Monitoring your Windows devices is a critical part of ensuring environment security. Windows services can be monitored to assess appropriate use such as proper expected functionality, as well as detect threats such as suspicious activity involving high-value hosts, signs of data exfiltration, and even copyright infringement. The Windows content pack focuses on these specific events and helps highlight them for immediate investigation and timely resolution.
Content Pack Components
Alarms
Warn about external devices being connected to high-risk hosts.
- Windows– High Value Host External Media Activity
Reports
Designed to give a general overview into specific Windows events.
- Windows - System and Service Failure Report
Views
Provides more details into service failures and expand on where they are originating from.
- Windows System and Service Failures
- Windows External Media Activity
- Windows Application Failures
- Applocker EXE and DLL Events
- Applocker MSI and Script Events
- Applocker Packaged App Events
- Applocker Overview
Correlation Rules
Designed to fire when multiple failures occur or when malicious activity and failures have been detected in the same time frame.
- Windows - System or Service Failures on a Single Host
- Windows - System or Service Failure with Malicious Activity
- Windows - Application Crashes or Hangs on a Single Host
- Windows - Application Crashes or Hangs on Multiple Hosts
- Windows - BSoD System Crashes on Multiple Hosts
- Windows - BSoD System Crashes on a Single Host
- Windows - Multiple Failed EXE or DLL Applocker Events - Multiple Hosts
- Windows - Multiple Failed EXE or DLL Applocker Events - Single Host
- Windows - Multiple Failed MSI or Script Applocker Events - Multiple Hosts
- Windows - Multiple Failed MSI or Script Applocker Events - Single Host
- Windows - Multiple Failed Packaged App Applocker Events - Multiple Hosts
- Windows - Multiple Failed Packaged App Applocker Events - Single Host
Watchlists
Provides the capability to warn when high-risk hosts have external media connected to them.
- High-Value Hosts
Required Products
- McAfee Enterprise Security Manager (ESM) 11.x, 10.x
- McAfee Advanced Correlation Engine (ACE) 11.x, 10.x
- At least one Microsoft Windows Event Log - WMI data source added to the McAfee Enterprise Security Manager
- In order to use AppLocker-specific components, AppLocker will need to be established within your environment
Content pack demo
Content packs are available directly inside the McAfee Enterprise Security Manager user interface. Watch the video to discover how to access your content pack and get started.
Watch Video
Download Content Pack
Registered ServicePortal users can log in to access the Knowledge Center for further documentation or to download the content pack file manually.
Read Article