Skip to main content

CVA/H Capability Considerations

Data Redundancy and Overlap Considerations​

Often, different data collection tools may capture similar data sets. For instance, both Sysmon and Endgame can collect very similar data from Windows systems. When deploying host data collection capabilities, you must carefully consider the volume of data generated. To optimize storage:

  • Identify Overlapping Data: Determine which data types are collected by multiple tools.
  • Tune Collection Settings: Configure the tools to avoid duplicative logging where possible. For example, if both Windows native events and Sysmon provide process execution logs, you might choose to disable this logging in either Sysmon or Winlogbeat configs.
  • Prioritize Unique Data: Focus on unique data that each tool brings to the table and prioritize the collection of such data.

Endpoint Data Generation Rates​

This table offers a snapshot of the estimated data generation per endpoint for the different CVA/H host data collection capabilities. By understanding the expected daily data output from each capability, CPTs can better strategize their deployment, ensure efficient data management, and maintain optimal query performance in Elasticsearch.

CapabilityData Generated per Endpoint
Endgame (Stream)~80 MB/day
Sysmon~60 MB/day (with tuned 262COS config)
Winlogbeat~300 MB/day
Auditbeat~70 MB/day
FilebeatVaries greatly
SyslogVaries greatly
MetasponseVaries greatly

Endgame Considerations​

  • Due to Endgame installing a driver during deployment, older systems with outdated certificate stores may not trust the Endgame's signature and prevent installation - Driver Signature Enforcement will need to be disabled from the BIOS in these situations
  • "In-band" remote Windows installations require WinRM (5985/TCP) open on target endpoints
  • Can be installed both on Windows and *Nix systems, but logging and hunt capabilities are more abundant and favorable to Windows
  • Must be installed manually ("out-of-band") on non-Windows systems
  • Endgame Stream data on Windows hosts somewhat overlaps with Sysmon data, but:
    • Sysmon is better at correlating between log types (through the use of process GUIDs and logon IDs)
    • Sysmon provides more data sources than Endgame
    • Sysmon logging is tunable through its config file (Endgame is not), allowing you to cut down on noise and storage consumption
    • Endgame streaming relies on a single agent, while Sysmon relies on two (Sysmon + Winlogbeat)

Sysmon Considerations​

  • Due to Sysmon installing a driver during deployment, older systems with outdated certificate stores may not trust the Sysmon's signature and prevent installation - Driver Signature Enforcement will need to be disabled from the BIOS in these situations
  • Logs must be collected in some way, such as via Winlogbeat
  • Sysmon logging is tunable through its config file, allowing you to cut down on white and storage consumption
  • Endgame Stream data on Windows hosts somewhat overlaps with Sysmon data, but:
    • Sysmon is better at correlating between log types (through the use of process GUIDs and logon IDs)
    • Sysmon provides more data sources than Endgame
    • Endgame streaming relies on a single agent, while Sysmon relies on two (Sysmon + Winlogbeat)

Winlogbeat Considerations​

  • Has the abillity to retroactively ship old logs after installation - but this must be specified in the config file prior to deployment
  • Some native logs may overlap with other CVA/H capabilities - for example, 4688 process creation logs do not need to be collected if Sysmon is being deployed

Auditbeat Considerations​

  • Auditbeat has file integrity monitoring capabilities - this must be explicitly configured prior to deployment in order to active it
  • The process of installing Auditbeat involves disabling auditd
  • Like Winlogbeat, Filebeat can be directed to send logs to Logstash on port TCP/5045

Filebeat Considerations​

  • In additiona to being able to read raw log lines from a file, Filebeat has a large number modules for ingesting and parsing logs from different applications - these capabilities must be explicitly configured prior to deployment
  • Like Winlogbeat, Filebeat can be directed to send logs to Logstash on port TCP/5045

Syslog Considerations​

note
  • CVA/H 3.7 does not natively have the ability to ingest Syslog data, but a DIP configured IAW 262COS-DIP-SOP-001 does.
  • Syslog logs streamed across the network to CVA/H are in plaintext and could be potentially sniffed or manipulated by an adversary
  • Syslog (or it's equivalent) will need to be configured on the endpoint to ship logs back to CVA/H
  • Syslog can be directed to send logs to Logstash on port TCP/5047 or UDP/514 - the DIP firewall will need to be configured to portforward these connections