Reply to thread

Message

<blockquote data-quote="Victor M" data-source="post: 1066449" data-attributes="member: 96560">Hello Everybody,This is my new BitDefender Endpoint Detection Response (EDR) test box. ( free trial 1 month )It has the usual executive summary - which includes: Modules Installed, Risk Score, Incident Status, Top 5 Blocked Threats ...[ATTACH=full]279867[/ATTACH]The client/agent has no features to toggle or play with. So I won&#039;t show it here.It has a Incidents section.[ATTACH=full]279868[/ATTACH]And here is a screenshot of a real incident.[ATTACH=full]279869[/ATTACH]Here is a screenshot of all my machines (1), located in Network menu.[ATTACH=full]279870[/ATTACH]And here is where you add modules to the agent, from Network, checkmark machine, click on Task button on top, and choose Reconfigure Agent.The Advanced Anti Exploit module is Not part of the default configuration of an agent, and must be manually added this way.[ATTACH=full]279871[/ATTACH]I find that BitDefender EDR&#039;s native detection rules don&#039;t detect much. So I added my own rules, at&nbsp;&nbsp; Incident &gt; Custom Detection Rules. It basically adds a detection rule by keyword.BitDefender EDR, like all EDR&#039;s, is primarily an anti-malware. When it&#039;s arsenal can&#039;t stop an attack, the EDR portion has one more weapon, and that is the EDR&#039;s block list. It can block a file by file hash.However, if the attacker is using a Windows native tool, like compattelagent.exe&nbsp; as shown in the screenshot above; there isn&#039;t much it can do if you can&#039;t block it. So you NEED other layers of defense.I have chosen Comodo Firewall with it Auto Containment and Host Intrusion Detection System as my second layer. And used the HIDS to contain compattagent.exe. I haven&#039;t noticed any Windows malfunction so far.In order to use Comodo Firewall, I removed BitDefender&#039;s firewall module, because having 2 firewalls with each&#039;s own rules is a cause for confusion. This was done using the above Reconfigure Agent task.</blockquote>

[QUOTE="Victor M, post: 1066449, member: 96560"] Hello Everybody, This is my new BitDefender Endpoint Detection Response (EDR) test box. ( free trial 1 month ) It has the usual executive summary - which includes: Modules Installed, Risk Score, Incident Status, Top 5 Blocked Threats ... [ATTACH type="full" alt="BD Executive Summary.gif"]279867[/ATTACH] The client/agent has no features to toggle or play with. So I won't show it here. It has a Incidents section. [ATTACH type="full" alt="Incidents.gif"]279868[/ATTACH] And here is a screenshot of a real incident. [ATTACH type="full" alt="real incident.gif"]279869[/ATTACH] Here is a screenshot of all my machines (1), located in Network menu. [ATTACH type="full" alt="Network.gif"]279870[/ATTACH] And here is where you add modules to the agent, from Network, checkmark machine, click on Task button on top, and choose Reconfigure Agent. The Advanced Anti Exploit module is Not part of the default configuration of an agent, and must be manually added this way. [ATTACH type="full" alt="Network>Reconfigure Agent.gif"]279871[/ATTACH] I find that BitDefender EDR's native detection rules don't detect much. So I added my own rules, at Incident > Custom Detection Rules. It basically adds a detection rule by keyword. BitDefender EDR, like all EDR's, is primarily an anti-malware. When it's arsenal can't stop an attack, the EDR portion has one more weapon, and that is the EDR's block list. It can block a file by file hash. However, if the attacker is using a Windows native tool, like compattelagent.exe as shown in the screenshot above; there isn't much it can do if you can't block it. So you NEED other layers of defense. I have chosen Comodo Firewall with it Auto Containment and Host Intrusion Detection System as my second layer. And used the HIDS to contain compattagent.exe. I haven't noticed any Windows malfunction so far. In order to use Comodo Firewall, I removed BitDefender's firewall module, because having 2 firewalls with each's own rules is a cause for confusion. This was done using the above Reconfigure Agent task. [/QUOTE]

Verification