Indicators of attack settings

Indicators of attack are a type of signal that Advanced EPDR generates when it detects suspicious activity that is highly likely to be an attack. They provide context for incidents that signal an imminent infection or an attack that has already penetrated your company IT network.

For more information about the indicators of attack module, see:

Creating and managing settings profiles: Information about how to create, edit, delete, or assign settings profiles to the computers on your network.
The management console: Information about how to manage user accounts and assign permissions.

Configuring indicators of attack (IOA)

To create, edit, delete, or assign indicators of attack settings profiles, your user role must have the Configure indicators of attack (IOA) permission.
To view indicators of attack settings profiles, your user role must have the View indicators of attack (IOA) settings permission.
For more information about roles and permissions, see Understanding permissions.

To create an indicators of attack settings profile:

From the top menu, select Settings.
From the side menu, select Indicators of attack (IOA). A list opens and shows all existing settings profiles.
Click Add. The Add settings page opens.
In the Name text box, type a name for the settings profile.
In the Description text box, type a brief description of the settings profile.
To assign recipients, see Assigning recipients to settings profiles.

You can assign indicators of attack (IOA) settings profiles to Windows, Linux, and macOS workstations and servers.

To detect RDP attacks, enable the RDP attacks toggle. For more information about RDP attacks, see RDP attack containment.
To show Advanced settings for RDP attacks, click the link.
To configure a Response on workstations in the event of an RDP attack, from the drop-down menu, select:
- Report and block RDP attacks: Generates a signal and blocks RDP attacks.
- Report only: Generates a signal.
To configure a Response on servers in the event of an RDP attack, from the drop-down menu, select:
- Report and block RDP attacks: Generates a signal and blocks RDP attacks.
- Report only: Generates a signal.
In the Trusted IPs section, enter a list of IP addresses of computers that Advanced EPDR considers secure and will not block, although they will generate signals.
To enable the sending of advanced IOAs, enable the Advanced IOA toggle.
We recommend that you keep the Advanced IOA toggle always enabled; otherwise, Advanced EPDR will not record IOA-type signals and will not generate some incidents. Disable the toggle only when you detect performance issues.
Click Save. The settings profile is sent to the assigned computers and applies immediately.

Assigning recipients to settings profiles

In the Recipients section, click the link. A dialog box opens and prompts you to save the settings profile, if you have not already done so.
In the dialog box, click OK. The settings profile is saved and the Recipients page opens.
To add computer groups:
- In the Computer groups box, click the icon (1). The Add group dialog box opens.
- Select a group.
- Click Add. The selected appears in the Computer groups box.
To add individual computers:
- In the Additional computers box, click the icon (2). The Add computers dialog box opens.
- Select the checkboxes for the computers you want to send the settings profile to.
- Click Add. The selected computers appear in the Additional computers box.
To delete computer groups:
- In the Computer groups box, click the icon (3) for the group you want to delete. A confirmation dialog box opens.
- Click Delete. The group is removed from the settings profile.
To delete individual computers:
- In the Additional computers box, select the checkboxes for the computers you want to delete.
- Click the icon (4). A confirmation dialog box opens.
- Click Delete. The computers are removed from the settings profile.