cau - epm n discovery v4应用程序发现

EPMFundamentals

ApplicationDiscoveryCyberArkUniversityPrivilegedManagementImplementationWorkflowServerInstallationAgentDeploymentSilentApplicationDiscoveryPolicyCreationExceptionManagementReportingAUDITINGPOLICIESDISCOVERYDEPLOYMENTINSTALLATIONObjectivesThissessionwillenableyoutodiscoverapplicationsandprivilegedactionsusing:PrivilegeManagementandApplicationControlInboxesEnd-UserMessagingAgentConfigurationApplicationCatalogThreatIntelligenceNotethattheapplicationcatalogandthreatintelligencefunctionalityarenotavailableintheGPOeditionofEPM.PrivilegeManagementInboxPrivilegeManagementInboxEventCollectioncapturesactionsrequiringelevatedprivilegesfromend-usercomputersanddisplaystheminthePrivilegeManagementInboxIncludesOSactionsandapplicationsthatrequireelevatedcredentialsBasedonthecollectedevents,policiescanthenbecreatedtoallowelevationofuserprivilegesforspecificactionsorapplications.HowAreActionsDetected?Threemethodstodetectwhenelevationisrequired UACtriggeredDefault,mostreliable,somecustomersmayneedtoswitchUAConfordiscoveryInternalmanifestChecksXMLfileembeddedinEXE,looksforflagthattriggersUAC<requestedExecutionLevellevel="highestAvailable“>NotallapplicationsthatrequireelevationcontaincorrectlyconfiguredmanifestApplicationexitswithreturncodeshowingthataccesswasdeniedHowAreActionsDetected?UACneedstobeactivatedonendpoints

BewareofGPOoverridinglocalsettingsorpolicyComputerConfiguration=>WindowsSettings=>SecuritySettings=>LocalPolicies=>SecurityOptionsStartingEventCollectionTostartEventCollectionclickonPrivilegeManagementInbox

thenEventCollectionThisopensadialogforEventCollectionconfigurationStartingEventCollectionThepolicysectiondeterminestheelevationpolicyduringthediscovery:CollectPolicyAutomationEventsDefaultDeny:allelevationrequestsfromnon-adminuserswillfailElevateanyApplicationifnecessaryDefaultAllow:allelevationrequestswillbeallowedNote:TheselectionchangestheoptionsinthefollowingwizardEvents(CollectOption)CollecteventstriggeredbyEnd-useractionsonlyUseheuristicstocatchunsuccessfullaunchesIfunchecking“CollecteventstriggeredbyEnd-useractionsonly”,makesuretocheck“Useheuristicstocatchunsuccessfullaunches”NotifyAdministratorbyEmailDonotusethisoptionduringinitialdiscovery!Events(CollectOption)CollectEnd-usermanualrequestAllowsuserstocreateamanualapprovalrequestinEPMControlPanelRequeststhenappearinPrivilegeMgmtInboxUserTypes(CollectOption)SetwhethereventswillbecollectedforstandardoradminusersComputersinSet(BothOptions)LimitwhichcomputersinsetwillbeusedfordiscoveryADComputerGroups(BothOptions)UsingADGroups,limitwhichcomputerswillbeusedfordiscoveryOSUsers(BothOptions)LimitwhichADusersorgroupswillbeusedfordiscovery

Ifnouserorgroupisselected,eventsfromallusersloggingontomonitoredsystemswillbediscoveredEnd-UserUI(ElevateOption)Setwhetherelevationwilloccurforstandardand/oradminusers

Choosewhetherdialogorballoonwillbedisplayedorifmessagewillbesuppressed

ElevationbehaviorcanbedefinedforShowBalloon,notShowDialogManualElevation(ElevateOption)Allowsuserstoright-clickonanexecutableandchoosetheoptionRunwithElevatedPrivilegesEventisdisplayedinPrivilegeManagementInboxEventsCollectedintheInboxOnceEventCollectionhasstarted,InboxwillbepopulatedwithapplicationsandoperationsthatrequireAdminPrivileges.TheInboxpresentsanaggregated,filterabledisplayofalleventscollected.PoliciesfortheEventscanbecreatedfromtheInboxortheycanbeassignedtoanApplicationGrouporAdvancedPolicy.ClickonsymbolornumberinEventscolumnformoredetailTimelineHelpsdecideifapplicationismaliciousornotShowsinformationon:ApplicationFamilyTreeReputationAppliedPoliciesAccessedObjectsAssociatedComputersandEventsCreatepoliciesbyclickingonActionsSeemoredetailonassociatedeventsbyclickingonApplicationControlorPrivilegeManagementEvents.EventSummarySummaryofelevationrequestsorapplicationlaunchesonallmachinesClickonsymboltoseeinformationonindividualeventsApplicationControlInboxApplicationControlInboxApplicationControlcapturesapplicationinstallationsandlaunchesonEPMEndpoints.Unhandled,orgrey-listed,applicationsappearaseventsintheInboxBasedonthecollectedevents,policiescanthenbecreatedtoblack-listorwhite-listthedetectedapplications.WhatisanUnhandledApplication?Agrey-ListedorunhandledApplicationisnotyethandledbyapolicyAssoonasapolicyortrustedsourceiscreatedforanapp,oritisassignedtoanapplicationgroup,alleventsforthatapplicationwilldisappearfromtheinboxApplicationControlInbox–DefaultActionOff:Unhandledappslaunch,eventsarenotcapturedMonitor:Unhandledappslaunch(norestrictions),eventsappearininboxRestrictaccess:UnhandledappslaunchwithrestrictionsonresourceaccessDefaultDeny:UnhandledappswillnotlaunchandeventsmaynotappearintheinboxMonitorWizard-LaunchesFirsttabdetermineswhetherthelaunchofanunhandledapplicationwillgenerateanevent.Defaultisoff,putaticknextto

StartofUnhandledApplicationstocaptureevents

SelectdesiredEnd-userUI

behaviourMonitorWizard-InstallationsofnewUnhandledApplications

SelectwhetherInstallationsofnewUnhandledApplications

willgenerateeventsintheApplicationControlinboxornotNote:Aninstallationtypicallyrequiresadminprivilegestorun,soitismorelikelytoappearintheprivilegemanagementinboxthanintheApplicationControlinbox!MonitorAccesstoNetworkandLocalResourcesbyUnhandledApplicationsPuttingticknexttoAccesstonetworkandlocalresourcesactivatesadditionaltabstoactivatemonitoringofapplicationaccessto:Internet/IntranetNetworkSharesLocalResourcesMemoryMonitorAccesstoNetworkandLocalResourcesbyUnhandledApplicationsThiswizardwillonlyactivatemonitoringofthedifferenttypesofresourcesaccessedbyunhandledapplications

TheonlyoptionsareMonitorandDoNotMonitor,thereisnooptioninthiswizardtorestrictaccesstoresources.LimitScopeofPolicyThepolicycanberestrictedto:ComputersinSetADComputerGroupsOSUsers(includingADGroups)OldApplicationOldapplicationsareapplicationfilesthatwerepresentonthesystembeforetheEPMagentwasinstalledThisboxistickedbydefaultmeaningoldapplicationsthatarenothandledbyapolicywillbemonitored.RestrictAccessActivatingtheRestrictAccesspolicyallowsapplicationstolaunchbutwithrestrictionsontheiraccesstoparticularresourcesRestrictAccessWizardWizardallowsgranularcontrolofaccessandloggingforunhandledapplication’saccesstodifferentresourcetypesIdenticaloptionstotheMonitoroption,exceptthatitispossibletochoosetorestrictaccessinsteadofmonitoring.Formonitoring,setAccesstoAllowandFullLogtoLocalFailedaccessgeneratesaneventintheinbox.DefaultDenyAnyunhandledapplicationwillnotbeallowedtorun,blockingallapplicationsnotcoveredbyapolicy.Notmendedfordiscovery,asaneffectivepolicysetwillnotyethavebeendefined.EventsforunhandledapplicationswillnotbegeneratedifDefaultDenyisenabledDefaultDenyWizardOptions-MonitorSetwhatwillbedisplayedtoend-userwhenappisblockedShowDialogShowBalloonShowNothingSetwhetherattemptstostartblockedapplicationswillgenerateaneventintheinbox.RansomwareProtection

and

AppsInstalledfrom

RemovableMediaorInternetRansomwareRansomwareisagrowingrisk,withenterprisesfacingextortiontorecoverdataencryptedbymalware.ClickontheRansomwareicontoactivatetheprotectionpolicyCanbesettomonitororrestrictappaccesstodataRansomware-AccessSelectfiletypesforwhichaccesswillberestrictedSpecifywhichfolderswillbemonitoredoraddnewfiletypesusingwildcardsbyclickingonAddFolderorAddFilerespectivelyRansomware-TrustedSelectwhichapplicationsareallowedtoaccessdocumentfiles.DefaultsareexecutablesfromMicrosoft,Google,AdobeandCyberArk,alongwithMicrosoftWindowsStoreAppsExceptionscanbeaddedusingNewRansomware-MonitorIfRansomwareprotectionisactivatedwhilethedefaultpolicyisMonitor,Ransomwarepolicywillonlymonitor,notprotectRansomwareprotectionwillonlyrestrictmalwareaccesstoprotectedresourcesifdefaultpolicyissettoRestrictInternetandRemovableMediaSetseparatepolicyforappsinstalledfromInternetorfromremovablemediaOverridesdefaultpolicyofMonitor,RestrictAccessorDefaultDenyClickonInternetorRemovableMediatoactivateInternetandRemovableMedia-ActionFirstwizardscreenofwizardallowstochoosedefaultactionOverridesdefaultpolicyofMonitor,RestrictAccessorDefaultDenyOtherscreensaresameasfordefaultpolicies.ApplicationCatalogApplicationCatalogTheApplicationCatalogdisplaysalistofdiscoveredapplicationsEvenifthecatalogisdeactivated,appsdisplayedinApplicationControl&PrivilegeManagementinboxesarealsoshownhereScanscanalsobelaunchedtodiscoverapplicationsinuseintheenterprise.ApplicationCatalogResultofscansaredisplayedincatalog

Re-scanAllComputersbestrunaspartofdiscoveryprocessScanninganIndividualMachineOpentheMyComputerspageSelectdesiredmachinefromlistClickonComputer

then

Re-scanApplicationFilesEndUserMessagingEndUserCustomMessagesEPMallowsorganizationstoextensivelycustomizethemessagesthataredisplayedtoendusersrelatedtopolicyexecutionandpolicyautomationEndUserCustomMessagesTheEPMApplicationrequiresadministrativeprivilegesmessagereplacesthestandardWindowsUACmessage

Usingtags,canincludehyperlinktosendemailtohelpdeskEndUserCustomMessagesEnd-userexperience:Clickingonherewillcreateaprepopulatedemailwhichincludesapplicationanduserinformation.ShowNotificationAreaIconAdvanced>AgentConfiguration>End-UserUI

Thissettingcanbeusedtochangetheiconorswitchitoffcompletely

NotethatEPMAgentballoonmessageswillnotbedisplayedifthisoptionisturnedoffHideCyberArkEPMAgentfromInstalledProgramsAdvanced>AgentConfiguration>End-UserUI

RemovestheEPMAgentfromlistofinstalledprograms("UninstallorChangePrograms","AddorRemovePrograms".)Eventhisoptionisnotactivated,Agentself-protectionwillpreventusersuninstallingtheagentProtectAdministratorsGroupAdvanced>AgentConfiguration>PoliciesWhenturnedon,administrativeUserGroups(localAdministrators,etc.)cannotbemodified.Note:MaylimitfunctionalityofsomeApplications,e.g."LocalUserandGroup"AdministrativeTask.

DefaultvalueisOffThreatIntelligenceUsingThreatIntelligenceServicesEPMcanintegratewithseveraldifferentservicestocheckwhetheraparticularapplicationismaliciousornot

Somearedeliveredout-of-the-box,othersrequireaseparatelicenceThreatIntelligenc