Atomic Endpoint Defender HIDS Configuration¶
Introduction¶
AED includes a powerful Host Based Intrusion Detection System (HIDS). This HIDS will look for suspicious activity, suspicious processes, malicious files and other signs of malicious and supsicious activiy. It will also aggregate the systems logs and look for signs of attack, authentication failures, errors in applications, and other important information.
Configuring AED HIDS¶
You can access the HIDS configuration options by following this process:
Step 1: Log into the AED GUI
Step 2: Click on the ‘Settings’ tab
Step 3: Select ‘AED Configuration’
Step 4: Select ‘Host Intrusion Detection System’
Editing AED HIDS Rules¶
You can edit specific HIDS rules by following this process:
Step 1: Log into the AED GUI
Step 2: Click on the ‘AED’ tab
Step 3: Select ‘WAF and HIDS Rules’
Step 4: Select ‘HIDS’
Suspicious Behavior Rules¶
By default, AED comes with a powerful set of rules that should detect and stop most attacks, without generating false positives. AED also includes additional rules that are enabled, but are set to a lower priority and will not automatically block the activities they detect. AED will only alert on these events, it will not take an active response actions.
To change this behavior you can search for rules with an alert level below 5. Level 5 is the default level to block an action (AED will automatically block the action from succeeding and will, if configured to do so, shun the IP address).
Reconfiguring HIDS Rules¶
To reconfigure a rule simply pull up the rule manager and type in the Rule ID into the search field. For Example:
Step 1: Log into the AED GUI
Step 2: Click on the ‘Configuration’ tab
Step 3: Select ‘Rule Management’
This will bring up the Rule Managment window.
Step 4: Select the ‘Rules’ tab
Step 5: Type in the Rule ID, for example 60815
Step 6: Click on the down arrow next to the Rule ID, this will pull up all the options for the rule. Please see the example below:
Step 7: Select the Active Response drop down and change it to “yes”
Step 8 (Optional, but recommended): We also recommend you change the alert level to 10, that way it will both show up in the AED GUI and you will get an email alerting you when its been activated. If you do not want to be emailed or alerted, just leave the level at 4. You can also select Email and Logging options should you prefer that you be emailed but not notified in the GUI and/or vice versa.