Automated Actions - Forensic Snapshot

Used Case - Lab Recreate

#1: As we stated in FAQ section. Forensic snapshots are taken only in case of “compromise”. In other words, if we try to access and download a malicious file from a TEST site and the file is flagged upon download and quarantined that is not considered a compromise and does not trigger the action.

Note: DFC Detection, Quarantine Failure, and pretty much anything that by the logic fall into the category of compromise event should create Forensic Snapshot.

#2: You can only generate Forensic Snapshot once on a unique compromised event it does not generate a snapshot unless you resolve the compromised machine in your inbox. If you don’t resolve the compromised event, you do not generate any other snapshot.

Example: In this lab, a script generates malicious activity, and because the file is deleted as soon as it is created and Secure Endpoint was not able to quarantine the file it falls in to compromise category.

Now in this test, you can look under automated actions and 3 things that happened based on the settings.

• Snapshot was created
• Submission was sent to Threat Grid (TG)
• The endpoint was moved to a separate group that was created and called ISOLATION

You can see all of that in this output, as shown in the image.

Now since this endpoint is compromised, the next test to prove the theory with a similar malicious file but with a different name, as shown in the image.

However, since this compromise was not resolved, you can only be able to create a TG submission. No other events were recorded, also turn off the Isolation prior to this 2^nd test.

Note: Please notice the time when the threat was detected and automated action triggers.

The event is not able to retrigger unless the compromised endpoint is resolved. In this case, the dashboard looks like this. Please notice the percentage and the button Mark Resolved along with the compromised events. No matter how many events are triggered you are only able to create one snapshot and the big percentage number never changed. That number represents compromise inside of your organization and it is based on the total amount of endpoints in your organization. It changes only with another compromised machine. In this example, the number is high due to only 16 devices in the lab. Also, note that compromise events are auto cleared once they reach 31 days of age.

The next step is to create another event and generate a forensic snapshot. The first step is to resolve this compromise, click on the Mark Resolved button. You can do that per endpoint or you can select all in your organization.

Note:  If you select all the compromises are reset to 0%.

Once the Mark Resolved button is selected and since only one endpoint was compromised on the Secure Endpoint dashboard looks like this. And at this point, a new compromised event on the test machine was triggered.

The next example triggers an event with a custom script that creates and deletes a malicious file.

Secure Endpoint console once again compromised, as shown in the image

Here are new events under Automated Actions, as shown in the image.

When the hostname under Automated Actions is selected, it redirects to Device Trajectory where you can observe the snapshot being created once you expand the computer tab, as shown in the image.

And minute later snapshot is created, as shown in the image.

And now you can view the data displayed.

Tip

In very large environments with thousands of endpoints and hundreds of compromises, you can run into situations where the navigation to the individual endpoint might be a challenge. Currently, the only available solution is to use the heat map and then drill down to a specific group where your compromise endpoint is as in this example below.

Once the group is selected in the heat map navigate to that group in which we have compromised the event. Since there is only one endpoint in that group please notice the 100% compromised which is based now on the specific group that we are in. In other words, if we have 2 endpoints in this group one clean and the other compromised displays 50% compromise.