Alert Policy
-
A policy determines which events will generate an alert for you.
-
There are 7 event categories. You can define specific rules within each category.
-
Xcitium EDR ships with a default security policy that is applied to all enrolled endpoints.
-
You can also create custom policies according to your requirements.
-
Only one policy can be active at a time. You cannot delete the active policy.
Open the 'Alert Policy' interface.
-
Click 'Security' > 'Endpoint Security.'
-
Place your mouse on the 'Alerts' tab and choose 'Alert Policy.'
-
The 'Alert Policy' view shows security events from all managed endpoints in chronological order:
Create a new policy.
-
Can be able to view alert generation rules.
-
Click 'Create Policy':
-
Create a name for the policy and press enter:
-
Now, click on the policy name to view and edit its current details:
-
The new policy is automatically assigned a set of default rules.
-
You can add new rules, edit or delete rules as required.
There are seven event categories:
Each category has conditions or rules that can be implemented in your policy. You can create new conditions and edit or delete a condition from a category.
The built-in event categories are:
-
Process Events –Rules to alert you when processes are invoked by an application.
-
Registry Events - Rules to alert you about changes to the Windows registry on your endpoints.
-
File Events - Rules to alert you about modifications to system files.
-
Download Events - Rules to alert you when files are downloaded via browsers, emails, shared folders, or external drives.
-
Upload Events - Rules to alert you when files are transferred to shared folders or external drives.
-
Defense+ Events - Rules to alert you when processes attempt to access critical operating system functions or launch attacks.
-
Network Events - Rules to alert you about any service listening to ports and network connections on your endpoints.
To create a new condition:
-
Click 'Add New' let the top of an event category:
The 'Add Condition' dialog will open:
-
'Event Type'– choose the type of incident that you want EDR (Endpoint Detection & Response) to detect. The event types available depend on the event category chosen.
-
In the example above, the category is 'Registry Events', so the available event types are 'Delete Registry Key', 'Delete Registry Value' and 'Set Registry Value'.
-
After choosing a type, you must next construct your condition. You do this by choosing the specific criteria which should be monitored. Again, the criteria vary by event category and event type.
-
In the example above we will choose 'Registry Events'> 'Set Registry Value'. The available criteria for 'Set Registry Value' let you specify which key names, values or paths should be monitored.
-
Event Name – Create a label for your condition. This label will be shown as 'Alert Name' in the 'Alerts' interface.
-
Tactic – There are totally 14 tactics available to choose, as per the needs select tactic. For more detail about tactic, you can refer https://attack.mitre.org/tactics/enterprise/.
-
Technique –For a particular tactic, there are certain number of techniques available, as per the needs select techniques. For more detail about technique, you can refer https://attack.mitre.org/techniques/enterprise/.
-
Object - The resource on which the incident occurred. For example, an endpoint.
-
Subject - The source of the incident. For example, a user or process that accessed the resource
-
Score – Rate the event according to how seriously you judge the incident. Scores range from 0 to 10.
-
Scores 0 to 5 – Low risk events
-
Scores 6 to 10 – High risk events
The next step is configuring the parameters and conditions for the rule.
-
Click the arrow below 'AND/OR'
The parameters depend on the selected category and event type.
-
Choose the parameter you wish to monitor.
-
In the second box select the condition. The conditions list varies for different parameters.
-
In the third box, enter or select the value. You must enter the value or select depending on the parameter.
-
Click 'Delete' to remove the rule.
-
Click 'Save' if the rule satisfies your requirement.
-
To add multiple rules, click 'Add rule.'
-
Define parameters and condition as explained above.
-
Use 'AND' or 'OR' operators for the rule per your requirement
You can add multiple rules and define their relationship with 'AND', 'OR' operators.
-
To add a group, click 'Add group.'
-
Define parameters and conditions as explained above.
-
Use 'AND' or 'OR' operators for groups (and within a group for rules) per your requirements.
-
Click 'Save' when done.
-
An alert will be created if the rule condition(s) are met.
-
To edit a rule, click the pencil icon beside it and update as required. The process is same as explained above.
-
To remove a rule, click the delete icon beside it.
-
Click 'Yes, delete it!' to confirm removal.
Activate a policy.
-
You can add as many security policies as required but any one only can be active at a time.
-
The active policy has a green check mark next to it.
-
Click ‘edit policy’ to activate.
-
Click 'Activate' at the top
The policy will be activated, and its rules will be applied to the enrolled endpoints.
Delete a policy.
-
You cannot delete an active policy.
-
Click 'Policy Management' on the left then the security policy that you want to delete.
-
Click ‘edit policy’ to activate.
-
Click 'Delete' at the top.
A confirmation dialog will be shown:
-
Click 'OK' to close the dialog.