HyperSec HyperCollector Integration

Windows Planning

Deployment Goals

There are four goals of a Windows HyperCollector deployment within a Microsoft Windows environment.

  1. Obtain as wide a reach of event sources from Windows hosts as possible.
  2. Significantly increase the value of the data collected for cyber analysis.
  3. Minimise the workload and impact of cyber data collection on the IT environment.
  4. Filter unnecessary data collection.

Subsequently the following deployment paradigm for Windows hosts is provided and supported with deployment and maintenance automation and SOPs.

There are four groups of Windows Host deployments

  1. Domain joined and managed hosts, the default.
  2. Stand-alone Windows hosts and Application Servers, such as non-domain joined servers in a DMZ and web servers.
  3. Disconnected, mobile hosts, such as a laptop sales workforce or SME.
  4. Business System Servers.

Common HyperCollector Integration Deployment Type Breakdown

Domain Joined Windows Hosts

Domain joined Windows hosts are serviced using a Windows Event Forwarding (WEF) model. The benefit of this approach is centralised collection of Windows events using native, Microsoft supported mechanisms without the requirement for any agent deployment or maintenance. If a Windows host joins the domain, it automatically starts forwarding events without any administrative intervention requirement.

Implementing WEF successfully and reliably as a customer can be challenging for most organisations. However the HyperSec HyperCollector integration and automation repository includes automation and a walk-through SOP that reliably implements a best practice implementation of this model.

Planning for a WEF deployment for a medium to large organisation it is recommended to:

It is important to note that no agent is required to be deployed to be deployed to these hosts, apart from the centralised Windows Event Collector servers themselves. A Microsoft Sysmon deployment is still strongly recommended, however.

Stand-Alone Windows Hosts

Stand-alone windows hosts that connect directly to a HyperCollector are systems that are typically segregated for security or operational purposes, these include:

Integration of these sources requires the installation of an agent to send event data. The following agent options are available with direct HyperSec integration automation support for deployment and maintenance:

This list is not prescriptive and many other approaches are directly supported by the the HyperCollector (such as Windows events over syslog), however they lack the supporting HyperSec integration automation.

It is typical to mix this type of deployment in combination with the Domain Joined Windows Hosts deployment with WEF and Domain Joined Windows Hosts servicing the majority of event collection and Stand-Alone deployments for DMZ, application servers and exceptions to reduce maintenance and overhead.

Disconnected Mobile Hosts

Disconnected mobile windows systems services a different use case to the normal stand-alone host. A mobile system is typically a laptop and may spend days without connecting to the corporate network directly or via VPN while still performing business operations or actions that incur cyber risk. These systems need to stream cyber event data directly to receivers irrespective of their location and state. Connectivity options for this pathway requires the deployment of HyperSec XDR back end software, or the DMZ/Receiver component at a minimum.

Deployment onto these hosts requires an agent, configured for a direct-to-receiver deployment. Deployment options include:

Application Servers

Application servers with local, non WEF forward-able file logs require the installation of a local agent.

The following agent options are available with direct HyperSec integration automation support for deployment and maintenance:

This list is not prescriptive and many other approaches are directly supported by the the HyperCollector (such as syslog), however they lack the supporting HyperSec integration automation.

This deployment option includes event sources outside of standard windows logs, including, but not limited to:

Sysmon

It is strongly recommended the Microsoft Sysmon security component be deployed to all Windows systems. This provides a significant boost to the cyber value of data collected your environment, in particular threat indicator matching.

Collection of Sysmon data is already integrated with the above approaches and only requires the installation of the software itself, configuration and subsequent updates.

This is provided using HyperSec integration in a safely re-executable form, whereby re-installing either:

This non-proprietary package can be executed as a batch file (cmd) or deployed using Microsoft Configuration Manager or other software management distribution or update software.