Initial OfficeCom Sentinel client and deployment assets

docs/ninjaone-monitoring-playbook.md

@@ -0,0 +1,136 @@
+# NinjaOne Monitoring Playbook
+
+## Goal
+
+Use `AttackTracerNinja` in NinjaOne with simple, predictable monitor behaviors and endpoint-visible custom-field data.
+
+## Recommended scripts
+
+Primary data collection:
+
+- [scripts/run-attacktracer-ninja.ps1](C:\Users\Besitzer\Documents\AttackTracerNinjaVersion\scripts\run-attacktracer-ninja.ps1)
+
+Monitor-oriented wrapper:
+
+- [scripts/run-attacktracer-ninja-monitor.ps1](C:\Users\Besitzer\Documents\AttackTracerNinjaVersion\scripts\run-attacktracer-ninja-monitor.ps1)
+
+## Recommended monitor layout
+
+## Recommended custom fields
+
+Create these device custom fields in NinjaOne and allow script write access:
+
+- `attacktracerstatus`
+- `attacktracerreason`
+- `attacktracerbasestatus`
+- `attacktracerevents`
+- `attacktraceruniqueips`
+- `attacktracercvecritical`
+- `attacktracercvetotal`
+- `attacktracermode`
+- `attacktracertriggered`
+- `attacktracerlastscanutc`
+
+Suggested field types:
+
+- text: `attacktracerstatus`, `attacktracerreason`, `attacktracerbasestatus`, `attacktracermode`, `attacktracerlastscanutc`
+- number/integer: `attacktracerevents`, `attacktraceruniqueips`, `attacktracercvecritical`, `attacktracercvetotal`
+- checkbox or text: `attacktracertriggered`
+
+### 1. Attack status monitor
+
+Purpose:
+- trigger when the final correlated status is not `ok`
+
+Suggested command:
+
+```powershell
+& "C:\Program Files\AttackTracerNinja\scripts\run-attacktracer-ninja-monitor.ps1" -Mode status -LookbackDays 7
+```
+
+Meaning:
+- alerts on attack-only findings
+- alerts on attack-plus-CVE escalation
+
+### 2. Attack-only monitor
+
+Purpose:
+- trigger only on attack activity, ignoring pure CVE context
+
+Suggested command:
+
+```powershell
+& "C:\Program Files\AttackTracerNinja\scripts\run-attacktracer-ninja-monitor.ps1" -Mode attack-only -LookbackDays 7
+```
+
+Meaning:
+- good for brute-force / failed-login monitoring
+- independent of vulnerability imports
+
+### 3. Critical CVE monitor
+
+Purpose:
+- trigger when the imported NinjaOne vulnerability export shows critical/high CVEs for this device
+
+Suggested command:
+
+```powershell
+& "C:\Program Files\AttackTracerNinja\scripts\run-attacktracer-ninja-monitor.ps1" -Mode cve-critical -LookbackDays 7 -VulnerabilityCsvPath "C:\Program Files\AttackTracerNinja\samples\ninja-vulnerability-export.example.csv"
+```
+
+Meaning:
+- CVE-focused monitor
+- no attack activity required
+
+### 4. Attack plus CVE correlation monitor
+
+Purpose:
+- trigger only when this endpoint has attack activity and critical/high CVEs at the same time
+
+Suggested command:
+
+```powershell
+& "C:\Program Files\AttackTracerNinja\scripts\run-attacktracer-ninja-monitor.ps1" -Mode attack-plus-cve -LookbackDays 7 -VulnerabilityCsvPath "C:\Program Files\AttackTracerNinja\samples\ninja-vulnerability-export.example.csv"
+```
+
+Meaning:
+- highest-signal monitor
+- ideal for priority triage
+
+## Suggested alert interpretation
+
+- `status`
+  - use for general security operations visibility
+- `attack-only`
+  - use for incident-style login abuse detection
+- `cve-critical`
+  - use for vulnerability backlog / patch pressure
+- `attack-plus-cve`
+  - use for urgent escalation
+
+## Useful output fields from the main runner
+
+The main runner emits:
+
+- `ATTACKTRACER_STATUS`
+- `ATTACKTRACER_REASON`
+- `ATTACKTRACER_BASE_STATUS`
+- `ATTACKTRACER_EVENTS`
+- `ATTACKTRACER_UNIQUE_IPS`
+- `ATTACKTRACER_ERRORS`
+- `ATTACKTRACER_CVE_TOTAL`
+- `ATTACKTRACER_CVE_CRITICAL`
+- `ATTACKTRACER_CVE_HIGH_CVSS`
+
+These are useful if you prefer a condition-based script monitor rather than exit-code-only behavior.
+
+The installed monitor wrapper also attempts to populate NinjaOne custom fields automatically using `Ninja-Property-Set` first and `C:\ProgramData\NinjaRMMAgent\ninjarmm-cli.exe` as a fallback.
+
+## Practical recommendation
+
+If you want the smallest workable setup, start with:
+
+1. a scheduled script that runs `status` and updates the custom fields
+2. a condition or device health check on `attacktracertriggered = true`
+
+That gives you one broad monitor, keeps the latest values visible on the device, and avoids relying only on transient script output.