admin/tsale-EDR-Telemetry
1
0
Fork 0
mirror of https://github.com/tsale/EDR-Telemetry synced 2026-06-08 17:58:18 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
b3e969ea891c341254f784493582e638056f3b9c
tsale-EDR-Telemetry/EDR_telem_windows.json
T
Ján TrenčanskýandKostas b3e969ea89 ESET USB Mount/Unmount (#157) 
* ESET USB events+file open

* Update ESET Inspect telemetry description for sensitive file tracking

---------

Co-authored-by: Kostas <kostastsale@gmail.com>
2026-03-23 18:07:46 -07:00

1485 lines
36 KiB
JSON
Raw Blame History

[
{
"Telemetry Feature Category":"Process Activity",
"Sub-Category":"Process Creation",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Yes",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"Yes",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"Yes",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Yes",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Process Termination",
"BitDefender":"Yes",
"Carbon Black":"Partially",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Via EnablingTelemetry",
"Harfanglab":"No",
"LimaCharlie":"Yes",
"MDE":"No",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"No",
"Symantec SES Complete":"Yes",
"Sysmon":"Yes",
"Trellix":"No",
"Trend Micro":"Via EnablingTelemetry",
"Uptycs":"No",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Process Access",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"No",
"ESET Inspect":"Partially",
"Elastic":"Yes",
"FortiEDR":"No",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Partially",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"Yes",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Yes",
"Uptycs":"No",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Image\/Library Loaded",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Via EnablingTelemetry",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"Yes",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Yes",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Remote Thread Creation",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"No",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"No",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"No",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Yes",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Win32 API Telemetry",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Pending Response",
"Cybereason":"Pending Response",
"Cylance":"Yes",
"ESET Inspect":"Partially",
"Elastic":"Yes",
"FortiEDR":"Pending Response",
"Harfanglab":"Pending Response",
"LimaCharlie":"Pending Response",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Partially",
"Qualys":"Pending Response",
"SentinelOne":"Pending Response",
"Symantec SES Complete":"Pending Response",
"Sysmon":"No",
"Trellix":"Pending Response",
"Trend Micro":"Pending Response",
"Uptycs":"Via EnablingTelemetry",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Process Tampering Activity",
"BitDefender":"Yes",
"Carbon Black":"Partially",
"Cortex XDR":"Partially",
"CrowdStrike":"Yes",
"Cybereason":"Pending Response",
"Cylance":"Via EnablingTelemetry",
"ESET Inspect":"No",
"Elastic":"Yes",
"FortiEDR":"No",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"No",
"Qualys":"No",
"SentinelOne":"Yes",
"Symantec SES Complete":"Yes",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Yes",
"Uptycs":"Yes",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Process Call Stacks",
"BitDefender":"No",
"Carbon Black":"No",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"No",
"Cylance":"No",
"ESET Inspect":"No",
"Elastic":"Yes",
"FortiEDR":"No",
"Harfanglab":"Yes",
"LimaCharlie":"No",
"MDE":"No",
"OpenEDR":"No",
"Padvish XDR":"No",
"Qualys":"No",
"SentinelOne":"No",
"Symantec SES Complete":"No",
"Sysmon":"Yes",
"Trellix":"No",
"Trend Micro":"No",
"Uptycs":"No",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":"File Manipulation",
"Sub-Category":"File Creation",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Via EnablingTelemetry",
"ESET Inspect":"Partially",
"Elastic":"Yes",
"FortiEDR":"Yes",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"Yes",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"Yes",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Yes",
"Uptycs":"Yes",
"WatchGuard":"Partially"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"File Opened",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Partially",
"Cybereason":"No",
"Cylance":"Via EnablingTelemetry",
"ESET Inspect":"Partially",
"Elastic":"Yes",
"FortiEDR":"Via EnablingTelemetry",
"Harfanglab":"Yes",
"LimaCharlie":"Partially",
"MDE":"No",
"OpenEDR":"No",
"Padvish XDR":"No",
"Qualys":"Yes",
"SentinelOne":"No",
"Symantec SES Complete":"Yes",
"Sysmon":"No",
"Trellix":"Yes",
"Trend Micro":"Via EnablingTelemetry",
"Uptycs":"Yes",
"WatchGuard":"Partially"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"File Deletion",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Via EnablingTelemetry",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"Yes",
"Padvish XDR":"No",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"Yes",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Via EnablingTelemetry",
"Uptycs":"Yes",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"File Modification",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"No",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Via EnablingTelemetry",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"No",
"SentinelOne":"Yes",
"Symantec SES Complete":"Yes",
"Sysmon":"No",
"Trellix":"Yes",
"Trend Micro":"Yes",
"Uptycs":"Yes",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"File Renaming",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Via EnablingTelemetry",
"Harfanglab":"Yes",
"LimaCharlie":"Partially",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Partially",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"Yes",
"Sysmon":"No",
"Trellix":"Yes",
"Trend Micro":"Yes",
"Uptycs":"Yes",
"WatchGuard":"Partially"
},
{
"Telemetry Feature Category":"User Account Activity",
"Sub-Category":"Local Account Creation",
"BitDefender":"Via EventLogs",
"Carbon Black":"No",
"Cortex XDR":"Via EventLogs",
"CrowdStrike":"Yes",
"Cybereason":"No",
"Cylance":"Via EventLogs",
"ESET Inspect":"Yes",
"Elastic":"Via EventLogs",
"FortiEDR":"Via EventLogs",
"Harfanglab":"Yes",
"LimaCharlie":"Via EventLogs",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Via EventLogs",
"Qualys":"Via EventLogs",
"SentinelOne":"Yes",
"Symantec SES Complete":"No",
"Sysmon":"No",
"Trellix":"Yes",
"Trend Micro":"Via EventLogs",
"Uptycs":"Via EventLogs",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Local Account Modification",
"BitDefender":"Via EventLogs",
"Carbon Black":"No",
"Cortex XDR":"Via EventLogs",
"CrowdStrike":"Partially",
"Cybereason":"No",
"Cylance":"Via EventLogs",
"ESET Inspect":"Yes",
"Elastic":"Via EventLogs",
"FortiEDR":"Via EventLogs",
"Harfanglab":"Yes",
"LimaCharlie":"Via EventLogs",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Via EventLogs",
"Qualys":"Via EventLogs",
"SentinelOne":"Via EventLogs",
"Symantec SES Complete":"No",
"Sysmon":"No",
"Trellix":"Yes",
"Trend Micro":"Via EventLogs",
"Uptycs":"Via EventLogs",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Local Account Deletion",
"BitDefender":"Via EventLogs",
"Carbon Black":"No",
"Cortex XDR":"Via EventLogs",
"CrowdStrike":"Yes",
"Cybereason":"No",
"Cylance":"Via EventLogs",
"ESET Inspect":"Yes",
"Elastic":"Via EventLogs",
"FortiEDR":"Via EventLogs",
"Harfanglab":"Yes",
"LimaCharlie":"Via EventLogs",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Via EventLogs",
"Qualys":"Via EventLogs",
"SentinelOne":"Via EventLogs",
"Symantec SES Complete":"No",
"Sysmon":"No",
"Trellix":"Yes",
"Trend Micro":"Via EnablingTelemetry",
"Uptycs":"Via EventLogs",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Account Login",
"BitDefender":"Yes",
"Carbon Black":"Via EventLogs",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Via EventLogs",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Via EventLogs",
"Harfanglab":"Yes",
"LimaCharlie":"Partially",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Via EventLogs",
"Qualys":"Via EventLogs",
"SentinelOne":"Yes",
"Symantec SES Complete":"Yes",
"Sysmon":"No",
"Trellix":"Yes",
"Trend Micro":"Via EventLogs",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Account Logoff",
"BitDefender":"No",
"Carbon Black":"Via EventLogs",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Via EventLogs",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Via EventLogs",
"Harfanglab":"Yes",
"LimaCharlie":"Via EventLogs",
"MDE":"No",
"OpenEDR":"No",
"Padvish XDR":"Via EventLogs",
"Qualys":"Via EventLogs",
"SentinelOne":"Yes",
"Symantec SES Complete":"Yes",
"Sysmon":"No",
"Trellix":"Yes",
"Trend Micro":"Via EventLogs",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":"Network Activity",
"Sub-Category":"TCP Connection",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Yes",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"Yes",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"Via EnablingTelemetry",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Yes",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"UDP Connection",
"BitDefender":"No",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"No",
"Elastic":"Yes",
"FortiEDR":"Yes",
"Harfanglab":"Via EventLogs",
"LimaCharlie":"Yes",
"MDE":"No",
"OpenEDR":"Yes",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"No",
"Symantec SES Complete":"Via EnablingTelemetry",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Yes",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"URL",
"BitDefender":"No",
"Carbon Black":"No",
"Cortex XDR":"Yes",
"CrowdStrike":"No",
"Cybereason":"No",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Partially",
"FortiEDR":"No",
"Harfanglab":"Yes",
"LimaCharlie":"No",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"Via EnablingTelemetry",
"Symantec SES Complete":"Partially",
"Sysmon":"No",
"Trellix":"Yes",
"Trend Micro":"No",
"Uptycs":"Yes",
"WatchGuard":"Partially"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"DNS Query",
"BitDefender":"No",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Via EnablingTelemetry",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"No",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Yes",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"File Downloaded",
"BitDefender":"Partially",
"Carbon Black":"No",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Partially",
"Cylance":"No",
"ESET Inspect":"Partially",
"Elastic":"No",
"FortiEDR":"No",
"Harfanglab":"Yes",
"LimaCharlie":"Partially",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"No",
"Qualys":"No",
"SentinelOne":"No",
"Symantec SES Complete":"No",
"Sysmon":"No",
"Trellix":"No",
"Trend Micro":"Yes",
"Uptycs":"Partially",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":"Hash Algorithms",
"Sub-Category":"MD5",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Yes",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"Yes",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Yes",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"SHA",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Yes",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"Yes",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"Yes",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Yes",
"Uptycs":"Yes",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"IMPHASH",
"BitDefender":"No",
"Carbon Black":"No",
"Cortex XDR":"No",
"CrowdStrike":"No",
"Cybereason":"No",
"Cylance":"No",
"ESET Inspect":"No",
"Elastic":"Yes",
"FortiEDR":"No",
"Harfanglab":"Yes",
"LimaCharlie":"No",
"MDE":"No",
"OpenEDR":"No",
"Padvish XDR":"No",
"Qualys":"No",
"SentinelOne":"No",
"Symantec SES Complete":"No",
"Sysmon":"Yes",
"Trellix":"No",
"Trend Micro":"No",
"Uptycs":"No",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"JA3\/JA3s",
"BitDefender":"No",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"No",
"Cybereason":"No",
"Cylance":"No",
"ESET Inspect":"No",
"Elastic":"No",
"FortiEDR":"No",
"Harfanglab":"Yes",
"LimaCharlie":"No",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"No",
"Qualys":"No",
"SentinelOne":"No",
"Symantec SES Complete":"No",
"Sysmon":"No",
"Trellix":"No",
"Trend Micro":"No",
"Uptycs":"Yes",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":"Registry Activity",
"Sub-Category":"Key\/Value Creation",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Partially",
"Cybereason":"Partially",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Via EnablingTelemetry",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"Yes",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"Yes",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Yes",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Key\/Value Modification",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Partially",
"Cybereason":"Partially",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Via EnablingTelemetry",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"No",
"SentinelOne":"Yes",
"Symantec SES Complete":"Yes",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Yes",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Key\/Value Deletion",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"No",
"Cybereason":"Partially",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Via EnablingTelemetry",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"Yes",
"Padvish XDR":"No",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"Yes",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Yes",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":"Schedule Task Activity",
"Sub-Category":"Scheduled Task Creation",
"BitDefender":"Via EventLogs",
"Carbon Black":"No",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Via EventLogs",
"ESET Inspect":"Yes",
"Elastic":"Via EventLogs",
"FortiEDR":"Via EventLogs",
"Harfanglab":"Yes",
"LimaCharlie":"Via EventLogs",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"Via EventLogs",
"SentinelOne":"Yes",
"Symantec SES Complete":"No",
"Sysmon":"No",
"Trellix":"No",
"Trend Micro":"Via EventLogs",
"Uptycs":"Yes",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Scheduled Task Modification",
"BitDefender":"Via EventLogs",
"Carbon Black":"No",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Via EventLogs",
"ESET Inspect":"No",
"Elastic":"Via EventLogs",
"FortiEDR":"Via EventLogs",
"Harfanglab":"Yes",
"LimaCharlie":"Via EventLogs",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Via EventLogs",
"Qualys":"Via EventLogs",
"SentinelOne":"Yes",
"Symantec SES Complete":"No",
"Sysmon":"No",
"Trellix":"Yes",
"Trend Micro":"Via EventLogs",
"Uptycs":"Via EventLogs",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Scheduled Task Deletion",
"BitDefender":"Via EventLogs",
"Carbon Black":"No",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"No",
"Cylance":"Via EventLogs",
"ESET Inspect":"No",
"Elastic":"Via EventLogs",
"FortiEDR":"Via EventLogs",
"Harfanglab":"Yes",
"LimaCharlie":"Via EventLogs",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Via EventLogs",
"Qualys":"Via EventLogs",
"SentinelOne":"Yes",
"Symantec SES Complete":"No",
"Sysmon":"No",
"Trellix":"No",
"Trend Micro":"Via EventLogs",
"Uptycs":"Via EventLogs",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":"Service Activity",
"Sub-Category":"Service Creation",
"BitDefender":"Partially",
"Carbon Black":"Partially",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"No",
"ESET Inspect":"Yes",
"Elastic":"Via EventLogs",
"FortiEDR":"Via EventLogs",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"No",
"Sysmon":"No",
"Trellix":"No",
"Trend Micro":"Via EventLogs",
"Uptycs":"Yes",
"WatchGuard":"Partially"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Service Modification",
"BitDefender":"Via EventLogs",
"Carbon Black":"No",
"Cortex XDR":"Yes",
"CrowdStrike":"Partially",
"Cybereason":"No",
"Cylance":"No",
"ESET Inspect":"No",
"Elastic":"Via EventLogs",
"FortiEDR":"Via EventLogs",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"No",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"Via EnablingTelemetry",
"Symantec SES Complete":"No",
"Sysmon":"No",
"Trellix":"Yes",
"Trend Micro":"Via EventLogs",
"Uptycs":"Yes",
"WatchGuard":"Partially"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Service Deletion",
"BitDefender":"No",
"Carbon Black":"No",
"Cortex XDR":"Yes",
"CrowdStrike":"No",
"Cybereason":"No",
"Cylance":"No",
"ESET Inspect":"No",
"Elastic":"Via EventLogs",
"FortiEDR":"Via EventLogs",
"Harfanglab":"No",
"LimaCharlie":"Pending Response",
"MDE":"No",
"OpenEDR":"No",
"Padvish XDR":"No",
"Qualys":"No",
"SentinelOne":"No",
"Symantec SES Complete":"No",
"Sysmon":"No",
"Trellix":"No",
"Trend Micro":"Via EventLogs",
"Uptycs":"Yes",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":"Driver\/Module Activity",
"Sub-Category":"Driver Loaded",
"BitDefender":"No",
"Carbon Black":"No",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"No",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Via EnablingTelemetry",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"No",
"Sysmon":"Yes",
"Trellix":"No",
"Trend Micro":"Via EnablingTelemetry",
"Uptycs":"Via EventLogs",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Driver Modification",
"BitDefender":"No",
"Carbon Black":"No",
"Cortex XDR":"No",
"CrowdStrike":"Yes",
"Cybereason":"No",
"Cylance":"No",
"ESET Inspect":"No",
"Elastic":"No",
"FortiEDR":"No",
"Harfanglab":"No",
"LimaCharlie":"Yes",
"MDE":"No",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"No",
"Symantec SES Complete":"No",
"Sysmon":"No",
"Trellix":"No",
"Trend Micro":"No",
"Uptycs":"Yes",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Driver Unloaded",
"BitDefender":"No",
"Carbon Black":"No",
"Cortex XDR":"No",
"CrowdStrike":"No",
"Cybereason":"No",
"Cylance":"No",
"ESET Inspect":"No",
"Elastic":"No",
"FortiEDR":"No",
"Harfanglab":"No",
"LimaCharlie":"No",
"MDE":"No",
"OpenEDR":"No",
"Padvish XDR":"No",
"Qualys":"No",
"SentinelOne":"Partially",
"Symantec SES Complete":"No",
"Sysmon":"No",
"Trellix":"No",
"Trend Micro":"No",
"Uptycs":"Via EventLogs",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":"Device Operations",
"Sub-Category":"Virtual Disk Mount",
"BitDefender":"No",
"Carbon Black":"No",
"Cortex XDR":"Partially",
"CrowdStrike":"Yes",
"Cybereason":"No",
"Cylance":"No",
"ESET Inspect":"Yes",
"Elastic":"No",
"FortiEDR":"No",
"Harfanglab":"No",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"No",
"SentinelOne":"No",
"Symantec SES Complete":"No",
"Sysmon":"No",
"Trellix":"No",
"Trend Micro":"No",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"USB Device Unmount",
"BitDefender":"No",
"Carbon Black":"No",
"Cortex XDR":"Partially",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"No",
"ESET Inspect":"Yes",
"Elastic":"No",
"FortiEDR":"No",
"Harfanglab":"Partially",
"LimaCharlie":"Partially",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"No",
"SentinelOne":"Via EnablingTelemetry",
"Symantec SES Complete":"Via EnablingTelemetry",
"Sysmon":"No",
"Trellix":"No",
"Trend Micro":"No",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"USB Device Mount",
"BitDefender":"No",
"Carbon Black":"Partially",
"Cortex XDR":"Partially",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"No",
"ESET Inspect":"Yes",
"Elastic":"No",
"FortiEDR":"No",
"Harfanglab":"Partially",
"LimaCharlie":"Partially",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"No",
"SentinelOne":"Via EnablingTelemetry",
"Symantec SES Complete":"Via EnablingTelemetry",
"Sysmon":"No",
"Trellix":"No",
"Trend Micro":"No",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":"Other Relevant Events",
"Sub-Category":"Group Policy Modification",
"BitDefender":"No",
"Carbon Black":"No",
"Cortex XDR":"Via EventLogs",
"CrowdStrike":"No",
"Cybereason":"No",
"Cylance":"No",
"ESET Inspect":"No",
"Elastic":"No",
"FortiEDR":"No",
"Harfanglab":"No",
"LimaCharlie":"No",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"No",
"Qualys":"No",
"SentinelOne":"Yes",
"Symantec SES Complete":"No",
"Sysmon":"No",
"Trellix":"No",
"Trend Micro":"No",
"Uptycs":"Via EventLogs",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Volume Shadow Copy Deletion",
"BitDefender":"Yes",
"Carbon Black":"No",
"Cortex XDR":"No",
"CrowdStrike":"Yes",
"Cybereason":"Pending Response",
"Cylance":"Pending Response",
"ESET Inspect":"Yes",
"Elastic":"Pending Response",
"FortiEDR":"Pending Response",
"Harfanglab":"Pending Response",
"LimaCharlie":"No",
"MDE":"No",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"No",
"SentinelOne":"Yes",
"Symantec SES Complete":"Pending Response",
"Sysmon":"No",
"Trellix":"Pending Response",
"Trend Micro":"Pending Response",
"Uptycs":"No",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":"Named Pipe Activity",
"Sub-Category":"Pipe Creation",
"BitDefender":"Yes",
"Carbon Black":"Partially",
"Cortex XDR":"No",
"CrowdStrike":"Yes",
"Cybereason":"No",
"Cylance":"No",
"ESET Inspect":"Yes",
"Elastic":"No",
"FortiEDR":"No",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"No",
"Qualys":"No",
"SentinelOne":"Via EnablingTelemetry",
"Symantec SES Complete":"No",
"Sysmon":"Yes",
"Trellix":"No",
"Trend Micro":"Via EnablingTelemetry",
"Uptycs":"Yes",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Pipe Connection",
"BitDefender":"Yes",
"Carbon Black":"No",
"Cortex XDR":"No",
"CrowdStrike":"Yes",
"Cybereason":"No",
"Cylance":"No",
"ESET Inspect":"No",
"Elastic":"No",
"FortiEDR":"No",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"No",
"Qualys":"No",
"SentinelOne":"Via EnablingTelemetry",
"Symantec SES Complete":"No",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Via EnablingTelemetry",
"Uptycs":"No",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":"EDR SysOps",
"Sub-Category":"Agent Start",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"No",
"Elastic":"Yes",
"FortiEDR":"Yes",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"Yes",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"Via EnablingTelemetry",
"Sysmon":"Yes",
"Trellix":"Pending Response",
"Trend Micro":"No",
"Uptycs":"Yes",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Agent Stop",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"No",
"Elastic":"Yes",
"FortiEDR":"No",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Via EventLogs",
"OpenEDR":"Yes",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"Via EnablingTelemetry",
"Sysmon":"Yes",
"Trellix":"Pending Response",
"Trend Micro":"No",
"Uptycs":"Yes",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Agent Install",
"BitDefender":"No",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"No",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"No",
"FortiEDR":"Yes",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Via EventLogs",
"OpenEDR":"Yes",
"Padvish XDR":"Via EventLogs",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"Via EnablingTelemetry",
"Sysmon":"No",
"Trellix":"Yes",
"Trend Micro":"No",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Agent Uninstall",
"BitDefender":"No",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Yes",
"Harfanglab":"No",
"LimaCharlie":"No",
"MDE":"No",
"OpenEDR":"No",
"Padvish XDR":"Via EventLogs",
"Qualys":"No",
"SentinelOne":"Yes",
"Symantec SES Complete":"Via EnablingTelemetry",
"Sysmon":"No",
"Trellix":"Yes",
"Trend Micro":"No",
"Uptycs":"No",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Agent Keep-Alive",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"No",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Via EventLogs",
"OpenEDR":"Yes",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"Via EnablingTelemetry",
"Sysmon":"No",
"Trellix":"Pending Response",
"Trend Micro":"No",
"Uptycs":"Yes",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Agent Errors",
"BitDefender":"Yes",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"No",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Yes",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"OpenEDR":"Yes",
"Padvish XDR":"No",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"Via EnablingTelemetry",
"Sysmon":"Yes",
"Trellix":"Pending Response",
"Trend Micro":"No",
"Uptycs":"Yes",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":"WMI Activity",
"Sub-Category":"WmiEventConsumerToFilter",
"BitDefender":"Yes",
"Carbon Black":"No",
"Cortex XDR":"Via EnablingTelemetry",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Via EventLogs",
"Harfanglab":"Yes",
"LimaCharlie":"No",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"Via EventLogs",
"SentinelOne":"Yes",
"Symantec SES Complete":"Partially",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Via EventLogs",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"WmiEventConsumer",
"BitDefender":"No",
"Carbon Black":"No",
"Cortex XDR":"Via EnablingTelemetry",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Via EventLogs",
"Harfanglab":"Yes",
"LimaCharlie":"No",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"Via EventLogs",
"SentinelOne":"Yes",
"Symantec SES Complete":"Partially",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Via EventLogs",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"WmiEventFilter",
"BitDefender":"No",
"Carbon Black":"No",
"Cortex XDR":"Via EnablingTelemetry",
"CrowdStrike":"Yes",
"Cybereason":"Yes",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"FortiEDR":"Via EventLogs",
"Harfanglab":"Yes",
"LimaCharlie":"No",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"Via EventLogs",
"SentinelOne":"Yes",
"Symantec SES Complete":"Partially",
"Sysmon":"Yes",
"Trellix":"Yes",
"Trend Micro":"Via EventLogs",
"Uptycs":"Yes",
"WatchGuard":"Yes"
},
{
"Telemetry Feature Category":"BIT JOBS Activity",
"Sub-Category":"BIT JOBS Activity",
"BitDefender":"Yes",
"Carbon Black":"No",
"Cortex XDR":"Via EnablingTelemetry",
"CrowdStrike":"Yes",
"Cybereason":"No",
"Cylance":"No",
"ESET Inspect":"Yes",
"Elastic":"No",
"FortiEDR":"Via EventLogs",
"Harfanglab":"No",
"LimaCharlie":"No",
"MDE":"No",
"OpenEDR":"No",
"Padvish XDR":"Via EventLogs",
"Qualys":"Yes",
"SentinelOne":"Via EventLogs",
"Symantec SES Complete":"No",
"Sysmon":"No",
"Trellix":"Yes",
"Trend Micro":"Via EventLogs",
"Uptycs":"No",
"WatchGuard":"No"
},
{
"Telemetry Feature Category":"PowerShell Activity",
"Sub-Category":"Script-Block Activity",
"BitDefender":"No",
"Carbon Black":"Yes",
"Cortex XDR":"Yes",
"CrowdStrike":"Yes",
"Cybereason":"No",
"Cylance":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Via EventLogs",
"FortiEDR":"Via EventLogs",
"Harfanglab":"Yes",
"LimaCharlie":"Via EventLogs",
"MDE":"Yes",
"OpenEDR":"No",
"Padvish XDR":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Symantec SES Complete":"Yes",
"Sysmon":"No",
"Trellix":"Yes",
"Trend Micro":"Yes",
"Uptycs":"Yes",
"WatchGuard":"No"
}
]
Reference in New Issue View Git Blame Copy Permalink