This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

Review of existing solutions for VM/workstation management (updates/patches, configuration issues)

We feel as though our project idea should combine aspects of a SIEM product (Security information event management) and also elements of more general endpoint management platforms. Thus, we've separated our comparison into the two categories, and included some products that also offer general antivirus features.

Patch mgmt / general endpoint management / AV

ManageEngine

• ManageEngine's patch management pushes patches to endpoints, and allows for easy audits to meet compliance requirements.
• A type of EDR Has features that allow you to push patches to endpoints + allows you to quickly inventory and audit system configs (helpful to ensure environments is up to code in terms of compliance)
• It supports Windows, Linux, MacOS, and mobile platforms.
• Patch Management can be combined with Endpoint Central for more general management tasks of an endpoint inventory, offering software deployment, OS configuration, remote control, etc.
• Aimed at small to large businesses (relatively affordable price plans)
  • Has a free 30-day trial version for smaller environments (5 techs + 25 devices)
  • You will need to pay in order to continue use and gain full access to this service
• Forum users indicate that this is a useful tool at an affordable price, but support may not be 100% there all the time for when you need it.
• Proprietary software → Users rely on service to work properly
• Available both via Cloud or on Prem

Azure Arc

• Hybrid (Multi-Cloud + On-Site) management platform that helps to consolidate Windows Environments used by DevOps and IT teams.
• Some basic features are free for servers that already support Azure Arc (Windows Servers + Azure-ARC enabled Kubernetes clusters) which includes Inventory, management, and some VM management services.
  • Additional features include security, governance, and monitoring tools that can be added to your environment at extra costs.
• Aimed at medium or larger organizations that need to manage more complex environments that may span across multiple sites and cloud platforms
• One notable feature is that Azure Arc is able to integrate into hypervisors such as VMware vSphere to provide centralized management.
• Service appears to be complex and requires a rather steep learning curve in order to use it to its full potential.

NinjaOne

• Remote Cloud Monitoring and Management Software, useful for automating, managing, and remediating IT tasks across a large number of workstations
• Aimed at medium to large scale organisations
• Can provide an inventory of systems for management
  • Provides system info as well as status alerts for running system updates as well as basic alerts if your system’s antivirus is disabled or if it is missing some security patches
• Has ticketing and remote desktop support features (also ability to create and run scripts on user endpoints)
• Offers free trial, then you must pay a subscription in order to continue managing your environment

AutoMox

• Cloud-based RMM tool used to implement patch management and monitoring for endpoint devices (Windows, MacOS, Linux)
• Aimed at small/medium/large businesses
• Free trial but you will need to pay subscription for full use
• Can run some automations and scheduled tasks using PowerShell and Bash Scripts
• Similar to NinjaOne in feature set (ex. Dashboard Inventory + alerts for systems, can run scripts and automations for patch management as well as remote access to endpoint systems for support via Splashtop remote desktop)

FleetDM

• Open Source device monitoring and management platform
• Offers free and paid plan options (that include additional features and support options)
  • Local host (free) and Cloud Hosted options available
• Mainly uses OSQuery to manage its environment, which is an open source tool used to acquire and monitor endpoint system information as well as generate alerts for security issues detected.
• Supports Windows, Linux, MacOS, as well as Also allows for Mobile Device Management (MDM)
• FleetDM’s API can be integrated with platforms such as Ansible to run automation tasks as well as scripts in response to specific system activities or security alerts

BitDefender

• Computer Antivirus solution available for Windows, Linux, and MacOS
• Offers a free/basic option that includes virus scanning and real time protection
  • Paid premium option offers additional features that include VPNs, password managers as well as ransomware protection/prevention measures.
  • This version can be run local hosts
• Also a paid cloud version (Bitdefender Central) for small-large businesses which provides similar features to above but allows for centralized management
  • Offers Managed Detection and Response (MDR) as well as Extended Detection and Response (XDR) Capabilities
  • This version of Bitdefender offers a dashboard that allows you to view an inventory of your systems managed by your organization
  • An agent is installed onto each endpoint system to allow centralized management
  • Bitdefender Central also allows you to view the status of systems as well as run automations used generate reports on the health of an organization’s managed devices

Ivanti Security Controls (Specifically mentioned vCenter snapshot support!!)

• Offers features for endpoint patching and management, software deployment, as well as remote desktop capabilities for support
• Supports Windows, Linux, and MacOS platforms
• Also offers features that allow it to be integrated with virtualization environments such as vCenter/VMWare (can take snapshots
• Free trial is available, but you need to pay for full version and to use software after trial expires
• Can be local hosted within a Windows Server Environment or run via cloud application
• Uses agents installed on endpoint system that report back to a central server for management of system monitoring and alerts

BatchPatch

• BatchPatch offers Windows-only patching management for Windows clients that are Win10/Srv2016 and newer.
• Uses PsExec to connect to the managed hosts, so no endpoint program is needed on each one.

SIEM Tools

Wazuh

• Robust, Open Source XDR (Extended Detection & Response) and SIEM (Security Information and Event Monitoring) tool.
• Wazuh is able to acquire system information as well as generate alerts for security events that occur on the system.
• Comes with a standard set of alerts that are able to pick up most security events, you can also configure additional modules to look for and gather other information from endpoint systems as well.
• Extensive community and documentation for how to set up, install, and use the tool.
• Available as a Free Local Host or Paid Cloud Solution.
• Has tools that can help an organization meet compliance requirements for frameworks such as (PCI DSS, GDPR, CIS, HIPAA, and NIST 800-53).
• SCA (Security Configuration Assessment) Module can be configured to run scripts in the event that a specific security event is triggered, which can be useful in situations where you need to patch system vulnerabilities.

Main Drawbacks:

• Learning curve might be a bit much for people not familiar with managing a SIEM or setting up/filtering agents and alerts for systems
  • You can configure more/less alerts, but you will need to learn how to configure this yourself to suit your environment's needs
• The Local Host option requires that you set up and maintain services on your own.

Components:

• Wazuh (localhost) consists of the following components:
  • Wazuh Indexer - Used to store and search for alert entries generated by the Wazuh Server
  • Wazuh Server - Main backend server component responsible for processing log data acquired from the Agents. Will process incoming data with known threat intelligence and IOCs (Indicators of Compromise) rules to generate alerts.
  • Wazuh Dashboard - Web GUI portal that provides dashboard views to allow security analysts to monitor system alerts as well as view and manage Agent status.
  • Wazuh Agents - Installed onto endpoint systems for security monitoring and sends data back to the Wazuh Server (available for Windows, MacOS, and Linux Platforms). Communication between the client and server systems are secured using specific TCP ports and TLS/SSL certificates to encrypt communications (AES) being sent over the network.

ELK Stack

• Network Monitoring service used for centralized log management, system monitoring and data analysis.
• Offers a free open-source version that can be self-hosted on bare metal or run via docker containers.
• Also offers a premium version as well as options that can be hosted in the cloud that can offer additional features that include enterprise support, and machine learning capabilities.
• Supports Windows, Linux, and MacOS platforms
• Can implement automatic response actions in the event that an alarm or security condition is detected/triggered on an endpoint system (useful for detection of malicious activity and remediation of affected systems)
• Also extensive documentation is available online on how to setup and configure the ELK stack

Main Drawbacks:

• Steep learning curve for beginners, setup is extensive and it can take some time for new users to become familiar with configuring endpoints, filters, and alerts for logs.
• You also have to maintain your ELK stack as well if you choose to self host this environment

Components:

• Elasticsearch - Open Source source service used to quickly index and store gathered logs within a database structure. This is useful for gathering and analyzing large volumes of system logs and data.
• Logstash - Service used to aggregate and process data. Logstash is able to take incoming system log data sources from Beats, and transform the data into a format that can be used in services such as Elasticsearch.
• Kibana - Provides the WebUI dashboard that can be configured to help visualize/analyze system data and logs gathered from endpoint devices.
• Beats - Data collection service used to send logs and data from endpoint devices to services that can store and analyze this data (ex. Elasticsearch and or Logstash)

Splunk

• Commercial SIEM (Security Information and Event Management) and SOAR (Security Orchestration, and Automation and Response) platform that can allow you to monitor the security events of endpoint devices as well as automate response and remediation in the event that a security incident is detected.
• Targeted at more enterprise environments and can be run self hosted (also paid cloud option is also available)
  • Setup consists of forwarders that collect data on endpoint devices, forwarders send the data to the splunk indexer which stores the collected logs and data into a format that can be used for analysis, from here splunk search heads are used to analyze the collected data in order to generate dashboards and create reports on the status of the organization’s endpoint systems.
• Offers free license version with limited features available.
  • You are limited to 1 instance of splunk and can only index 500MB of data per day with the free version
  • Most alerting, search, and management capabilities are also not available in this version
• Paid enterprise license version enables features such as:

  • 500MB of index data per day

  • Alerting
  • Clustering of services that can support search (log data analysis) and deployment management (endpoint systems)
  • Splunk Customer Support
• Some main downsides to this service would be pricing for an enterprise license as well as the learning curve and maintenance of the Splunk Service due to its complexity

MS Sentinel (Microsoft Sentinel)

• Cloud Native proprietary SIEM and SOAR platform that can be used to analyze system status and logs from endpoint devices as well as push security patches, updates and remediation in the event that a security alert is triggered.
  • Automation rules and playbooks are available to be run in response to certain alerts
• MS Sentinel is scalable and can be implemented within small to large organizations
• Supported endpoint platforms include: Hosted instances on Azure, AWS and or GCP cloud, as well as on prem (Windows, Linux, MacOS)
• Can be implemented within Azure ARC

Main Takeaways:

• MS Sentinel can be complex and can have a steep learning curve for people not familiar with SIEM platforms.
• Offers a free trial, however this is a paid service for continued use.

CrowdStrike Falcon

• Cloud Native proprietary SIEM service that also provides some SOAR capabilities
• Supported platforms include: Windows, Linux, MacOS, ChromeOS, iOS, and Android (supports a wide range of endpoint devices and also includes support for legacy device versions as well)
• Service offers a way for organizations to centrally manage their endpoint devices as well as provide monitoring and remediation in the event that a security event is detected or triggered.
• You gain access to up to date threat intelligence/antivirus as well as customer support which can be useful for implementing security for small to large businesses

Drawbacks:

• Can only be run via the cloud, meaning you will need internet to access and manage your dashboard and endpoint devices (as well as getting up to date AV security)
• Offers free trial version with limited features, however you will need to pay a subscription to use the full service (cost can add up quickly depending on your organization’s size)

ManageEngine Log360

• ManageEngine Log360 is a proprietary SIEM service that offers features that can allow you to monitor and manage the security of your organization/environment's endpoint devices
• Offers a free trial, but requires subscription payment in order to continue use of service as well as gain full access to features and customer support.
• Can be implemented within on-prem, hybrid, and or cloud environments
  • Some documentation exists online on how to setup the on-prem service
• Supported platforms include: Windows, Linux, MacOS, as well as hosts run on Azure, AWS, GCP, as well as salesforce.

Components:

• Based on our findings, Log360 appears to use endpoint agents in order to collect system data which would be sent to a backend server for further analysis
• The backend server contains a database server (ex. postgreSQL) which stores the acquired endpoint system and log data
• The server also contains services that is able to examine and analyze the system data for threats and vulnerabilities which can trigger alerts
• The status of an organization's endpoints and security alerts can be monitored through a central Web Dashboard

Drawbacks:

• There may be a steep learning curve when first using this service if users are not familiar with cybersecurity or IT management. (meaning that you will need to have someone familiar with the service to be able to use this to the best capacity)
• Also you will need to maintain your subscription payments to continue use of service (which can add up for small businesses).

Our desired functions

• Report on updates applied, ensure endpoints have an auto-update method (unattended-upgrades on Debian*, GPO for auto Win update, etc)
• Integrate with hypervisor(s) to ensure snapshots of virtualized endpoints
• Scan endpoints for nonstandard configurations, or configurations that don't match package suggestions (e.g. weird /etc/ssh/sshd_config), without generating a ton of alerts & alert fatigue like some SIEM tools can do