List of supported Events

[nk-nez]

Good afternoon!

Looked for a list of supported Event IDs in SysmonForLinux. The information is not explicitly given on the official Microsoft page or in this repository. Maybe we should add this information to the README? Please duplicate it in the comments. I only found information about EventId 1,3,4,5,9,10,11,16,23,255

Thanks in advance for the answer!

[juju4]

Only code hint I see from quick search
https://github.com/microsoft/SysmonForLinux/blob/main/sysmonforlinux.c#L850
else can only suppose it stays align with sysmon windows but it would be still nice to have docs
https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#events