Overview

ClearSkies™ NG EDR Agent v6.3 is a comprehensive Endpoint Detection & Response solution, fully integrated with ClearSkies™ SaaS NG SIEM. It complements the detection of and response to never-before-seen targeted attacks and insider threats with the use of Behavioral Monitoring and Analysis (BMA), and by leveraging Advanced Security Analytics complemented by Threat Intelligence and signature-based detection.

What’s New in v 6.3

New Features:

• Detection of missing/recommended security patches as well as related vulnerabilities that could impact the integrity and availability of information assets
• Automatic updating of policy changes and related updates using an encrypted tunnel when working remotely
• Collection and analysis of SQL Trace (Audit) Events
• Correlation of DHCP log and event data within UEBA
• And many more that improve effectiveness and user experience…

Enhancements

Several major new enhancements are introduced in this new ClearSkies™ NG Endpoint Detection & Response (EDR) Agent version 6.3:

Behavioral Analysis Tool/Application

• Redesigned and upgraded graphical user interface
• Watchdog service enhancement/upgrade:
  • Improved detection capability through refined Sysmon configurations
  • Performance enhancements
• File Integrity Monitoring (FIM) enhancements:
  • Redesigned and upgraded graphical user interface
  • No file count and file size restrictions
  • Capability to monitor entire drive volumes
  • Improved performance

Management Tool/Application

• Redesigned and upgraded graphical user interface:
  • New overview page illustrating important metrics
  • Global iCollector and Incident/Alert settings can now only be configured in the ‘Policies’ page
  • Policies can now only be scheduled in the ‘Policies’ page
  • Versions can now only be scheduled in the ‘Schedules’ page
  • Schedules can now be deleted
  • Endpoints that exhibit loss of communication with the iCollector for more than 30 days are automatically removed, and they can reappear when they become active
• New information logsource prerequisites are now displayed in the agent policy configuration screen

General

• Log and event data forwarding to the iCollector using SFTP now uses higher compression:
  • The Agent compresses and forwards log and event data via SFTP to the iCollector for improved performance and bandwidth utilization

• Redesign of the Agent’s services architecture:
  • The Agent now supports the collection of logsources and other functionalities contained in multiple services for improved service integrity and performance

Bug Fixes

This version resolves a number of stability and performance issues identified.