Skip to main content

Sensor Policies

tip

After logging to the Endgame web UI as admin (or any user with the ADMIN role), Sensor Policies are created by navigating to Administration -> POLICY and clicking Create New Policy

1. Create DO-NOTHING Sensor Policy​

  1. Create a new policy with the following information:
    • Policy Name: DO-NOTHING
    • Select a base policy: DEFAULT
  2. Click the Create button, then click the View Policy button once the policy has been created to enter the policy’s configuration
  3. Navigate to the THREATS tab and click Quick Configure -> Disable All
  4. Navigate to the ADVERSARY BEHAVIORS tab and click Quick Configure -> Disable All
  5. Navigate to the SETTINGS and disable all options
  6. Click Save and Apply

2. Create DETECT-ONLY Sensor Policy​

  1. Create a new policy with the following information:
    • Policy Name: DETECT-ONLY
    • Select a base policy: DEFAULT
  2. Click the Create button, then click the View Policy button once the policy has been created to enter the policy’s configuration
  3. Navigate to the THREATS tab and click Quick Configure -> Enable All (Detect)
  4. Navigate to the ADVERSARY BEHAVIORS tab and click Quick Configure -> Enable All (Detect)
  5. Navigate to the SETTINGS and disable all options
  6. Click Save and Apply

3. Create DETECT-STREAM Sensor Policy​

  1. Create a new policy with the following information:
    • Policy Name: DETECT-STREAM
    • Select a base policy: DEFAULT
  2. Click the Create button, then click the View Policy button once the policy has been created to enter the policy’s configuration
  3. Navigate to the THREATS tab and click Quick Configure -> Enable All (Detect)
  4. Navigate to the ADVERSARY BEHAVIORS tab and click Quick Configure -> Enable All (Detect)
  5. Navigate to the SETTINGS and enable the following options:
    • ELASTIC STREAMING: Event Streaming
    • EVENT COLLECTION:
      • Linux Event Collection
      • Mac Event Collection
      • Windows Event Collection
  6. Click Save and Apply

4. Create PREVENT-ONLY Sensor Policy​

  1. Create a new policy with the following information:
    • Policy Name: PREVENT-ONLY
    • Select a base policy: DEFAULT
  2. Click the Create button, then click the View Policy button once the policy has been created to enter the policy’s configuration
  3. Navigate to the THREATS tab and click Quick Configure -> Enable All (Prevent)
  4. Navigate to the ADVERSARY BEHAVIORS tab and click Quick Configure -> Enable All (Reflex Response)
  5. Navigate to the SETTINGS and disable all options
  6. Click Save and Apply

5. Create PREVENT-STREAM Sensor Policy​

  1. Create a new policy with the following information:
    • Policy Name: PREVENT-STREAM
    • Select a base policy: DEFAULT
  2. Click the Create button, then click the View Policy button once the policy has been created to enter the policy’s configuration
  3. Navigate to the THREATS tab and click Quick Configure -> Enable All (Prevent)
  4. Navigate to the ADVERSARY BEHAVIORS tab and click Quick Configure -> Enable All (Reflex Response)
  5. Navigate to the SETTINGS and enable the following options:
    • ELASTIC STREAMING: Event Streaming
    • EVENT COLLECTION:
      • Linux Event Collection
      • Mac Event Collection
      • Windows Event Collection
  6. Click Save and Apply