EDR_telem_linux.json

[
  {
    "Telemetry Feature Category":"Process Activity",
    "Sub-Category":"Process Creation",
    "Auditd":"Yes",
    "Carbon Black Cloud":"Yes",
    "CrowdStrike":"Yes",
    "ESET Inspect":"Yes",
    "Elastic":"Yes",
    "LimaCharlie":"Yes",
    "MDE":"Yes",
    "Qualys":"Yes",
    "SentinelOne":"Yes",
    "Sysmon":"Yes",
    "Uptycs":"Yes"
  },
  {
    "Telemetry Feature Category":null,
    "Sub-Category":"Process Termination",
    "Auditd":"No",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"Yes",
    "ESET Inspect":"Yes",
    "Elastic":"Yes",
    "LimaCharlie":"Yes",
    "MDE":"No",
    "Qualys":"Yes",
    "SentinelOne":"No",
    "Sysmon":"Yes",
    "Uptycs":"Yes"
  },
  {
    "Telemetry Feature Category":"File Manipulation",
    "Sub-Category":"File Creation",
    "Auditd":"Yes",
    "Carbon Black Cloud":"Yes",
    "CrowdStrike":"Yes",
    "ESET Inspect":"Yes",
    "Elastic":"Yes",
    "LimaCharlie":"No",
    "MDE":"Yes",
    "Qualys":"Yes",
    "SentinelOne":"Yes",
    "Sysmon":"Yes",
    "Uptycs":"Yes"
  },
  {
    "Telemetry Feature Category":null,
    "Sub-Category":"File Modification",
    "Auditd":"Yes",
    "Carbon Black Cloud":"Yes",
    "CrowdStrike":"Yes",
    "ESET Inspect":"Yes",
    "Elastic":"Yes",
    "LimaCharlie":"No",
    "MDE":"No",
    "Qualys":"Yes",
    "SentinelOne":"Yes",
    "Sysmon":"No",
    "Uptycs":"Yes"
  },
  {
    "Telemetry Feature Category":null,
    "Sub-Category":"File Deletion",
    "Auditd":"Yes",
    "Carbon Black Cloud":"Yes",
    "CrowdStrike":"No",
    "ESET Inspect":"Yes",
    "Elastic":"Yes",
    "LimaCharlie":"No",
    "MDE":"Yes",
    "Qualys":"Yes",
    "SentinelOne":"Yes",
    "Sysmon":"Yes",
    "Uptycs":"Yes"
  },
  {
    "Telemetry Feature Category":"User Activity",
    "Sub-Category":"User Logon",
    "Auditd":"No",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"Yes",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"Yes",
    "Qualys":"No",
    "SentinelOne":"Yes",
    "Sysmon":"No",
    "Uptycs":"Yes"
  },
  {
    "Telemetry Feature Category":null,
    "Sub-Category":"User Logoff",
    "Auditd":"No",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"Yes",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"No",
    "Qualys":"No",
    "SentinelOne":"No",
    "Sysmon":"No",
    "Uptycs":"Yes"
  },
  {
    "Telemetry Feature Category":null,
    "Sub-Category":"Logon Failed",
    "Auditd":"No",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"Yes",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"Yes",
    "Qualys":"No",
    "SentinelOne":"Yes",
    "Sysmon":"No",
    "Uptycs":"Yes"
  },
  {
    "Telemetry Feature Category":"Script Activity",
    "Sub-Category":"Script Content",
    "Auditd":"No",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"Yes",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"Yes",
    "Qualys":"No",
    "SentinelOne":"No",
    "Sysmon":"No",
    "Uptycs":"No"
  },
  {
    "Telemetry Feature Category":"Network Activity",
    "Sub-Category":"Network Connection",
    "Auditd":"Yes",
    "Carbon Black Cloud":"Yes",
    "CrowdStrike":"Yes",
    "ESET Inspect":"Yes",
    "Elastic":"Yes",
    "LimaCharlie":"Yes",
    "MDE":"Yes",
    "Qualys":"Yes",
    "SentinelOne":"Yes",
    "Sysmon":"Yes",
    "Uptycs":"Yes"
  },
  {
    "Telemetry Feature Category":null,
    "Sub-Category":"Network Socket Listen",
    "Auditd":"Yes",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"Yes",
    "ESET Inspect":"No",
    "Elastic":"Yes",
    "LimaCharlie":"Partially",
    "MDE":"No",
    "Qualys":"Partially",
    "SentinelOne":"No",
    "Sysmon":"No",
    "Uptycs":"No"
  },
  {
    "Telemetry Feature Category":null,
    "Sub-Category":"DNS Query",
    "Auditd":"No",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"Yes",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"Yes",
    "MDE":"No",
    "Qualys":"Via EnablingTelemetry",
    "SentinelOne":"Yes",
    "Sysmon":"No",
    "Uptycs":"Yes"
  },
  {
    "Telemetry Feature Category":"Scheduled Task Activity",
    "Sub-Category":"Scheduled Task",
    "Auditd":"No",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"No",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"No",
    "Qualys":"No",
    "SentinelOne":"Yes",
    "Sysmon":"No",
    "Uptycs":"No"
  },
  {
    "Telemetry Feature Category":"User Account Activity",
    "Sub-Category":"User Account Created",
    "Auditd":"No",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"No",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"No",
    "Qualys":"No",
    "SentinelOne":"Yes",
    "Sysmon":"No",
    "Uptycs":"No"
  },
  {
    "Telemetry Feature Category":null,
    "Sub-Category":"User Account Modified",
    "Auditd":"No",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"No",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"No",
    "Qualys":"No",
    "SentinelOne":"No",
    "Sysmon":"No",
    "Uptycs":"No"
  },
  {
    "Telemetry Feature Category":null,
    "Sub-Category":"User Account Deleted",
    "Auditd":"No",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"No",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"No",
    "Qualys":"No",
    "SentinelOne":"Yes",
    "Sysmon":"No",
    "Uptycs":"No"
  },
  {
    "Telemetry Feature Category":"Driver\/Module Activity",
    "Sub-Category":"Driver Load",
    "Auditd":"Yes",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"No",
    "ESET Inspect":"Yes",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"No",
    "Qualys":"No",
    "SentinelOne":"No",
    "Sysmon":"No",
    "Uptycs":"No"
  },
  {
    "Telemetry Feature Category":null,
    "Sub-Category":"Image Load",
    "Auditd":"Yes",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"No",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"No",
    "Qualys":"No",
    "SentinelOne":"No",
    "Sysmon":"No",
    "Uptycs":"No"
  },
  {
    "Telemetry Feature Category":null,
    "Sub-Category":"eBPF Event",
    "Auditd":"Yes",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"Yes",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"No",
    "Qualys":"No",
    "SentinelOne":"No",
    "Sysmon":"No",
    "Uptycs":"Via EnablingTelemetry"
  },
  {
    "Telemetry Feature Category":"Access Activity",
    "Sub-Category":"Raw Access Read",
    "Auditd":"Yes",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"No",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"No",
    "Qualys":"No",
    "SentinelOne":"No",
    "Sysmon":"Yes",
    "Uptycs":"Via EnablingTelemetry"
  },
  {
    "Telemetry Feature Category":null,
    "Sub-Category":"Process Access",
    "Auditd":"Yes",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"No",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"No",
    "Qualys":"No",
    "SentinelOne":"No",
    "Sysmon":"No",
    "Uptycs":"Via EnablingTelemetry"
  },
  {
    "Telemetry Feature Category":"Process Tampering Activity",
    "Sub-Category":"Process Tampering",
    "Auditd":"Yes",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"No",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"No",
    "Qualys":"No",
    "SentinelOne":"Yes",
    "Sysmon":"No",
    "Uptycs":"Via EnablingTelemetry"
  },
  {
    "Telemetry Feature Category":"Service Activity",
    "Sub-Category":"Service Creation",
    "Auditd":"No",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"No",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"No",
    "Qualys":"No",
    "SentinelOne":"Yes",
    "Sysmon":"No",
    "Uptycs":"No"
  },
  {
    "Telemetry Feature Category":null,
    "Sub-Category":"Service Modification",
    "Auditd":"No",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"No",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"No",
    "Qualys":"No",
    "SentinelOne":"Yes",
    "Sysmon":"Yes",
    "Uptycs":"No"
  },
  {
    "Telemetry Feature Category":null,
    "Sub-Category":"Service Deletion",
    "Auditd":"No",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"No",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"No",
    "Qualys":"No",
    "SentinelOne":"No",
    "Sysmon":"No",
    "Uptycs":"No"
  },
  {
    "Telemetry Feature Category":"EDR SysOps",
    "Sub-Category":"Agent Start",
    "Auditd":"No",
    "Carbon Black Cloud":"Yes",
    "CrowdStrike":"Yes",
    "ESET Inspect":"No",
    "Elastic":"Yes",
    "LimaCharlie":"Yes",
    "MDE":"Yes",
    "Qualys":"Yes",
    "SentinelOne":"Yes",
    "Sysmon":"No",
    "Uptycs":"Yes"
  },
  {
    "Telemetry Feature Category":null,
    "Sub-Category":"Agent Stop",
    "Auditd":"No",
    "Carbon Black Cloud":"Yes",
    "CrowdStrike":"Yes",
    "ESET Inspect":"Yes",
    "Elastic":"Yes",
    "LimaCharlie":"Yes",
    "MDE":"Yes",
    "Qualys":"Yes",
    "SentinelOne":"Yes",
    "Sysmon":"No",
    "Uptycs":"Yes"
  },
  {
    "Telemetry Feature Category":"Hash Algorithms",
    "Sub-Category":"MD5",
    "Auditd":"No",
    "Carbon Black Cloud":"Yes",
    "CrowdStrike":"Yes",
    "ESET Inspect":"Yes",
    "Elastic":"Yes",
    "LimaCharlie":"Yes",
    "MDE":"Yes",
    "Qualys":"Yes",
    "SentinelOne":"No",
    "Sysmon":"Yes",
    "Uptycs":"Yes"
  },
  {
    "Telemetry Feature Category":null,
    "Sub-Category":"SHA",
    "Auditd":"No",
    "Carbon Black Cloud":"Yes",
    "CrowdStrike":"Yes",
    "ESET Inspect":"Yes",
    "Elastic":"Yes",
    "LimaCharlie":"Yes",
    "MDE":"Yes",
    "Qualys":"Yes",
    "SentinelOne":"Yes",
    "Sysmon":"Yes",
    "Uptycs":"Yes"
  },
  {
    "Telemetry Feature Category":null,
    "Sub-Category":"Fuzzy Hash",
    "Auditd":"No",
    "Carbon Black Cloud":"No",
    "CrowdStrike":"No",
    "ESET Inspect":"No",
    "Elastic":"No",
    "LimaCharlie":"No",
    "MDE":"No",
    "Qualys":"No",
    "SentinelOne":"No",
    "Sysmon":"Yes",
    "Uptycs":"No"
  }
]