Harmony Endpoint Telemetry Tracking for Windows

gg_fga — Fri, 02 Feb 2024 13:50:23 GMT

Hello,

Is it possible to have the list of items monitored by Harmony Endpoint?

I have a list of items below, for each item, I would like to know if it is:

Implemented

Not Implemented

Partially Implemented

Via Windows EventLogs (EDR is inspecting windows event logs to collect the telemetry)

Via EnablingTelemetry (Additional telemetry that can be enabled easily as part of the Harmony Endpoint solution but is not ON by default.)

Item list:

Telemetry Feature Category	Sub-Category
Process Activity	Process Creation
	Process Termination
	Process Access
	Image/Library Loaded
	Remote Thread Creation
	Process Tampering Activity
File Manipulation	File Creation
	File Opened
	File Deletion
	File Modification
	File Renaming
User Account Activity	Local Account Creation
	Local Account Modification
	Local Account Deletion
	Account Login
	Account Logoff
Network Activity	TCP Connection
	UDP Connection
	URL
	DNS Query
	File Downloaded
Hash Algorithms	MD5
	SHA
	IMPHASH
Registry Activity	Key/Value Creation
	Key/Value Modification
	Key/Value Deletion
Schedule Task Activity	Scheduled Task Creation
	Scheduled Task Modification
	Scheduled Task Deletion
Service Activity	Service Creation
	Service Modification
	Service Deletion
Driver/Module Activity	Driver Loaded
	Driver Modification
	Driver Unloaded
Device Operations	Virtual Disk Mount
	USB Device Unmount
	USB Device Mount
Other Relevant Events	Group Policy Modification
Named Pipe Activity	Pipe Creation
	Pipe Connection
EDR SysOps	Agent Start
	Agent Stop
	Agent Install
	Agent Uninstall
	Agent Keep-Alive
	Agent Errors
WMI Activity	WmiEventConsumerToFilter
	WmiEventConsumer
	WmiEventFilter
BIT JOBS Activity	BIT JOBS Activity
PowerShell Activity	Script-Block Activity

Note that this list was retrieved from a GitHub project, but I can't mention it due to Check Point community rules.

Kind regards,

Re: Harmony Endpoint Telemetry Tracking for Windows

PhoneBoy — Fri, 09 Feb 2024 21:15:57 GMT

I'm fairly certain sharing a link to this would not violate any community rules.
Having said that, if you're concerned about that, please provide the link to me in a PM.

In any case, this reads like something that would appear in an RFI/RFP.
For these sorts of questions, best to engage with your local Check Point office.

Re: Harmony Endpoint Telemetry Tracking for Windows

gg_fga — Wed, 14 Feb 2024 16:28:57 GMT

Hi,

I already posted the same topic with the link, but it was rejected. I'll send it to you by PM.

The idea is to make Check Point more widely known, and I'm sure that the EDR answers many of the points listed.

topic Re: Harmony Endpoint Telemetry Tracking for Windows in Endpoint

Harmony Endpoint Telemetry Tracking for Windows

Re: Harmony Endpoint Telemetry Tracking for Windows

Re: Harmony Endpoint Telemetry Tracking for Windows