# NinjaOne Monitoring Playbook

## Goal

Use `AttackTracerNinja` in NinjaOne with simple, predictable monitor behaviors and endpoint-visible custom-field data.

## Recommended scripts

Primary data collection:

- [scripts/run-attacktracer-ninja.ps1](C:\Users\Besitzer\Documents\AttackTracerNinjaVersion\scripts\run-attacktracer-ninja.ps1)

Monitor-oriented wrapper:

- [scripts/run-attacktracer-ninja-monitor.ps1](C:\Users\Besitzer\Documents\AttackTracerNinjaVersion\scripts\run-attacktracer-ninja-monitor.ps1)

## Recommended monitor layout

## Recommended custom fields

Create these device custom fields in NinjaOne and allow script write access:

- `attacktracerstatus`
- `attacktracerreason`
- `attacktracerbasestatus`
- `attacktracerevents`
- `attacktraceruniqueips`
- `attacktracercvecritical`
- `attacktracercvetotal`
- `attacktracermode`
- `attacktracertriggered`
- `attacktracerlastscanutc`

Suggested field types:

- text: `attacktracerstatus`, `attacktracerreason`, `attacktracerbasestatus`, `attacktracermode`, `attacktracerlastscanutc`
- number/integer: `attacktracerevents`, `attacktraceruniqueips`, `attacktracercvecritical`, `attacktracercvetotal`
- checkbox or text: `attacktracertriggered`

### 1. Attack status monitor

Purpose:
- trigger when the final correlated status is not `ok`

Suggested command:

```powershell
& "C:\Program Files\AttackTracerNinja\scripts\run-attacktracer-ninja-monitor.ps1" -Mode status -LookbackDays 7
```

Meaning:
- alerts on attack-only findings
- alerts on attack-plus-CVE escalation

### 2. Attack-only monitor

Purpose:
- trigger only on attack activity, ignoring pure CVE context

Suggested command:

```powershell
& "C:\Program Files\AttackTracerNinja\scripts\run-attacktracer-ninja-monitor.ps1" -Mode attack-only -LookbackDays 7
```

Meaning:
- good for brute-force / failed-login monitoring
- independent of vulnerability imports

### 3. Critical CVE monitor

Purpose:
- trigger when the imported NinjaOne vulnerability export shows critical/high CVEs for this device

Suggested command:

```powershell
& "C:\Program Files\AttackTracerNinja\scripts\run-attacktracer-ninja-monitor.ps1" -Mode cve-critical -LookbackDays 7 -VulnerabilityCsvPath "C:\Program Files\AttackTracerNinja\samples\ninja-vulnerability-export.example.csv"
```

Meaning:
- CVE-focused monitor
- no attack activity required

### 4. Attack plus CVE correlation monitor

Purpose:
- trigger only when this endpoint has attack activity and critical/high CVEs at the same time

Suggested command:

```powershell
& "C:\Program Files\AttackTracerNinja\scripts\run-attacktracer-ninja-monitor.ps1" -Mode attack-plus-cve -LookbackDays 7 -VulnerabilityCsvPath "C:\Program Files\AttackTracerNinja\samples\ninja-vulnerability-export.example.csv"
```

Meaning:
- highest-signal monitor
- ideal for priority triage

## Suggested alert interpretation

- `status`
  - use for general security operations visibility
- `attack-only`
  - use for incident-style login abuse detection
- `cve-critical`
  - use for vulnerability backlog / patch pressure
- `attack-plus-cve`
  - use for urgent escalation

## Useful output fields from the main runner

The main runner emits:

- `ATTACKTRACER_STATUS`
- `ATTACKTRACER_REASON`
- `ATTACKTRACER_BASE_STATUS`
- `ATTACKTRACER_EVENTS`
- `ATTACKTRACER_UNIQUE_IPS`
- `ATTACKTRACER_ERRORS`
- `ATTACKTRACER_CVE_TOTAL`
- `ATTACKTRACER_CVE_CRITICAL`
- `ATTACKTRACER_CVE_HIGH_CVSS`

These are useful if you prefer a condition-based script monitor rather than exit-code-only behavior.

The installed monitor wrapper also attempts to populate NinjaOne custom fields automatically using `Ninja-Property-Set` first and `C:\ProgramData\NinjaRMMAgent\ninjarmm-cli.exe` as a fallback.

## Practical recommendation

If you want the smallest workable setup, start with:

1. a scheduled script that runs `status` and updates the custom fields
2. a condition or device health check on `attacktracertriggered = true`

That gives you one broad monitor, keeps the latest values visible on the device, and avoids relying only on transient script output.