The following table lists the Linux telemetry monitored and collected by the endpoint
agent.
For information about eventId and eventSubId mapping in XDR Data Explorer, see Endpoint data sources eventId and eventSubId mapping.
|
Category
|
Sub-category
|
Details
|
|
PROCESS ACTIVITY
|
Process Creation
|
Collected through standard settings
|
|
Process Termination
|
Collected through standard settings
|
|
|
FILE MANIPULATION
|
File Creation
|
Collected through standard settings
|
|
File Opened
|
Requires enabling hypersensitive mode
|
|
|
File Deletion
|
Default disabled. If you require monitoring of this event type, contact your support
provider.
|
|
|
File Set Security
|
Default disabled. If you require monitoring of this event type, contact your support
provider.
|
|
|
NETWORK ACTIVITY
|
Outbound Connection
|
Collected through standard settings
|
|
Inbound Connection
|
Collected through standard settings
|
|
|
Listening
|
Collected through standard settings
|
|
|
MODIFIED PROCESS ACTIVITY
|
Modified Process Write Memory
|
Collected through standard settings
|
|
Modified Process Write Process
|
Collected through standard settings
|
|
|
MEMORY ACTIVITY
|
Memory Read
|
Collected through standard settings
|
|
Memory Modify
|
Collected through standard settings
|
|
|
BM ACTIVITY
|
BM Invoke
|
Collected through standard settings
|
|
BM Invoke API
|
Collected through standard settings
|