Ingesting Linux Audit Logs

Ingesting Sysmon Event Logs

Soteria EDR Rules

Ingesting MacOS Unified Logs

Ingesting Windows Event Logs

Reference: EDR Events

Reference: Endpoint Agent Commands

macOS Agent Installation - Latest Versions (macOS 15 Sequoia and newer)

macOS Agent Installation - Older Versions (macOS 10.15 Catalina to macOS 14 Sonoma)

Response Actions

Updating Sensors to the Newest Version

Test a New Sensor Version

Sensor Connectivity

macOS Agent Installation - MDM Configuration Profiles

Docker Agent Installation

Linux Agent Installation

Endpoint Agent Versioning and Upgrades

macOS Agent Installation - Older Versions (macOS 10.14 and prior)

Sleeper Deployment

Sysmon Comparison