HawkEye XDR Agent
The HawkEye XDR agent is a robust endpoint security threat detection and prevention solution designed for deployment on user devices and server compute infrastructure to provide unparalleled visibility.
It provides continuous data collection, on-demand forensic capabilities, and automated
response to evolving threats. With its advanced features, the agent ensures comprehensive
protection and real-time visibility across your infrastructure.
HawkEye XDR agent does not replace your existing NGAV or EDR, rather it augments it to work seamlessly with HawkEye XDR platform.
Key Features
Technical Specifications
Device Security Posture
Software Bill of Materials
Maintains the inventory of installed applications and libraries, including the below details.
- Name
- Version
- Vendor
- Format
- Size
- Install Time
- Architecture
- Description
- Filepath
- Checksum
Device Inventory
Device inventory maintained includes the below details.
- Hardware
- Motherboard Serial Number
- CPU information
- Memory Information
- Operating System Information
- OS Name
- OS Version
- OS Platform
- OS Major Release
- OS Minor Release
- Hostname
- Windows update details
- Network Interfaces
- Name
- Adapter
- State
- MAC Address
- Sent Packets
- Received Packets
- Sent Bytes
- Received Bytes
- Dropped Packets (sent and received)
- IP Address
- Netmask
- Gateway
- DHCP Status
- Network Connections
Vulnerability Assessment
Vulnerability detection begins with the HawkEye XDR periodically collecting a Software Bill of Materials (SBOM) from monitored systems, which is then transmitted to a centralized database.
A specialized detection module on the server analyzes the SBOM, comparing it against vulnerability intelligence to identify potential security risks. This analysis is based on Common Vulnerabilities and Exposures (CVE) records, sourced from our Cyber Threat Intelligence (CTI) platform.
Security Configuration Assessment
The Security Configuration Assessment (SCA) module helps security teams identify and address misconfigurations within their infrastructure. Agents scan the monitored endpoints using predefined policy files, which contain specific checks tailored for each system.
This module includes ready-to-use SCA policies based on the security benchmarks established by the Center for Internet Security (CIS). These benchmarks provide essential best practices for securing IT systems and safeguarding sensitive data.
Information thus obtained along with information from other modules such as File Integrity Monitoring, Vulnerability Assessments etc. along with tagged rulesets provide information on compliance with PCI DSS, HIPAA, NIST 800-53, TSC, and GDPR frameworks and standards.
Threat Detection
Log Collection
Log collection is the primary method for threat detection, centralizing event data from various systems, applications, and devices to provide critical insights for identifying security incidents, monitoring activity, and enabling timely response to potential threats. The Hawkeye Telemetry agent collects logs mainly using the below methods.
- Event log collection
- Logs from flat files
- Remote logs via syslog forwarding
- API based collection for SaaS and PaaS applications
- Docker log collection for containerized applications
Logs thus collected are normalized and shipped to the centralized analysis engine for further enrichment and analysis.
Log Enhancement
The HawkEye telemetry agent offers advanced monitoring capabilities for enhanced threat detection and analysis. It captures critical data, including detailed event logs for process creation, file and registry changes, network connections, and more, enabling deep visibility into system activities.
- Key Capabilities of the HawkEye Telemetry Agent:
- Process creation and termination tracking
- File creation and modification monitoring
- Registry changes and key tracking
- Network connection logging
- Driver and image load monitoring
- Raw disk access detection
- Thread injection detection
File Integrity Monitoring
The HawkEye telemetry agent’s File Integrity Monitoring (FIM) capability helps track and log all changes to critical files and directories, making it invaluable for maintaining visibility into system modifications. This feature supports change tracking, ensuring that all adjustments are documented and authorized, which is critical for regulatory compliance. Additionally, FIM plays a key role in ransomware detection by identifying unauthorized or unexpected file alterations, helping organizations respond quickly to potential attacks and safeguard sensitive data.
Registry Integrity Monitoring
The HawkEye telemetry agent includes Registry Integrity Monitoring, which tracks changes to critical registry keys and values in real-time. This feature is vital for detecting unauthorized or suspicious modifications that could indicate a potential security breach. By keeping a record of all registry alterations, it aids in change tracking, ensuring that only approved modifications are made. This capability also supports regulatory compliance by maintaining a secure baseline configuration. Additionally, it enhances ransomware detection by identifying malicious registry changes that are often associated with such attacks.
Threat Detection
- Real-time system queries: Allows for live data collection across endpoints, providing visibility into processes, services, and configurations.
- Forensic data collection: Enables retrieval of disk, memory, and log data for detailed offline investigation.
- Automated artifact retrieval: Simplifies the collection of critical data to accelerate incident response and remediation efforts.
Digital artefacts thus collected include the below.- File and directory metadata: Captures information on file creation, modification, and deletion.
- Network connections: Logs active network connections and associated processes.
- Process and service information: Tracks running processes and service changes over time.
- Registry modifications: Monitors changes to critical registry keys.
- Memory and disk snapshots: Collects forensic data from memory and disk for offline analysis.
- Event log capture: Gathers system, application, and security event logs for investigation.
Containment
The HawkEye telemetry agent features an Automated Response capability that enables swift, rule-based actions in response to detected threats. This automation allows the agent to mitigate risks in real-time, such as blocking malicious IP addresses, isolating infected systems, or stopping suspicious processes.
Example Automated Response Actions
- Block connections to specific IP addresses using host firewall
- Isolate the device from the network
- Trigger a custom script when a particular event is logged.
- Trigger collection of DFIR Artefacts to remote server when a particular event is logged.