The following table lists the Linux telemetry monitored and collected by the endpoint
agent.
For information about eventId and eventSubId mapping in XDR Data Explorer, see eventId and eventSubId mapping.
|
Category
|
Sub-category
|
Details
|
|
PROCESS ACTIVITY
|
Process Creation
|
Collected through standard settings
|
|
Process Termination
|
Collected through standard settings
|
|
|
FILE MANIPULATION
|
File Creation
|
Collected through standard settings
|
|
File Opened
|
Requires enabling hypersensitive mode
|
|
|
File Deletion
|
Default disabled. If you require monitoring of this event type, contact your support
provider.
|
|
|
File Set Security
|
Default disabled. If you require monitoring of this event type, contact your support
provider.
|
|
|
NETWORK ACTIVITY
|
Outbound Connection
|
Collected through standard settings
|
|
Inbound Connection
|
Collected through standard settings
|
|
|
Listening
|
Collected through standard settings
|
|
|
MODIFIED PROCESS ACTIVITY
|
Modified Process Write Memory
|
Collected through standard settings
|
|
Modified Process Write Process
|
Collected through standard settings
|
|
|
MEMORY ACTIVITY
|
Memory Read
|
Collected through standard settings
|
|
Memory Modify
|
Collected through standard settings
|
|
|
BM ACTIVITY
|
BM Invoke
|
Collected through standard settings
|
|
BM Invoke API
|
Collected through standard settings
|
