137 lines
4.0 KiB
Markdown
137 lines
4.0 KiB
Markdown
# NinjaOne Monitoring Playbook
|
|
|
|
## Goal
|
|
|
|
Use `AttackTracerNinja` in NinjaOne with simple, predictable monitor behaviors and endpoint-visible custom-field data.
|
|
|
|
## Recommended scripts
|
|
|
|
Primary data collection:
|
|
|
|
- [scripts/run-attacktracer-ninja.ps1](C:\Users\Besitzer\Documents\AttackTracerNinjaVersion\scripts\run-attacktracer-ninja.ps1)
|
|
|
|
Monitor-oriented wrapper:
|
|
|
|
- [scripts/run-attacktracer-ninja-monitor.ps1](C:\Users\Besitzer\Documents\AttackTracerNinjaVersion\scripts\run-attacktracer-ninja-monitor.ps1)
|
|
|
|
## Recommended monitor layout
|
|
|
|
## Recommended custom fields
|
|
|
|
Create these device custom fields in NinjaOne and allow script write access:
|
|
|
|
- `attacktracerstatus`
|
|
- `attacktracerreason`
|
|
- `attacktracerbasestatus`
|
|
- `attacktracerevents`
|
|
- `attacktraceruniqueips`
|
|
- `attacktracercvecritical`
|
|
- `attacktracercvetotal`
|
|
- `attacktracermode`
|
|
- `attacktracertriggered`
|
|
- `attacktracerlastscanutc`
|
|
|
|
Suggested field types:
|
|
|
|
- text: `attacktracerstatus`, `attacktracerreason`, `attacktracerbasestatus`, `attacktracermode`, `attacktracerlastscanutc`
|
|
- number/integer: `attacktracerevents`, `attacktraceruniqueips`, `attacktracercvecritical`, `attacktracercvetotal`
|
|
- checkbox or text: `attacktracertriggered`
|
|
|
|
### 1. Attack status monitor
|
|
|
|
Purpose:
|
|
- trigger when the final correlated status is not `ok`
|
|
|
|
Suggested command:
|
|
|
|
```powershell
|
|
& "C:\Program Files\AttackTracerNinja\scripts\run-attacktracer-ninja-monitor.ps1" -Mode status -LookbackDays 7
|
|
```
|
|
|
|
Meaning:
|
|
- alerts on attack-only findings
|
|
- alerts on attack-plus-CVE escalation
|
|
|
|
### 2. Attack-only monitor
|
|
|
|
Purpose:
|
|
- trigger only on attack activity, ignoring pure CVE context
|
|
|
|
Suggested command:
|
|
|
|
```powershell
|
|
& "C:\Program Files\AttackTracerNinja\scripts\run-attacktracer-ninja-monitor.ps1" -Mode attack-only -LookbackDays 7
|
|
```
|
|
|
|
Meaning:
|
|
- good for brute-force / failed-login monitoring
|
|
- independent of vulnerability imports
|
|
|
|
### 3. Critical CVE monitor
|
|
|
|
Purpose:
|
|
- trigger when the imported NinjaOne vulnerability export shows critical/high CVEs for this device
|
|
|
|
Suggested command:
|
|
|
|
```powershell
|
|
& "C:\Program Files\AttackTracerNinja\scripts\run-attacktracer-ninja-monitor.ps1" -Mode cve-critical -LookbackDays 7 -VulnerabilityCsvPath "C:\Program Files\AttackTracerNinja\samples\ninja-vulnerability-export.example.csv"
|
|
```
|
|
|
|
Meaning:
|
|
- CVE-focused monitor
|
|
- no attack activity required
|
|
|
|
### 4. Attack plus CVE correlation monitor
|
|
|
|
Purpose:
|
|
- trigger only when this endpoint has attack activity and critical/high CVEs at the same time
|
|
|
|
Suggested command:
|
|
|
|
```powershell
|
|
& "C:\Program Files\AttackTracerNinja\scripts\run-attacktracer-ninja-monitor.ps1" -Mode attack-plus-cve -LookbackDays 7 -VulnerabilityCsvPath "C:\Program Files\AttackTracerNinja\samples\ninja-vulnerability-export.example.csv"
|
|
```
|
|
|
|
Meaning:
|
|
- highest-signal monitor
|
|
- ideal for priority triage
|
|
|
|
## Suggested alert interpretation
|
|
|
|
- `status`
|
|
- use for general security operations visibility
|
|
- `attack-only`
|
|
- use for incident-style login abuse detection
|
|
- `cve-critical`
|
|
- use for vulnerability backlog / patch pressure
|
|
- `attack-plus-cve`
|
|
- use for urgent escalation
|
|
|
|
## Useful output fields from the main runner
|
|
|
|
The main runner emits:
|
|
|
|
- `ATTACKTRACER_STATUS`
|
|
- `ATTACKTRACER_REASON`
|
|
- `ATTACKTRACER_BASE_STATUS`
|
|
- `ATTACKTRACER_EVENTS`
|
|
- `ATTACKTRACER_UNIQUE_IPS`
|
|
- `ATTACKTRACER_ERRORS`
|
|
- `ATTACKTRACER_CVE_TOTAL`
|
|
- `ATTACKTRACER_CVE_CRITICAL`
|
|
- `ATTACKTRACER_CVE_HIGH_CVSS`
|
|
|
|
These are useful if you prefer a condition-based script monitor rather than exit-code-only behavior.
|
|
|
|
The installed monitor wrapper also attempts to populate NinjaOne custom fields automatically using `Ninja-Property-Set` first and `C:\ProgramData\NinjaRMMAgent\ninjarmm-cli.exe` as a fallback.
|
|
|
|
## Practical recommendation
|
|
|
|
If you want the smallest workable setup, start with:
|
|
|
|
1. a scheduled script that runs `status` and updates the custom fields
|
|
2. a condition or device health check on `attacktracertriggered = true`
|
|
|
|
That gives you one broad monitor, keeps the latest values visible on the device, and avoids relying only on transient script output.
|