$ show tsale/EDR-Telemetry
This repository is a community-driven research project that maintains structured telemetry coverage matrices for major EDR (Endpoint Detection and Response) products across Windows, Linux, and macOS. It currently tracks 25+ vendors with approximately 100 telemetry sub-categories mapped to MITRE ATT&CK data sources. The primary data artifacts are three JSON files (EDR_telem_windows.json, EDR_telem_linux.json, EDR_telem_macOS.json) that are manually curated through pull requests, each with evidence requirements. The project provides a scoring system that computes weighted vendor scores based on coverage, an automated statistics pipeline that generates historical change events, vendor score timeseries, and contributor summaries, and platform-specific telemetry generators that produce test events for validation purposes. While the core asset is the curated dataset, the repository also contains reusable software components including a modular scoring model, a diff engine for snapshot comparison, and a PR evidence classifier. The project has a substantial community with nearly 2000 stars, active issue triage, and continuous updates through GitHub Actions workflows that regenerate statistics and synchronize data to a Supabase database.
The LLM identified 4 files worth highlighting for reuse:
Defines ScoringModel dataclass and compute_vendor_scores function that maps telemetry statuses (Yes/No/Partially/etc.) to numeric scores with per-platform weights. The design is clean, dependency-free (only standard library and its own config), and could be extracted to score any categorical coverage matrix. Demonstrates non-obvious engineering with status-to-score mapping, platform-specific weight structures, and error handling for missing data.
Implements diff_snapshots which compares two telemetry matrices and classifies every cell change (improvement, downgrade, new vendor, new category, rename, etc.) with deterministic event IDs. The function is self-contained, uses only standard library collections, and produces a structured list of events suitable for audit trails or time-series generation. This pattern is directly reusable for any two-version comparison of structured JSON data.
Provides functions to classify PR/commit evidence types (official_documentation, screenshots, logs, etc.) from text, and to categorize contributors (bot, maintainer, community). The implementation uses regex patterns and heuristics without external ML dependencies. While the specific pattern sets are domain-specific, the architecture of evidence extraction from structured input is a reusable pattern for any PR-based data curation project.
A self-contained Python module that uses ctypes to call macOS CoreFoundation, SystemConfiguration, libproc, and other native APIs to gather process, network, and system information without spawning external binaries. This is a non-obvious engineering pattern for cross-platform telemetry generation - wrapping multiple C APIs in clean Python functions, with proper error handling and memory management (CFRelease). The module could be extracted and reused in any macOS system monitoring or telemetry validation tool.