mondoo-edr-policy.mql.yaml

# Copyright (c) Mondoo, Inc.
# SPDX-License-Identifier: BUSL-1.1
policies:
  - uid: mondoo-edr-policy
    name: Endpoint Detection and Response (EDR) Policy
    version: 1.3.0
    license: BUSL-1.1
    tags:
      mondoo.com/category: security
      mondoo.com/platform: windows,linux,macos
    authors:
      - name: Mondoo, Inc
        email: hello@mondoo.com
    docs:
      desc: |-
        In today's ever-changing world of cybersecurity, it is crucial to ensure the strength of endpoint security. A reliable defense mechanism is the Endpoint Detection and Response (EDR) framework, which provides real-time monitoring, threat identification, and incident response capabilities. However, the effectiveness of this framework depends on the agents' deployment and functionality across organizational endpoints.

        In order to strengthen your cyber defenses and stay protected against emerging threats, it is essential to establish a policy that thoroughly confirms the presence and operational status of EDR agents. This policy aims to verify the installation of these critical components and ensure their continuous operation, thereby enhancing our resilience against malicious attacks.

        By implementing this policy, we take a proactive approach to instill confidence in our security posture and reinforce our commitment to safeguarding sensitive data, critical assets, and the integrity of our digital infrastructure.

        Additionally, it is highly recommended that antivirus signatures are updated daily to ensure protection against the latest threats. For instance, Windows Defender signatures can be updated using the following PowerShell command:
  
        ```powershell
        Update-MpSignature
        ```

        ## Local scan

        Local scan refer to scans of files and operating systems where cnspec is installed.

        To scan the `localhost` against this policy:

        ```bash
        cnspec scan local --policy-bundle mondoo-edr-policy.mql.yaml
        ```

        ## Remote scan

        Remote scans use cnspec providers to retrieve on-demand scan results without having to install any agents.

        For a complete list of providers run:

        ```bash
        cnspec scan --help
        ```

        ### Prerequisites

        Remote scans of windows hosts suitable authentication method such as winRM enabled or SSH keys.

        ### Scan a remote Windows (SSH authentication)

        ```bash
        cnspec scan ssh <user>@<IP_ADDRESS> -i /path/to/ssh_key --policy-bundle mondoo-edr-policy.mql.yaml
        ```

        ## Join the community!

        Our goal is to build policies that are simple to deploy, accurate, and actionable.

        If you have any suggestions for how to improve this policy, or if you need support, [join the community](https://github.com/orgs/mondoohq/discussions) in GitHub Discussions.
    groups:
      - title: Endpoint Detection and Response (EDR)
        filters: |
          asset.platform == 'macos' || asset.family.contains("linux") || asset.family.contains('windows')
        checks:
          - uid: mondoo-edr-policy-ensure-edr-agent-is-installed
          - uid: mondoo-edr-policy-ensure-edr-agent-is-running
    scoring_system: highest impact
queries:
  - uid: mondoo-edr-policy-ensure-edr-agent-is-installed
    title: Ensure EDR Agent is installed
    impact: 100
    docs:
      desc: |-
        This query checks if the EDR agent is installed on the system. The presence of an EDR agent is crucial for real-time monitoring, threat identification, and incident response capabilities. It is essential to ensure that the EDR agent is installed and operational to enhance the resilience against malicious attacks.
      audit: Please ensure that the EDR agent is installed on the system.
      remediation:
        - desc: |-
            Please install an EDR agent on the system, e.g. SentinelOne, CrowdStrike, ESET Endpoint Security, Wazuh
    variants:
        - uid: mondoo-edr-policy-ensure-edr-agent-is-installed-macos
        - uid: mondoo-edr-policy-ensure-edr-agent-is-installed-linux
        - uid: mondoo-edr-policy-ensure-edr-agent-is-installed-windows
  - uid: mondoo-edr-policy-ensure-edr-agent-is-installed-macos
    filters: asset.platform == 'macos'
    mql: |
      package('Falcon').installed || 
      package('SentinelOne Extensions').installed || 
      package('ESET Endpoint Security').installed || 
      file('/Library/Ossec').exists
  - uid: mondoo-edr-policy-ensure-edr-agent-is-installed-linux
    filters: asset.family.contains('linux')
    mql: |
      package('falcon-sensor').installed || package('SentinelAgent').installed || package('sentinelagent').installed || file('/opt/eset/RemoteAdministrator/Agent').exists
  - uid: mondoo-edr-policy-ensure-edr-agent-is-installed-windows
    filters: asset.family.contains('windows')
    mql: |
      package('CrowdStrike Sensor Platform').installed || 
      package('Sentinel Agent').installed || 
      package('ESET Endpoint Security').installed || 
      package('ESET Server Security').installed || 
      service('WinDefend').installed || 
      package('Wazuh Agent').installed ||
      ['Sophos Endpoint Defense', 'Sophos Endpoint Agent'].all(package(_).installed)

  - uid: mondoo-edr-policy-ensure-edr-agent-is-running
    title: Ensure EDR Agent is running
    impact: 100
    docs:
      desc: |-
        This query checks if the EDR agent is running on the system. The presence of an EDR agent is crucial for real-time monitoring, threat identification, and incident response capabilities. It is essential to ensure that the EDR agent is installed and operational to enhance the resilience against malicious attacks.
      audit: Please ensure that the EDR agent is running on the system.
      remediation:
        - desc: |-
            Please install the EDR agent on the system, e.g. SentinelOne, CrowdStrike.
    variants:
      - uid: mondoo-edr-policy-ensure-crowdstrike-agent-is-running-macos
      - uid: mondoo-edr-policy-ensure-crowdstrike-agent-is-running-linux
      - uid: mondoo-edr-policy-ensure-crowdstrike-agent-is-running-windows
      - uid: mondoo-edr-policy-ensure-sentinelone-agent-is-running-macos
      - uid: mondoo-edr-policy-ensure-sentinelone-agent-is-running-linux
      - uid: mondoo-edr-policy-ensure-sentinelone-agent-is-running-windows
      - uid: mondoo-edr-policy-ensure-eset-agent-is-running-macos
      - uid: mondoo-edr-policy-ensure-eset-agent-is-running-linux
      - uid: mondoo-edr-policy-ensure-eset-agent-is-running-windows
      - uid: mondoo-edr-policy-ensure-defender-agent-is-running-and-updated-windows
      - uid: mondoo-edr-policy-ensure-wazuh-agent-is-running-macos
      - uid: mondoo-edr-policy-ensure-wazuh-agent-is-running-windows
      - uid: mondoo-edr-policy-ensure-sophos-endpoint-defense-is-running-windows

  - uid: mondoo-edr-policy-ensure-crowdstrike-agent-is-running-macos
    title: Ensure CrowdStrike Agent is running
    filters: |
      asset.platform == 'macos'
      package('Falcon').installed
    mql: |
      services.where(name == /crowdstrike\.falcon\.Agent/).any(running == true)
      services.where(name == /crowdstrike\.falcon\.Agent/).any(enabled == true)
  - uid: mondoo-edr-policy-ensure-crowdstrike-agent-is-running-linux
    title: Ensure CrowdStrike Agent is running
    filters: |
      asset.family.contains('linux')
      package('falcon-sensor').installed
    mql: |
      service('falcon-sensor').running
      service('falcon-sensor').enabled
  - uid: mondoo-edr-policy-ensure-crowdstrike-agent-is-running-windows
    title: Ensure CrowdStrike Agent is running
    filters: |
      asset.family.contains('windows')
      package('CrowdStrike Sensor Platform').installed
    mql: |
      service('CSFalconService').running
      service('CSFalconService').enabled
  - uid: mondoo-edr-policy-ensure-sentinelone-agent-is-running-macos
    title: Ensure SentinelOne Agent is running
    filters: |
      asset.platform == 'macos'
      package('SentinelOne Extensions').installed
    mql: |
      service('com.sentinelone.sentineld-helper').running
      service('com.sentinelone.sentineld-helper').enabled
      service('com.sentinelone.sentineld-shell').enabled
      service('com.sentinelone.sentinel-extensions').running
      service('com.sentinelone.sentinel-extensions').enabled
      service('com.sentinelone.sentineld').running
      service('com.sentinelone.sentineld').enabled
      service('com.sentinelone.sentineld-guard').running
      service('com.sentinelone.sentineld-guard').enabled
  - uid: mondoo-edr-policy-ensure-sentinelone-agent-is-running-linux
    title: Ensure SentinelOne Agent is running
    filters: |
      asset.family.contains('linux')
      package('SentinelAgent').installed || package('sentinelagent').installed
    mql: |
      service('sentinelone').running
      service('sentinelone').enabled
  - uid: mondoo-edr-policy-ensure-sentinelone-agent-is-running-windows
    title: Ensure SentinelOne Agent is running
    filters: |
      asset.family.contains('windows')
      package('Sentinel Agent').installed
    mql: |
      services.where(name == /SentinelAgent/).any(running == true)
      services.where(name == /SentinelAgent/).any(enabled == true)
      services.where(name == /SentinelStaticEngine/).any(running == true)
      services.where(name == /SentinelStaticEngine/).any(enabled == true)
  - uid: mondoo-edr-policy-ensure-eset-agent-is-running-macos
    title: Ensure ESET Agent is running
    filters: |
      asset.platform == 'macos'
      package('ESET Endpoint Security').installed
    mql: |
      services.where(name == /com\.eset\.endpoint/).any(running == true)
      services.where(name == 'com.eset.enterpriseinspector.eiagent').any(enabled == true)
      services.where(name == 'com.eset.remoteadministrator.agent').any(enabled == true)
  - uid: mondoo-edr-policy-ensure-eset-agent-is-running-linux
    title: Ensure ESET Agent is running
    filters: |
      asset.family.contains('linux')
      file('/opt/eset/RemoteAdministrator/Agent').exists
    mql: |
      service('eraagent').running
      service('eraagent').enabled
  - uid: mondoo-edr-policy-ensure-eset-agent-is-running-windows
    title: Ensure ESET Agent is running
    filters: |
      asset.family.contains('windows')
      package('ESET Endpoint Security').installed || package('ESET Server Security').installed
    mql: |
      service('EraAgentSvc').running
      service('EraAgentSvc').enabled
  - uid: mondoo-edr-policy-ensure-defender-agent-is-running-and-updated-windows
    title: Ensure Windows Defender Agent is running
    filters: |
      asset.family.contains('windows')
      service('WinDefend').installed
    mql: |
      service('WinDefend').running
      service('WinDefend').enabled
      parse.json(content: powershell("Get-MpComputerStatus | Select-Object -Property AntivirusSignatureAge | ConvertTo-JSON").stdout).params.AntivirusSignatureAge == 0
  - uid: mondoo-edr-policy-ensure-wazuh-agent-is-running-macos
    title: Ensure Wazuh Agent is running
    filters: |
      asset.platform == "macos"
      file('/Library/Ossec').exists
    mql: |
      service('wazuh-agentd').running
      service('wazuh-agentd').enabled
  - uid: mondoo-edr-policy-ensure-wazuh-agent-is-running-windows
    title: Ensure Wazuh Agent is running
    filters: |
      asset.platform == "windows"
      package('Wazuh Agent').installed
    mql: |
      service('WazuhSvc').running
      service('WazuhSvc').enabled
  - uid: mondoo-edr-policy-ensure-sophos-endpoint-defense-is-running-windows
    title: Ensure Sophos Endpoint Defense Agent is running
    filters: |
      asset.family.contains('windows') &&
      ['Sophos Endpoint Defense', 'Sophos Endpoint Agent'].all(package(_).installed)
    mql: |
      service('Sophos Endpoint Defense Service').running
      service('Sophos Endpoint Defense Service').enabled
      service('Sophos MCS Agent').running
      service('Sophos MCS Agent').enabled