Linux Telemetry Section about edr-telemetry

[exeronn]

I thought I'd try & get this started by mapping out SysmonForLinux & seeing how it fits in with a hybrid of the current mapping for Windows & the suggestions from @craighrowland.

There was more initial overlap than I thought there would be, if we abstract things like "Services" to include systemd or service in Linux & similar for shceduled tasks. I'm very much taking the Windows one as the lead & I'm thinking items like file attributes, creation times, etc might be Yes/Partial/No requriements rather than fields.

We also need to think if we want to include some more specific but common data feeds such as apparmour & selinux. I briefly looked at the evented tables in OSQuery to get an idea for other data sets.

LinuxEDR-v0.csv

I added the evidence for SysmonForLinix to https://github.com/exeronn/Linux-Detection/tree/main/Sysmon/EventTypes - so we can fill it out in the pull request once we've got a way of doing it.

For reference the partials are:

Process Access: It only looks to include ptrace events
File Read: This may be better as a no, currently it's only raw read access that shows up in this
Tampering: You can see config changes