admin/tsale-EDR-Telemetry
1
0
Fork 0
mirror of https://github.com/tsale/EDR-Telemetry synced 2026-06-08 17:58:18 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
0.2
tsale-EDR-Telemetry/EDR_telem_linux.json
T

512 lines
11 KiB
JSON
Raw Permalink Blame History

[
{
"Telemetry Feature Category":"Process Activity",
"Sub-Category":"Process Creation",
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Sysmon":"Yes",
"Uptycs":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Process Termination",
"Auditd":"No",
"BitDefender":"Yes",
"Carbon Black Cloud":"No",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"Harfanglab":"No",
"LimaCharlie":"Yes",
"MDE":"No",
"Qualys":"Yes",
"SentinelOne":"No",
"Sysmon":"Yes",
"Uptycs":"Yes"
},
{
"Telemetry Feature Category":"File Manipulation",
"Sub-Category":"File Creation",
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"Harfanglab":"No",
"LimaCharlie":"Yes",
"MDE":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Sysmon":"Yes",
"Uptycs":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"File Modification",
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Partially",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Sysmon":"No",
"Uptycs":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"File Deletion",
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"CrowdStrike":"No",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Sysmon":"Yes",
"Uptycs":"Yes"
},
{
"Telemetry Feature Category":"User Activity",
"Sub-Category":"User Logon",
"Auditd":"No",
"BitDefender":"Yes",
"Carbon Black Cloud":"No",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"Yes",
"LimaCharlie":"No",
"MDE":"Yes",
"Qualys":"No",
"SentinelOne":"Yes",
"Sysmon":"No",
"Uptycs":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"User Logoff",
"Auditd":"No",
"BitDefender":"Yes",
"Carbon Black Cloud":"No",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"No",
"LimaCharlie":"No",
"MDE":"No",
"Qualys":"No",
"SentinelOne":"No",
"Sysmon":"No",
"Uptycs":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Logon Failed",
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"Yes",
"LimaCharlie":"No",
"MDE":"Yes",
"Qualys":"No",
"SentinelOne":"Yes",
"Sysmon":"No",
"Uptycs":"Yes"
},
{
"Telemetry Feature Category":"Script Activity",
"Sub-Category":"Script Content",
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"No",
"LimaCharlie":"No",
"MDE":"Yes",
"Qualys":"No",
"SentinelOne":"No",
"Sysmon":"No",
"Uptycs":"No"
},
{
"Telemetry Feature Category":"Network Activity",
"Sub-Category":"Network Connection",
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Sysmon":"Yes",
"Uptycs":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Network Socket Listen",
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"No",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"Yes",
"Harfanglab":"Yes",
"LimaCharlie":"Partially",
"MDE":"Yes",
"Qualys":"Partially",
"SentinelOne":"No",
"Sysmon":"No",
"Uptycs":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"DNS Query",
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"No",
"Qualys":"Via EnablingTelemetry",
"SentinelOne":"Yes",
"Sysmon":"No",
"Uptycs":"Yes"
},
{
"Telemetry Feature Category":"Scheduled Task Activity",
"Sub-Category":"Scheduled Task",
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"CrowdStrike":"No",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"No",
"LimaCharlie":"No",
"MDE":"No",
"Qualys":"No",
"SentinelOne":"Yes",
"Sysmon":"No",
"Uptycs":"No"
},
{
"Telemetry Feature Category":"User Account Activity",
"Sub-Category":"User Account Created",
"Auditd":"No",
"BitDefender":"Yes",
"Carbon Black Cloud":"No",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"No",
"LimaCharlie":"No",
"MDE":"No",
"Qualys":"No",
"SentinelOne":"Yes",
"Sysmon":"No",
"Uptycs":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"User Account Modified",
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"CrowdStrike":"No",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"No",
"LimaCharlie":"No",
"MDE":"No",
"Qualys":"No",
"SentinelOne":"No",
"Sysmon":"No",
"Uptycs":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"User Account Deleted",
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"No",
"LimaCharlie":"No",
"MDE":"No",
"Qualys":"No",
"SentinelOne":"Yes",
"Sysmon":"No",
"Uptycs":"No"
},
{
"Telemetry Feature Category":"Driver\/Module Activity",
"Sub-Category":"Driver Load",
"Auditd":"Yes",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"No",
"Harfanglab":"No",
"LimaCharlie":"No",
"MDE":"Via EnablingTelemetry",
"Qualys":"No",
"SentinelOne":"No",
"Sysmon":"No",
"Uptycs":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Image Load",
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"No",
"CrowdStrike":"No",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"No",
"LimaCharlie":"No",
"MDE":"No",
"Qualys":"No",
"SentinelOne":"No",
"Sysmon":"No",
"Uptycs":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"eBPF Event",
"Auditd":"Yes",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"No",
"LimaCharlie":"No",
"MDE":"Via EnablingTelemetry",
"Qualys":"No",
"SentinelOne":"No",
"Sysmon":"No",
"Uptycs":"Via EnablingTelemetry"
},
{
"Telemetry Feature Category":"Access Activity",
"Sub-Category":"Raw Access Read",
"Auditd":"Yes",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"CrowdStrike":"No",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"No",
"LimaCharlie":"No",
"MDE":"No",
"Qualys":"No",
"SentinelOne":"No",
"Sysmon":"Yes",
"Uptycs":"Via EnablingTelemetry"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Process Access",
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"No",
"CrowdStrike":"No",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"No",
"LimaCharlie":"No",
"MDE":"No",
"Qualys":"No",
"SentinelOne":"No",
"Sysmon":"No",
"Uptycs":"Via EnablingTelemetry"
},
{
"Telemetry Feature Category":"Process Tampering Activity",
"Sub-Category":"Process Tampering",
"Auditd":"Yes",
"BitDefender":"Yes",
"Carbon Black Cloud":"No",
"CrowdStrike":"No",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"No",
"LimaCharlie":"No",
"MDE":"No",
"Qualys":"No",
"SentinelOne":"Yes",
"Sysmon":"No",
"Uptycs":"Via EnablingTelemetry"
},
{
"Telemetry Feature Category":"Service Activity",
"Sub-Category":"Service Creation",
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"CrowdStrike":"Partially",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"No",
"LimaCharlie":"Yes",
"MDE":"Partially",
"Qualys":"No",
"SentinelOne":"Yes",
"Sysmon":"No",
"Uptycs":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Service Modification",
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"CrowdStrike":"Partially",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"No",
"LimaCharlie":"Yes",
"MDE":"No",
"Qualys":"No",
"SentinelOne":"Yes",
"Sysmon":"Yes",
"Uptycs":"No"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Service Deletion",
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"CrowdStrike":"No",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"No",
"LimaCharlie":"No",
"MDE":"No",
"Qualys":"No",
"SentinelOne":"No",
"Sysmon":"No",
"Uptycs":"No"
},
{
"Telemetry Feature Category":"EDR SysOps",
"Sub-Category":"Agent Start",
"Auditd":"No",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"No",
"Elastic":"Yes",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Sysmon":"No",
"Uptycs":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Agent Stop",
"Auditd":"No",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"Harfanglab":"No",
"LimaCharlie":"Yes",
"MDE":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Sysmon":"No",
"Uptycs":"Yes"
},
{
"Telemetry Feature Category":"Hash Algorithms",
"Sub-Category":"MD5",
"Auditd":"No",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"Qualys":"Yes",
"SentinelOne":"No",
"Sysmon":"Yes",
"Uptycs":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"SHA",
"Auditd":"No",
"BitDefender":"Yes",
"Carbon Black Cloud":"Yes",
"CrowdStrike":"Yes",
"ESET Inspect":"Yes",
"Elastic":"Yes",
"Harfanglab":"Yes",
"LimaCharlie":"Yes",
"MDE":"Yes",
"Qualys":"Yes",
"SentinelOne":"Yes",
"Sysmon":"Yes",
"Uptycs":"Yes"
},
{
"Telemetry Feature Category":null,
"Sub-Category":"Fuzzy Hash",
"Auditd":"No",
"BitDefender":"No",
"Carbon Black Cloud":"No",
"CrowdStrike":"No",
"ESET Inspect":"No",
"Elastic":"No",
"Harfanglab":"No",
"LimaCharlie":"Yes",
"MDE":"No",
"Qualys":"No",
"SentinelOne":"No",
"Sysmon":"Yes",
"Uptycs":"No"
}
]
Reference in New Issue View Git Blame Copy Permalink