This group includes tags that start with the level edr. These tags identify data generated by Endpoint Detection and Response (EDR) systems.
Company | Product/Service | Data tables |
|---|
Carbon Black Endpoint Detection and Response
edr.carbonblack.alertedr.carbonblack.binaryedr.carbonblack.feededr.carbonblack.ingressedr.carbonblack.watchlist
More info about these parsers
Crowdstrike Endpoint Detection & Response
edr.crowdstrike.cannonedr.crowdstrike.cannon.asepvalueupdateedr.crowdstrike.cannon.channelversionrequirededr.crowdstrike.cannon.dnsrequestedr.crowdstrike.cannon.endofprocessedr.crowdstrike.cannon.neighborlistip4edr.crowdstrike.cannon.networkconnectip4edr.crowdstrike.cannon.otheredr.crowdstrike.cannon.processrollup2edr.crowdstrike.cannon.processrollup2statsedr.crowdstrike.cannon.sensorheartbeatedr.crowdstrike.cannon.syntheticprocessrollup2
More info about these parsers
Cylance PROTECTÂ
edr.cylance.appedr.cylance.auditedr.cylance.deviceedr.cylance.memoryedr.cylance.scriptedr.cylance.threats
More info about these parsers
ObserveIT Insider Threat Detection
edr.observeit.events
Palo Alto Cortex XDR
edr.paloalto.cortex_xdredr.paloalto.cortex_xdr_agent
More info about these parsers
Symantec Endpoint Detection & Response
edr.symantec.events