sysmon-linux \.+ no_full_log Sysmon For Linux Event T1204 sysmon_event 200150 ^1$ no_full_log Sysmon - Event 1: Process creation $(eventdata.image) T1204 sysmon_event1 200150 ^3$ no_full_log Sysmon - Event 3: Network connection by $(eventdata.image) sysmon_event3 200150 ^5$ no_full_log Sysmon - Event 5: Process terminated $(eventdata.image) T1204 sysmon_event5 200150 ^9$ no_full_log Sysmon - Event 9: Raw Access Read by $(eventdata.image) T1204 sysmon_event9 200150 ^11$ no_full_log Sysmon - Event 11: FileCreate by $(eventdata.image) sysmon_event_11 200150 ^16$ no_full_log Sysmon - Event 16: Sysmon config state changed $(Event.EventData.Data.Configuration) T1562 sysmon_event_16 200150 ^23$ no_full_log Sysmon - Event 23: FileDelete (A file delete was detected) by $(eventdata.image) T1485 sysmon_event_23 200152 wazuh-agentd$ no_full_log Sysmon - Event 3: Network connection by $(eventdata.image) sysmon_event3 200155 wazuh-agentd$ no_full_log Sysmon - Event 11: FileCreate by $(eventdata.image) sysmon_event_11 200157 wazuh-agentd$ no_full_log Sysmon - Event 23: FileDelete (A file delete was detected) by $(eventdata.image) T1485 sysmon_event_23