EDR Telemetry Pull Request

Contribution Details

Adding telemetry field mapping for Process Creation events on Windows.

Telemetry Validation

The data provided directly relates to a security-relevant event (process creation) and details the execution context (command line, parent process, user). This meets the core telemetry definition.

Documentation or Evidence:

• [x ] Official documentation (link: [https://docs.edr-vendor.com/telemetry/events/process_creation)
• Screenshots attached
• Sanitized logs provided
• Private documentation (will share confidentially)

Type of Contribution

• [x ] Adding telemetry information for an existing EDR product
• Adding a new EDR product that meets eligibility criteria
• Proposing new event categories/sub-categories
• Documentation improvement
• Tool enhancement

Validation Details

EDR Product Information

• EDR Product Name: SentinelOne
• EDR Version: Agent 22.3.5.1
• Operating System(s) Tested: Windows 10 Pro (21H2)

Testing Methodology

Additional Notes