Task Deletion",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Service Activity",
    "Sub-Category":"Service Creation",
    "BitDefender": {"Partially": "Service creation telemetry was not consistent across different types of testing, with some methods being captured where others were not."},
    "Carbon Black":{"Partially":"Via monitoring the registry changes."},
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":{"Partially":"The dedicated event tracking service activity only tracks parent/child processes related to a service change, no further details."}
  },
  {
    "Telemetry Feature Category":"Service Activity",
    "Sub-Category":"Service Modification",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":{"Partially":"Tracks only modification of service binaries."},
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":{"Partially":"The dedicated event tracking service activity only tracks parent/child processes related to a service change, no further details."}
  },
  {
    "Telemetry Feature Category":"Service Activity",
    "Sub-Category":"Service Deletion",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Featurere Category":"Driver\/Module Activity",
    "Sub-Category":"Driver Loaded",    
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Driver\/Module Activity",
    "Sub-Category":"Driver Modification",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "Driver\/Module Activity",
    "Sub-Category":"Driver Unloaded",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Qualys":"",
    "SentinelOne":{"Partially":"It only shows a specific driver unload method use by attacker instead of every unloaded drivers"},    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Device Operations",
    "Sub-Category":"Virtual Disk Mount",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":{"Partially":"Device Control should be in block mode"},
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Device Operations",
    "Sub-Category":"USB Device Unmount",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":{"Partially":"Device Control should be in block mode"},
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":{"Partially":"Only applicable for removable drives, no HID devices."},
    "LimaCharlie":{"Partially":"Only mount/unmount events related to 'Volumes'. No other device visibility on this."},
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Device Operations",
    "Sub-Category":"USB Device Mount",
    "BitDefender":"",
    "Carbon Black":{"Partially":"Mounted USBs are recorded in a separate table within the platform for  administrative approval."},
    "Cortex XDR":{"Partially":"Device Control should be in block mode"},
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":{"Partially":"Only applicable for removable drives, no HID devices."},
    "LimaCharlie":{"Partially":"Only mount/unmount events related to 'Volumes'. No other device visibility on this."},
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Other Relevant Events",
    "Sub-Category":"Group Policy Modification",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Other Relevant Events",
    "Sub-Category":"Volume Shadow Copy Deletion",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Named Pipe Activity",
    "Sub-Category":"Pipe Creation",
    "BitDefender":"",
    "Carbon Black":{"Partially":"Reports only named pipes for file creation events."},
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"Named Pipe Activity",
    "Sub-Category":"Pipe Connection",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"EDR SysOps",
    "Sub-Category":"Agent Start",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "EDR SysOps",
    "Sub-Category":"Agent Stop",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "EDR SysOps",
    "Sub-Category":"Agent Install",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "EDR SysOps",
    "Sub-Category":"Agent Uninstall",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "EDR SysOps",
    "Sub-Category":"Agent Keep-Alive",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "EDR SysOps",
    "Sub-Category":"Agent Errors",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"WMI Activity",
    "Sub-Category":"WmiEventConsumerToFilter",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":{"Partially":"SES has a WMI Response Event and a WMI Instance Object, the WMI Response Event describes: unknown, blocked, allowed, no action, logged, command script, uncorrected, delayed, deleted, quarantined, restored, detected"},
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "WMI Activity",
    "Sub-Category":"WmiEventConsumer",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":{"Partially":"SES has a WMI Response Event and a WMI Instance Object, the WMI Response Event describes: unknown, blocked, allowed, no action, logged, command script, uncorrected, delayed, deleted, quarantined, restored, detected"},    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category": "WMI Activity",
    "Sub-Category":"WmiEventFilter",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":{"Partially":"SES has a WMI Response Event and a WMI Instance Object, the WMI Response Event describes: unknown, blocked, allowed, no action, logged, command script, uncorrected, delayed, deleted, quarantined, restored, detected"},
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"BIT JOBS Activity",
    "Sub-Category":"BIT JOBS Activity",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  },
  {
    "Telemetry Feature Category":"PowerShell Activity",
    "Sub-Category":"Script-Block Activity",
    "BitDefender":"",
    "Carbon Black":"",
    "Cortex XDR":"",
    "CrowdStrike":"",
    "Cybereason":"",
    "Cylance":" ",
    "ESET Inspect":"",
    "Elastic":"",
    "FortiEDR":"",
    "Harfanglab":"",
    "LimaCharlie":"",
    "MDE":"",
    "OpenEDR":"",
    "Padvish XDR":"",
    "Qualys":"",
    "SentinelOne":"",
    "Symantec SES Complete":"",
    "Sysmon":"",
    "Trellix":"",
    "Trend Micro":"",
    "Uptycs":"",
    "WatchGuard":""
  }
]