admin/tsale-EDR-Telemetry
1
0
Fork 0
mirror of https://github.com/tsale/EDR-Telemetry synced 2026-06-08 17:58:18 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
main
tsale-EDR-Telemetry/partially_value_explanations_windows.json
T
Ján Trenčanský b3e969ea89 ESET USB Mount/Unmount (#157) 
* ESET USB events+file open

* Update ESET Inspect telemetry description for sensitive file tracking

---------

Co-authored-by: Kostas <kostastsale@gmail.com>
2026-03-23 18:07:46 -07:00

1471 lines
35 KiB
JSON
Raw Permalink Blame History

[
{
"Telemetry Feature Category":"Process Activity",
"Sub-Category":"Process Creation",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Process Activity",
"Sub-Category":"Process Termination",
"BitDefender":"",
"Carbon Black": {"Partially":"Only observed as file operations."},
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Process Activity",
"Sub-Category":"Process Access",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":{"Partially":"Only for LSASS.exe process"},
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":{"Partially":"Only for LSASS.exe process"},
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "Process Activity",
"Sub-Category":"Image\/Library Loaded",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Process Activity",
"Sub-Category":"Remote Thread Creation",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "Process Activity",
"Sub-Category":"Win32 API Telemetry",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":{"Partially":"Only for a limited set of APIs as documented in: https://github.com/tsale/EDR-Telemetry/pull/130#issuecomment-3266387350"},
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":{"Partially":"Only for a limited set of APIs (e.g., SetWindowsHookEx, GetAsyncKeyState, etc.)"},
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "Process Activity",
"Sub-Category":"Process Tampering Activity",
"BitDefender":"",
"Carbon Black":{"Partially":"Only via cross-process."},
"Cortex XDR":{"Partially":"Needs the tamper protection enabled."},
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Qualys":"",
"SentinelOne":{"Partially":"Only provides cross process info like remote thread creation and process handles, it doesn't give much more detail beyond that."},
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "Process Activity",
"Sub-Category":"Process Call Stacks",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike": "",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"File Manipulation",
"Sub-Category":"File Creation",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":{"Partially":"Only for binaries created on disk."},
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":{"Partially":"Only tracks via dedicated event the renaming of Portable Executables (PE) and compressed files."}
},
{
"Telemetry Feature Category": "File Manipulation",
"Sub-Category":"File Opened",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":{"Partially":"Only file related events that is deems suspicious based on some proprietary criterias."},
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":{"Partially":"Generated only on specific files that may contain sensitive information such as browser related databases, credential storages etc."},
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":{"Partially":"Visibility on File Read only"},
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":{"Partially":"Only tracks via dedicated event the opening of compressed files."}
},
{
"Telemetry Feature Category": "File Manipulation",
"Sub-Category":"File Deletion",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "File Manipulation",
"Sub-Category":"File Modification",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "File Manipulation",
"Sub-Category":"File Renaming",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":{"Partially":"Events are reported as a delete+write."},
"MDE":"",
"OpenEDR":"",
"Padvish XDR": {"Partially":"Tracked as file modification event."},
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard": {"Partially":"Only tracks via dedicated event the renaming of Portable Executables (PE) and compressed files."}
},
{
"Telemetry Feature Category":"User Account Activity",
"Sub-Category":"Local Account Creation",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "User Account Activity",
"Sub-Category":"Local Account Modification",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":{"Partially":"Only contains modification from a user added to a group."},
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "User Account Activity",
"Sub-Category":"Local Account Deletion",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "User Account Activity",
"Sub-Category":"Account Login",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":{"Partially":"Only tracks when user is seen first time per endpoint."},
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "User Account Activity",
"Sub-Category":"Account Logoff",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Network Activity",
"Sub-Category":"TCP Connection",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Network Activity",
"Sub-Category":"UDP Connection",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "Network Activity",
"Sub-Category":"URL",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":{"Partially":"Only if activity is generated by a NON-Browser application."},
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":{"Partially":"Depends on Firewall / IPS settings / policy; if only IPS is enabled URL will just logged malicious connections, but not clean connections"},
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":{"Partially":"Mainly when the URL is fetched via HTTP/S GET and not from a modern browser."}
},
{
"Telemetry Feature Category": "Network Activity",
"Sub-Category":"DNS Query",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Network Activity",
"Sub-Category":"File Downloaded",
"BitDefender":{"Partially":"Only tracks downloads of executables."},
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":{"Partially":"Only for documents and binaries."},
"Cylance":" ",
"ESET Inspect":{"Partially":"Only for binaries created on disk."},
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":{"Partially":"Only if the activity is generated via Chrome browser[https://doc.limacharlie.io/docs/documentation/0b189c00533e5-reference-events#http_request]"},
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":{"Partially":"Limited to certain processes."},
"WatchGuard":""
},
{
"Telemetry Feature Category":"Hash Algorithms",
"Sub-Category":"MD5",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Hash Algorithms",
"Sub-Category":"SHA",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Hash Algorithms",
"Sub-Category":"IMPHASH",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Hash Algorithms",
"Sub-Category":"JA3/JA3s",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Registry Activity",
"Sub-Category":"Key\/Value Creation",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":{"Partially":"Tracks only only specific keys (ASEP = 'AutoStarting Entry Point')."},
"Cybereason":{"Partially":"By default, only RUN keys and some registry values that are commonly abused."},
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Registry Activity",
"Sub-Category":"Key\/Value Modification",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":{"Partially":"Tracks only only specific keys (ASEP = 'AutoStarting Entry Point')."},
"Cybereason":{"Partially":"By default, only RUN keys and some registry values that are commonly abused."},
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Registry Activity",
"Sub-Category":"Key\/Value Deletion",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":{"Partially":"By default, only RUN keys and some registry values that are commonly abused."},
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Schedule Task Activity",
"Sub-Category":"Scheduled Task Creation",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Schedule Task Activity",
"Sub-Category":"Scheduled Task Modification",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Schedule Task Activity",
"Sub-Category":"Scheduled Task Deletion",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Service Activity",
"Sub-Category":"Service Creation",
"BitDefender": {"Partially": "Service creation telemetry was not consistent across different types of testing, with some methods being captured where others were not."},
"Carbon Black":{"Partially":"Via monitoring the registry changes."},
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":{"Partially":"The dedicated event tracking service activity only tracks parent/child processes related to a service change, no further details."}
},
{
"Telemetry Feature Category":"Service Activity",
"Sub-Category":"Service Modification",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":{"Partially":"Tracks only modification of service binaries."},
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":{"Partially":"The dedicated event tracking service activity only tracks parent/child processes related to a service change, no further details."}
},
{
"Telemetry Feature Category":"Service Activity",
"Sub-Category":"Service Deletion",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Featurere Category":"Driver\/Module Activity",
"Sub-Category":"Driver Loaded",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Driver\/Module Activity",
"Sub-Category":"Driver Modification",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "Driver\/Module Activity",
"Sub-Category":"Driver Unloaded",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Qualys":"",
"SentinelOne":{"Partially":"It only shows a specific driver unload method use by attacker instead of every unloaded drivers"}, "Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Device Operations",
"Sub-Category":"Virtual Disk Mount",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":{"Partially":"Device Control should be in block mode"},
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Device Operations",
"Sub-Category":"USB Device Unmount",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":{"Partially":"Device Control should be in block mode"},
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":{"Partially":"Only applicable for removable drives, no HID devices."},
"LimaCharlie":{"Partially":"Only mount/unmount events related to 'Volumes'. No other device visibility on this."},
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Device Operations",
"Sub-Category":"USB Device Mount",
"BitDefender":"",
"Carbon Black":{"Partially":"Mounted USBs are recorded in a separate table within the platform for administrative approval."},
"Cortex XDR":{"Partially":"Device Control should be in block mode"},
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":{"Partially":"Only applicable for removable drives, no HID devices."},
"LimaCharlie":{"Partially":"Only mount/unmount events related to 'Volumes'. No other device visibility on this."},
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Other Relevant Events",
"Sub-Category":"Group Policy Modification",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Other Relevant Events",
"Sub-Category":"Volume Shadow Copy Deletion",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Named Pipe Activity",
"Sub-Category":"Pipe Creation",
"BitDefender":"",
"Carbon Black":{"Partially":"Reports only named pipes for file creation events."},
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"Named Pipe Activity",
"Sub-Category":"Pipe Connection",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"EDR SysOps",
"Sub-Category":"Agent Start",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "EDR SysOps",
"Sub-Category":"Agent Stop",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "EDR SysOps",
"Sub-Category":"Agent Install",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "EDR SysOps",
"Sub-Category":"Agent Uninstall",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "EDR SysOps",
"Sub-Category":"Agent Keep-Alive",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "EDR SysOps",
"Sub-Category":"Agent Errors",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"WMI Activity",
"Sub-Category":"WmiEventConsumerToFilter",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":{"Partially":"SES has a WMI Response Event and a WMI Instance Object, the WMI Response Event describes: unknown, blocked, allowed, no action, logged, command script, uncorrected, delayed, deleted, quarantined, restored, detected"},
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "WMI Activity",
"Sub-Category":"WmiEventConsumer",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":{"Partially":"SES has a WMI Response Event and a WMI Instance Object, the WMI Response Event describes: unknown, blocked, allowed, no action, logged, command script, uncorrected, delayed, deleted, quarantined, restored, detected"}, "Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category": "WMI Activity",
"Sub-Category":"WmiEventFilter",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":{"Partially":"SES has a WMI Response Event and a WMI Instance Object, the WMI Response Event describes: unknown, blocked, allowed, no action, logged, command script, uncorrected, delayed, deleted, quarantined, restored, detected"},
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"BIT JOBS Activity",
"Sub-Category":"BIT JOBS Activity",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
},
{
"Telemetry Feature Category":"PowerShell Activity",
"Sub-Category":"Script-Block Activity",
"BitDefender":"",
"Carbon Black":"",
"Cortex XDR":"",
"CrowdStrike":"",
"Cybereason":"",
"Cylance":" ",
"ESET Inspect":"",
"Elastic":"",
"FortiEDR":"",
"Harfanglab":"",
"LimaCharlie":"",
"MDE":"",
"OpenEDR":"",
"Padvish XDR":"",
"Qualys":"",
"SentinelOne":"",
"Symantec SES Complete":"",
"Sysmon":"",
"Trellix":"",
"Trend Micro":"",
"Uptycs":"",
"WatchGuard":""
}
]
Reference in New Issue View Git Blame Copy Permalink