Skip to main content

Introduction

Revision History​

DateAuthorSummary
28-NOV-2022TSgt. BernadotteInitial draft

Purpose​

This SOP standardizes a set of Endgame Sensor policies and profiles and settings to be employed based on varying deployment strategies.

End-State​

  1. The following Sensor Policies will be pre-configured to be applied against deployed sensors:
    • DO-NOTHING
    • DETECT-ONLY
    • DETECT+STREAM
    • PREVENT-ONLY
    • PREVENT+STREAM
  2. Both Persistent and Dissolvable (auto-removes after reboot) Sensor Profiles will be pre-configured with the DO-NOTHING policy to be deployed in a manner that best fits your mission.
  3. A CVAH sensor profile will be created for monitoring CVA/H assets, such as the MIP.

Requirements​

The Endgame SMP server must be installed on the DIP with a valid license IAW 262COS-DIP-SOP-001 or the CVA/H PMO's v3.7 R440 XXXX Deployable Interceptor Platform (DIP) Installation Guide

Considerations​

  1. Each Sensor Policy created by this SOP have their own use-cases and levels of risk of Endgame potentially negatively impacting systems, and should be reviewed before employed:
Policy NameRiskDescription
DO-NOTHINGLOW
  • Initial policy that should be used for test deployments
  • Does not perform detection, automated response actions, or log streamingnitial policy that should be used for test deployments
DETECT-ONLYLOW
  • Detects malicious activity
  • Does not perform automated response actions or log streaming to Elastic
DETECT+STREAMMODERATE
  • Detects malicious activity
  • Does not perform automated response actions
  • Streams host activity log data to Elastic
PREVENT-ONLYHIGH
  • Detects malicious activity and responds automaticallyy
  • Does not host activity stream log data to Elastic
PREVENT+STREAMHIGH
  • Detects malicious activity and responds automatically
  • Streams host activity log data to Elastic

  1. Event Streaming is best used on systems where Sysmon is not/cannot be installed for the following reasons:

    • Stream data collects much of the same data as Sysmon
    • Sysmon can be tuned to exclude noisy known-good activity while Streams cannot

  2. This SOP outlines the modification of the default sensor installation parameters to masquerade Endgame as a Tanium process in order to obscure Endgame’s presence from MCA – these parameters should be changed to best match your environment (it would still be out of place if your target system does not employ Tanium)