Update EDR_telem_linux.json - Uptycs - Image Load

[joshlemon]

EDR Telemetry Pull Request

Contribution Details

Telemetry Validation

Run the following search in Uptycs using both the process_events table (for clearly showing why the event occurred and its relationship), and the usrcall_events table to show the Image Load event:

select pe.upt_time,pe.upt_hostname,pe.pid,pe.cmdline,pe.ancestor_list, ue.functionname, ue.usrcall_params, ue.exe   from process_events pe join usrcall_events ue on ue.pid=pe.pid where pe.upt_asset_id='c8ba4d56-f11e-a7d4-c720-ef8be936c0a4' and pe.cmdline='python3 lnx_telem_gen.py ImageLoad' 

The above search produces the following output in Uptycs:

Documentation or Evidence:

• Official documentation (link: )
• Screenshots attached
• Sanitized logs provided
• Private documentation (will share confidentially)

Type of Contribution

• Adding telemetry information for an existing EDR product
• Adding a new EDR product that meets eligibility criteria
• Proposing new event categories/sub-categories
• Documentation improvement
• Tool enhancement

Validation Details

EDR Product Information

• EDR Product Name: Uptycs
• EDR Version: N/A
• Operating System(s) Tested: Linux

Testing Methodology

Running the provided Linux Telemetry script on a Linux host and reviewing data in the Uptycs platform.

python3 lnx_telem_gen.py ImageLoad

Additional Notes