tsale / EDR-Telemetry

This project aims to compare and evaluate the telemetry of various EDR products.
1.43k stars 141 forks source link

more verbose explanation of capability values in README.md #63

Open hRun opened 1 month ago

hRun commented 1 month ago

hi there,

would it be possible to add a more verbose description as to what the values a capability can take mean?

i.e. i was about to create a pull request changing the "network activity > url" value for mde to "partially", as the relevant network events logged by mde don't reliably populate the url field. it sometimes only contains a domain or trims the url parameters vs. what is logged on a proxy at the same time.

that's when i realized that i was unsure whether this would fulfil the criteria for "partially" or if the events simply being present in whatever quality is already enough to qualify for "implemented".

similarly i was unsure about the following: mde allows seeing bits jobs activity in the ProcessEventsTable and NetworkEventsTable, but doesn't have something specially dedicated. would that be regarded "partially" or still "not implemented"? btw. should be bits jobs in the json, not bit jobs 😉.

cheers, hrun

tsale commented 2 weeks ago

Thank you @hRun! While your point is valid, investigating the value of the information output by each telemetry category would be a significant challenge, given the project's current scope. I suggest creating a PR with additional information/evidence. If it only shows information from certain activities instead of all URL activities, we can label it as partially implemented :).

When checking the timeline of events, users can see bit job telemetry along with additional information, not just from the relevant tables you are referencing.