Skip to content

Latest commit

 

History

History
72 lines (50 loc) · 2.5 KB

README.md

File metadata and controls

72 lines (50 loc) · 2.5 KB
Raw

MVISION EDR Real Time Search - RTS

Welcome to the public knowledge-ground to bootstrap your expertise for hunting and thriving with MVISION EDR Real Time Search - RTS.

In this section we provide practical reasons and examples of baseline queries practitioners adopt for learning the environment they are defending.

We are aiming to relate our query examples with public domain resources like SANS, or research from individual security professionals in the community.

Using this repo

In the code blocks, we are providing the query syntax, you can copy/paste into your Real Time Search - RTS.

Throughout the content, we build from basic to more elaborate queries.

This repo is broken down by category of collectors in each section, and the table below represents how to find/associate queries to use-cases.

Query Language Orientation

The table below serves as the initial orientation of the McAfee Real Time Search (RTS) language.

Practitioners can find practical a how-to for MVISION Collectors and advance their needs for unique threat hunts applicable to their needs.


Category Location
FileSystem Queries That Support File Activity (CRUD)
Networking Queries That Supoport Network Flow Activity
User Logins Queries That Support Windows Logins
Processes Queries That Support Process Execution Activity
Patches Queries That Support HotFix Information
Registry Queries That Support The Presence of Info in the WinRegistry
Services Queries That Support The Windows Service Manager Activity
Software Queries That Support Software Versioning
CVEs Soon
IoCs Soon

Query Examples

Below you can see the format of this guide. We will expose the question (need) in bold and the query used to answer the question.

Example - Systems Management Needs

What Systems have MVision EDR Installed

HostInfo connection_status, hostname, ip_address, platform

What Systems are actively managed and are ONLINE

HostInfo connection_status, hostname, ip_address, platform
    WHERE HostInfo connection_status equals "Online"

What Systems are actively managed and are not a Windows PC

HostInfo connection_status, hostname, ip_address, platform
    WHERE HostInfo connection_status equals "Online"
        AND HostInfo platfom not equals "Windows"


Repository Contacts

Repo Owners Email Contact
Carlos Diaz [email protected]
Ismael Valenzuela [email protected]