Views:
The following table lists the Linux telemetry monitored and collected by the endpoint agent.
For information about eventId and eventSubId mapping in XDR Data Explorer, see eventId and eventSubId mapping.

Category
Sub-category
Details
PROCESS ACTIVITY
Process Creation
Collected through standard settings
Process Termination
Collected through standard settings
FILE MANIPULATION
File Creation
Collected through standard settings
File Opened
Requires enabling hypersensitive mode
File Deletion
Default disabled. If you require monitoring of this event type, contact your support provider.
File Set Security
Default disabled. If you require monitoring of this event type, contact your support provider.
NETWORK ACTIVITY
Outbound Connection
Collected through standard settings
Inbound Connection
Collected through standard settings
Listening
Collected through standard settings
MODIFIED PROCESS ACTIVITY
Modified Process Write Memory
Collected through standard settings
Modified Process Write Process
Collected through standard settings
MEMORY ACTIVITY
Memory Read
Collected through standard settings
Memory Modify
Collected through standard settings
BM ACTIVITY
BM Invoke
Collected through standard settings
BM Invoke API
Collected through standard settings