DOCSEARCHbyAlgolia
Submit Docs

EDR Telemetry

repository·main·Indexed 24 days ago

https://github.com/tsale/edr-telemetry

A comparative analysis project that evaluates the telemetry capabilities of various Endpoint Detection and Response (EDR) products and endpoint agents. It includes a detailed scoring system for feature implementation, a telemetry statistics pipeline, and Telemetry Generators for Windows, Linux, and macOS to produce and test telemetry data via system calls and frameworks like Atomic Red Team.

Tokens
4.1K
Snippets
8
Records
34
Agent score
84%

What's inside edr-telemetry

  1. Overview of EDR Telemetry

    main

    EDR Telemetry is a project that provides a comprehensive comparison of telemetry features across various Endpoint Detection and Response (EDR) products and endpoint agents (such as Sysmon). It is designed to help security practitioners evaluate the telemetry capabilities of different solutions and promote transparency among vendors.

    Key features include:

    • Feature-by-feature comparison of multiple EDR solutions.
    • A detailed scoring system for evaluating feature implementation.
    • Regular updates to maintain accuracy with the latest product capabilities.
    • Community-driven verification and contributions.

  2. Understand how telemetry scores are calculated

    main

    The script calculates weighted changes for telemetry cells using a status scoring model and feature weights.

    Status Scoring Model

    StatusScore
    Yes1.0
    Via EnablingTelemetry1.0
    Partially0.5
    Via EventLogs0.5
    No0.0
    Pending Response0.0

    Weighted Change Formula

    Each change is weighted by the telemetry feature weight defined in Tools/compare.py:

    Weighted change = (new status score - old status score) x feature weight

    This allows the script to track improvements such as moving from Via EnablingTelemetry to Yes, even if the numeric score remains 1.0, because it tracks the change in status.

  3. Understand the EDR Telemetry Scoring System

    main

    The project uses an evaluation script to assign numerical scores to telemetry features based on how they are implemented. Understanding these scores is essential when interpreting the comparison tables:

    SymbolMeaningScore
    ✅Yes1.0
    ⚠️Partially0.5
    🎚️Via EnablingTelemetry1.0
    🪵Via EventLogs0.5
    ❌No0.0
    ❓Pending Response0.0

  4. Run the macOS Telemetry Generator

    main

    The macOS Telemetry Generator requires root privileges to perform the system operations (syscalls and native framework calls) necessary to produce telemetry.

    Note on User Sessions: When running under sudo, user-session operations (like LaunchAgents/Services) are executed as the invoking user (via setuid/setgid) to ensure they run in the correct per-user launchd domain.

    To run all available telemetry events, use:

    sudo python3 macos_telem_gen.py

  6. Use the Telemetry Generator to generate and test telemetry data

    main

    The Telemetry Generator (v0.1) is a tool designed to generate and test telemetry data by mapping sub-categories to Atomic Red Team tests via the Invoke-AtomicRedTeam framework.

    How it works

    1. The tool reads a config.json file containing the mapping of sub-categories to specific Atomic Red Team techniques.
    2. It executes the mapped techniques to produce telemetry.
    3. The generated telemetry can then be compared against the project's comparison table to ensure alignment and accuracy.

    Execution Options

    You can control the scope of telemetry generation using the -Name parameter:

    • Execute all techniques: Leave the -Name parameter at its default value (All).
    • Execute a specific technique: Pass the specific name of the technique to the -Name parameter.

    Limitations

    Certain sub-categories cannot currently be tested with this tool, including:

    • USB Mount/Unmount
    • All categories within EDR-SysOps.

  10. Run the Telemetry Statistics Script

    main

    The scripts/generate_telemetry_stats.py script generates EDR telemetry statistics by analyzing the repository's Git history and comparing telemetry matrix files across commits. It records changes to 'telemetry cells' (defined by platform + vendor + telemetry category + telemetry sub-category + status).

    Full Rebuild

    Use this command to perform a complete recalculation of all statistics from the beginning of the Git history:

    python scripts/generate_telemetry_stats.py \
  --repo . \
  --output data/generated \
  --raw-output data/raw/github \
  --config config/stats_config.yml \
  --format json,jsonl,csv

    Incremental Update

    For routine updates, use the --incremental flag. This mode reads data/generated/run_metadata.json to find the last processed head_commit and only scans subsequent commits. It appends new events to the existing ledger and regenerates summaries.

    Note on Incremental Mode: The script will automatically fall back to a full rebuild if the previous commit is missing from the current branch history or if the schema version has changed.

    Note on GitHub Metadata: If the GITHUB_TOKEN environment variable is set, the script enriches the statistics with pull request metadata. Otherwise, it generates statistics based solely on local Git history.

    python scripts/generate_telemetry_stats.py \
  --repo . \
  --output data/generated \
  --raw-output data/raw/github \
  --config config/stats_config.yml \
  --format json,jsonl,csv