+{contributors_html} +
+""" + +# Update the specific section in the README file +def update_readme(new_section_content): + # Read the README file + with open(readme_path, "r") as file: + readme_content = file.read() + + # Use a regex pattern to replace the section + pattern = re.compile( + f"{re.escape(start_marker)}.*?{re.escape(end_marker)}", + re.DOTALL + ) + updated_content = pattern.sub(new_section_content + "\n" + end_marker, readme_content) + + # Write the updated content back to the README file + with open(readme_path, "w") as file: + file.write(updated_content) + + print("README.md has been updated successfully!") + +# Main function to orchestrate the process +def main(): + try: + contributors_html = fetch_contributors() + new_section_content = generate_new_content(contributors_html) + update_readme(new_section_content) + except Exception as e: + print(f"Error: {e}") + +# Execute the script +if __name__ == "__main__": + main() diff --git a/images/edr-telemetry_website_screenshot.png b/images/edr-telemetry_website_screenshot.png new file mode 100644 index 0000000..e912200 Binary files /dev/null and b/images/edr-telemetry_website_screenshot.png differ diff --git a/mitre_att&ck_mappings.json b/mitre_att&ck_mappings.json new file mode 100644 index 0000000..bee627a --- /dev/null +++ b/mitre_att&ck_mappings.json @@ -0,0 +1,320 @@ +[ + { + "" : "", + "MITRE ATT&CK Mappings" : "Process Creation - DS0009", + "Sub-Category" : "Process Creation", + "Telemetry Feature Category" : "Process Activity" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Process Termination - DS0009", + "Sub-Category" : "Process Termination", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Process Access - DS0009", + "Sub-Category" : "Process Access", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Module Load - DS0011", + "Sub-Category" : "Image\/Library Loaded", + "Telemetry Feature Category" : "" + }, + { + "" : "Process Access (Partial) - DS0009", + "MITRE ATT&CK Mappings" : "OS API Execution (Partial) - DS0009, Process Access (Partial) - DS0009", + "Sub-Category" : "Remote Thread Creation", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Process Modification - DS0009", + "Sub-Category" : "Process Tampering Activity", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "File Creation - DS0022", + "Sub-Category" : "File Creation", + "Telemetry Feature Category" : "File Manipulation" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "File Opened - DS0022", + "Sub-Category" : "File Opened", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "File Deletion - DS0022", + "Sub-Category" : "File Deletion", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "File Modification - DS0022", + "Sub-Category" : "File Modification", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "File Renaming - DS0022", + "Sub-Category" : "File Renaming", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Local Account Creation - DS0002", + "Sub-Category" : "Local Account Creation", + "Telemetry Feature Category" : "User Account Activity" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Local Account Modification - DS0002", + "Sub-Category" : "Local Account Modification", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Local Account Deletion - DS0002", + "Sub-Category" : "Local Account Deletion", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Account Login (User Account Authentication) - DS0002, Account Login (Logon Session Creation) - DS0028", + "Sub-Category" : "Account Login", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "-", + "Sub-Category" : "Account Logoff", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "TCP Connection - DS0029", + "Sub-Category" : "TCP Connection", + "Telemetry Feature Category" : "Network Activity" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "UDP Connection - DS0029", + "Sub-Category" : "UDP Connection", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "URL - DS0029", + "Sub-Category" : "URL", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "DNS Query - DS0029", + "Sub-Category" : "DNS Query", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "File Downloaded (Network Traffic Content) - DS0029,File Downloaded (File Creation) - DS0022", + "Sub-Category" : "File Downloaded", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "MD5 - DS0022", + "Sub-Category" : "MD5", + "Telemetry Feature Category" : "Hash Algorithms" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "SHA - DS0022", + "Sub-Category" : "SHA", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "IMPHASH - DS0022", + "Sub-Category" : "IMPHASH", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Key\/Value Creation - DS0024", + "Sub-Category" : "Key\/Value Creation", + "Telemetry Feature Category" : "Registry Activity" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Key\/Value Modification - DS0024", + "Sub-Category" : "Key\/Value Modification", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Key\/Value Deletion - DS0024", + "Sub-Category" : "Key\/Value Deletion", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Scheduled Task Creation - DS0003", + "Sub-Category" : "Scheduled Task Creation", + "Telemetry Feature Category" : "Schedule Task Activity" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Scheduled Task Modification - DS0003", + "Sub-Category" : "Scheduled Task Modification", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Scheduled Task Deletion - DS0003", + "Sub-Category" : "Scheduled Task Deletion", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Service Creation - DS0019", + "Sub-Category" : "Service Creation", + "Telemetry Feature Category" : "Service Activity" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Service Modification - DS0019", + "Sub-Category" : "Service Modification", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Service Deletion - DS0019", + "Sub-Category" : "Service Deletion", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Driver Loaded - DS0027", + "Sub-Category" : "Driver Loaded", + "Telemetry Feature Category" : "Driver\/Module Activity" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Driver Modification - DS0022", + "Sub-Category" : "Driver Modification", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "-", + "Sub-Category" : "Driver Unloaded", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Virtual Disk Mount - DS0016", + "Sub-Category" : "Virtual Disk Mount", + "Telemetry Feature Category" : "Device Operations" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "USB Device Unmount - DS0016", + "Sub-Category" : "USB Device Unmount", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "USB Device Mount - DS0016", + "Sub-Category" : "USB Device Mount", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Group Policy Modification - DS0026", + "Sub-Category" : "Group Policy Modification", + "Telemetry Feature Category" : "Other Relevant Events" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Pipe Creation - DS0023", + "Sub-Category" : "Pipe Creation", + "Telemetry Feature Category" : "Named Pipe Activity" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Pipe Connection - DS0023", + "Sub-Category" : "Pipe Connection", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Agent Start - DS0013", + "Sub-Category" : "Agent Start", + "Telemetry Feature Category" : "EDR SysOps" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Agent Stop - DS0013", + "Sub-Category" : "Agent Stop", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Agent Install - DS0013", + "Sub-Category" : "Agent Install", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Agent Uninstall - DS0013", + "Sub-Category" : "Agent Uninstall", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Agent Keep-Alive - DS0013", + "Sub-Category" : "Agent Keep-Alive", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Agent Errors - DS0013", + "Sub-Category" : "Agent Errors", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "WmiEventConsumerToFilter - DS0005", + "Sub-Category" : "WmiEventConsumerToFilter", + "Telemetry Feature Category" : "WMI Activity" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "WmiEventConsumer - DS0005", + "Sub-Category" : "WmiEventConsumer", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "WmiEventFilter - DS0005", + "Sub-Category" : "WmiEventFilter", + "Telemetry Feature Category" : "" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "PowerShell Activity - DS0012,PowerShell Activity - DS0017", + "Sub-Category" : "BIT JOBS Activity", + "Telemetry Feature Category" : "BIT JOBS Activity" + }, + { + "" : "", + "MITRE ATT&CK Mappings" : "Script-Block Activity - DS0012", + "Sub-Category" : "Script-Block Activity", + "Telemetry Feature Category" : "PowerShell Activity" + } + ] \ No newline at end of file diff --git a/partially_value_explanations.json b/partially_value_explanations.json new file mode 100644 index 0000000..cce8869 --- /dev/null +++ b/partially_value_explanations.json @@ -0,0 +1,1115 @@ +[ + { + "Telemetry Feature Category":"Process Activity", + "Sub-Category":"Process Creation", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Process Termination", + "Carbon Black": {"Partially":"Only observed as file operations."}, + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Process Access", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":{"Partially":"Only for LSASS.exe process"}, + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Image\/Library Loaded", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Remote Thread Creation", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Process Tampering Activity", + "Carbon Black":{"Partially":"Only via cross-process."}, + "Cortex XDR":{"Partially":"Needs the tamper protection enabled."}, + "CrowdStrike":"", + "Cybereason":"Pending Response", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":{"Partially":"Only provides cross process info like remote thread creation and process handles, it doesn't give much more detail beyond that."}, + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":"File Manipulation", + "Sub-Category":"File Creation", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":{"Partially":"Only for binaries created on disk."}, + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":{"Partially":"Only tracks via dedicated event the renaming of Portable Executables (PE) and compressed files."} + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"File Opened", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":{"Partially":"Only contains modification from a user added to a group."}, + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":{"Partially":"Visibility on File Read only"}, + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":{"Partially":"Only tracks via dedicated event the opening of compressed files."} + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"File Deletion", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"File Modification", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"File Renaming", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":{"Partially":"Events are reported as a delete+write."}, + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":{"Partially":"Only tracks via dedicated event the renaming of Portable Executables (PE) and compressed files."} + }, + { + "Telemetry Feature Category":"User Account Activity", + "Sub-Category":"Local Account Creation", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Local Account Modification", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":{"Partially":"Only contains modification from a user added to a group."}, + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Local Account Deletion", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Account Login", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":{"Partially":"Only tracks when user is seen first time per endpoint."}, + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Account Logoff", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":"Network Activity", + "Sub-Category":"TCP Connection", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"UDP Connection", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"URL", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":{"Partially":"Only if activity is generated by a NON-Browser application."}, + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":{"Partially":"Depends on Firewall / IPS settings / policy; if only IPS is enabled URL will just logged malicious connections, but not clean connections"}, + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":{"Partially":"Mainly when the URL is fetched via HTTP/S GET and not from a modern browser."} + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"DNS Query", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"File Downloaded", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":{"Partially":"Only for documents and binaries."}, + "ESET Inspect":{"Partially":"Only for binaries created on disk."}, + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":{"Partially":"Only if the activity is generated via Chrome browser[https://doc.limacharlie.io/docs/documentation/0b189c00533e5-reference-events#http_request]"}, + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":{"Partially":"Limited to certain processes."}, + "WatchGuard":"" + }, + { + "Telemetry Feature Category":"Hash Algorithms", + "Sub-Category":"MD5", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"SHA", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"IMPHASH", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":{"Partially":"Only available for drivers and DLL files."}, + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":"Registry Activity", + "Sub-Category":"Key\/Value Creation", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":{"Partially":"Tracks only only specific keys (ASEP = 'AutoStarting Entry Point')."}, + "Cybereason":{"Partially":"By default, only RUN keys and some registry values that are commonly abused."}, + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Key\/Value Modification", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":{"Partially":"Tracks only only specific keys (ASEP = 'AutoStarting Entry Point')."}, + "Cybereason":{"Partially":"By default, only RUN keys and some registry values that are commonly abused."}, + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Key\/Value Deletion", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":{"Partially":"By default, only RUN keys and some registry values that are commonly abused."}, + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":"Schedule Task Activity", + "Sub-Category":"Scheduled Task Creation", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Scheduled Task Modification", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Scheduled Task Deletion", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":"Service Activity", + "Sub-Category":"Service Creation", + "Carbon Black":{"Partially":"Via monitoring the registry changes."}, + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Service Modification", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":{"Partially":"Tracks only modification of service binaries."}, + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":{"Partially":"The dedicated event tracking service activity only tracks parent/child processes related to a service change, no further details."} + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Service Deletion", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"Pending Response", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":"Driver\/Module Activity", + "Sub-Category":"Driver Loaded", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Driver Modification", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Driver Unloaded", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":{"Partially":"It only shows a specific driver unload method use by attacker instead of every unloaded drivers"}, + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":"Device Operations", + "Sub-Category":"Virtual Disk Mount", + "Carbon Black":"", + "Cortex XDR":{"Partially":"Device Control should be in block mode"}, + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"USB Device Unmount", + "Carbon Black":"", + "Cortex XDR":{"Partially":"Device Control should be in block mode"}, + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":{"Partially":"Only mount/unmount events related to 'Volumes'. No other device visibility on this."}, + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"USB Device Mount", + "Carbon Black":{"Partially":"Mounted USBs are recorded in a separate table within the platform for administrative approval."}, + "Cortex XDR":{"Partially":"Device Control should be in block mode"}, + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":{"Partially":"Only mount/unmount events related to 'Volumes'. No other device visibility on this."}, + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":"Other Relevant Events", + "Sub-Category":"Group Policy Modification", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":"Named Pipe Activity", + "Sub-Category":"Pipe Creation", + "Carbon Black":{"Partially":"Reports only named pipes for file creation events."}, + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Pipe Connection", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":"EDR SysOps", + "Sub-Category":"Agent Start", + "Carbon Black":"", + "Cortex XDR":{"Partially":"Only if the start action fails"}, + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"Pending Response", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Agent Stop", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"Pending Response", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Agent Install", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Agent Uninstall", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Agent Keep-Alive", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"Pending Response", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"Agent Errors", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"Pending Response", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":"WMI Activity", + "Sub-Category":"WmiEventConsumerToFilter", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":{"Partially":"SES has a WMI Response Event and a WMI Instance Object, the WMI Response Event describes: unknown, blocked, allowed, no action, logged, command script, uncorrected, delayed, deleted, quarantined, restored, detected"}, + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"WmiEventConsumer", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":{"Partially":"SES has a WMI Response Event and a WMI Instance Object, the WMI Response Event describes: unknown, blocked, allowed, no action, logged, command script, uncorrected, delayed, deleted, quarantined, restored, detected"}, + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":null, + "Sub-Category":"WmiEventFilter", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":{"Partially":"SES has a WMI Response Event and a WMI Instance Object, the WMI Response Event describes: unknown, blocked, allowed, no action, logged, command script, uncorrected, delayed, deleted, quarantined, restored, detected"}, + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":"BIT JOBS Activity", + "Sub-Category":"BIT JOBS Activity", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + }, + { + "Telemetry Feature Category":"PowerShell Activity", + "Sub-Category":"Script-Block Activity", + "Carbon Black":"", + "Cortex XDR":"", + "CrowdStrike":"", + "Cybereason":"", + "ESET Inspect":"", + "Elastic":"", + "Harfanglab":"", + "LimaCharlie":"", + "MDE":"", + "Qualys":"", + "SentinelOne":"", + "Symantec SES Complete":"", + "Sysmon":"", + "Trellix":"", + "Trend Micro":"", + "Uptycs":"", + "WatchGuard":"" + } +]