Collection
The organization's fleet policy decides what each host collects. Agent-collected events use the same canonical field names as every other source, so they search, detect and report exactly like the rest of your data.
Windows
| Channel | Typical events |
|---|---|
| Security | Logons and failures, account changes, privilege use, audit policy changes. |
| System | Service installs and state changes, driver loads. |
| PowerShell operational | Script block logging, module logging. |
| Sysmon operational | Process creation with hashes and parent chain, network connections, image loads, file creation, registry changes, pipe events, DNS queries. Depends on the Sysmon configuration installed on the host. |
| Microsoft Defender operational | Detections and their disposition, real-time protection state changes. |
Sysmon gives the richest process, network and file picture. The installer bundle includes a recommended Sysmon configuration, and the content pack's process-based rules use it.
Linux
| Source | Typical events |
|---|---|
| journald | System and service messages. |
| Authentication logs | sshd logons and failures, sudo use, session opens. |
| auditd | Process execution, file access and privilege changes according to the rules installed. The bundle ships recommended rules. |
Agent-generated events
The agent also reports its own events into the same store:
- heartbeat and capability changes;
- containment applied, released or tampered with;
tool.downandtool.restoredfrom Security Tool Availability;- update applied or refused;
- every response action executed on the host, with the operator identity.
Privacy note
The agent collects the security events the configured sources record, and network activity as connection records. What is collected is the organization's decision through fleet policy, and the organization is responsible for informing the people it monitors as the law requires.