oc-sentinel/docs/ninjaone-monitoring-playbook.md

NinjaOne Monitoring Playbook

Goal

Use AttackTracerNinja in NinjaOne with simple, predictable monitor behaviors and endpoint-visible custom-field data.

Recommended scripts

Primary data collection:

• scripts/run-attacktracer-ninja.ps1

Monitor-oriented wrapper:

• scripts/run-attacktracer-ninja-monitor.ps1

Recommended monitor layout

Recommended custom fields

Create these device custom fields in NinjaOne and allow script write access:

• attacktracerstatus
• attacktracerreason
• attacktracerbasestatus
• attacktracerevents
• attacktraceruniqueips
• attacktracercvecritical
• attacktracercvetotal
• attacktracermode
• attacktracertriggered
• attacktracerlastscanutc

Suggested field types:

• text: attacktracerstatus, attacktracerreason, attacktracerbasestatus, attacktracermode, attacktracerlastscanutc
• number/integer: attacktracerevents, attacktraceruniqueips, attacktracercvecritical, attacktracercvetotal
• checkbox or text: attacktracertriggered

1. Attack status monitor

Purpose:

• trigger when the final correlated status is not ok

Suggested command:

& "C:\Program Files\AttackTracerNinja\scripts\run-attacktracer-ninja-monitor.ps1" -Mode status -LookbackDays 7

Meaning:

• alerts on attack-only findings
• alerts on attack-plus-CVE escalation

2. Attack-only monitor

Purpose:

• trigger only on attack activity, ignoring pure CVE context

Suggested command:

& "C:\Program Files\AttackTracerNinja\scripts\run-attacktracer-ninja-monitor.ps1" -Mode attack-only -LookbackDays 7

Meaning:

• good for brute-force / failed-login monitoring
• independent of vulnerability imports

3. Critical CVE monitor

Purpose:

• trigger when the imported NinjaOne vulnerability export shows critical/high CVEs for this device

Suggested command:

& "C:\Program Files\AttackTracerNinja\scripts\run-attacktracer-ninja-monitor.ps1" -Mode cve-critical -LookbackDays 7 -VulnerabilityCsvPath "C:\Program Files\AttackTracerNinja\samples\ninja-vulnerability-export.example.csv"

Meaning:

• CVE-focused monitor
• no attack activity required

4. Attack plus CVE correlation monitor

Purpose:

• trigger only when this endpoint has attack activity and critical/high CVEs at the same time

Suggested command:

& "C:\Program Files\AttackTracerNinja\scripts\run-attacktracer-ninja-monitor.ps1" -Mode attack-plus-cve -LookbackDays 7 -VulnerabilityCsvPath "C:\Program Files\AttackTracerNinja\samples\ninja-vulnerability-export.example.csv"

Meaning:

• highest-signal monitor
• ideal for priority triage

Suggested alert interpretation

• status
  • use for general security operations visibility
• attack-only
  • use for incident-style login abuse detection
• cve-critical
  • use for vulnerability backlog / patch pressure
• attack-plus-cve
  • use for urgent escalation

Useful output fields from the main runner

The main runner emits:

• ATTACKTRACER_STATUS
• ATTACKTRACER_REASON
• ATTACKTRACER_BASE_STATUS
• ATTACKTRACER_EVENTS
• ATTACKTRACER_UNIQUE_IPS
• ATTACKTRACER_ERRORS
• ATTACKTRACER_CVE_TOTAL
• ATTACKTRACER_CVE_CRITICAL
• ATTACKTRACER_CVE_HIGH_CVSS

These are useful if you prefer a condition-based script monitor rather than exit-code-only behavior.

The installed monitor wrapper also attempts to populate NinjaOne custom fields automatically using Ninja-Property-Set first and C:\ProgramData\NinjaRMMAgent\ninjarmm-cli.exe as a fallback.

Practical recommendation

If you want the smallest workable setup, start with:

1. a scheduled script that runs status and updates the custom fields
2. a condition or device health check on attacktracertriggered = true

That gives you one broad monitor, keeps the latest values visible on the device, and avoids relying only on transient script output.