Extended Threat Protection (Windows)

In this article, you will learn everything you need to know about the Endpoint Detection - Extended Threat Protection product.

1. Description
2. How does Extended Threat Protection (XTP) work?
3. Extended Threat Protection view
4. XTP settings

DESCRIPTION

The Extended Threat Protection (XTP) engine offers you superior protection against next-generation threats by supplying evidence-based information about sophisticated cybersecurity risks and offering a holistic view of weaknesses, categorized on MITRE ATT&CK tactics and techniques. The new engine uses intel coming from 1400+ sigma rules and is offered complimentary as part of our Next-Gen Antivirus, Firewall, and MDM license. Regardless of whether the attack method consists of exploits, defense evasion, credential access, or exfiltration, the XTP engine will keep you at the forefront of protection, with a deep and detailed analysis such as process trees, attack mechanisms, and attack types leveraged.

HOW DOES EXTENDED THREAT PROTECTION (XTP) WORK?

Extended Threat Protection (XTP) stores information based on the system's audit policies. These events are analyzed by the XTP engine, which can tell when a suspicious event occurred. The product collects information from any computer in your environment using the Heimdal XTP service and compares them against the 1400+ sigma rules that are defined in the MITRE ATT&CK knowledge base. It gives you a description of each rule that the endpoint is not complying with and offers you a small solution on how to mitigate the issue. XTP uses the sysmon Windows addon to log information, which might conflict with other applications that also use sysmon.

EXTENDED THREAT PROTECTION (XTP) view

The Extended Threat Protection view displays all the information collected by HEIMDAL Agent that is running on the endpoints in your organization. The collected information refers to the rules and alerts intercepted by the HEIMDAL Agent. On the top, you see a statistic regarding the number of Detections, the number of Critical Detections, the number of Medium Detections, and the number of Low Detections.

The collected information is placed in the following views: Standard, and Raw.
 

• Standard
  This view displays a table with the following details: Hostname, Rule Name, Severity, Process Name, Categories, and Detections. 
  
   
• Raw
  This view displays a table with the following details: Hostname, Rule Name, Severity, Process Name, PID, Categories,  Timestamp and Resolution. 
  
  The checkbox allows you to select an entry and Resolve or Unresolve the event. 

The Download CSV functionality allows you to generate and download a CSV report that includes all the information in Standard or Verbose mode corresponding to each view. The Filters button opens a toaster that allows you to filter by Severity type.

XTP SETTINGS

Extended Threat Protection (XTP) allows you to collect information on the events that take place on the computers in your environment, based on rules defined by Heimdal specialists. XTP provides evidence-based information about the cybersecurity risks encountered in your environment and offers a holistic view of weaknesses, categorized by MITRE ATT&CK tactics and techniques.

XTP - turns Extended Threat Protection ON or OFF.

General Settings

Note: The General Settings section is only visible when Advanced mode is enabled in the Group Policy editor.

XTP check interval [minutes] - sets the interval (between 1 and 360 minutes) XTP uses to automatically check for new rules and to check the computer for events that match the XTP rules.

Rules

XTP uses intel coming from 1,400+ Sigma rules, classified by severity and organized into categories. The rules are listed in a grid with the Name, Description, Severity, Categories, and Enabled columns. You can search the rules by name, filter them with the Select one or multiple categories dropdown and the Severity dropdown, and manually disable any rule by unticking its Enabled checkbox (right-side column). Hovering over a description shows its full text, and clicking a rule name opens a modal with all the information related to that rule.

Exclusions

The Exclusions section allows you to define specific rules that XTP should skip during monitoring, preventing conflicts or false positives. Add an exclusion by File Name, File Path, Directory, or MD5, or import multiple exclusions from a CSV file (a sample CSV file is available from the tooltip next to the section title). Existing entries can be searched and are listed in a grid with the following columns:

• File Name / Path / Value - the excluded process, file, directory, or hash.
• Command Line - optionally restricts the exclusion to executions whose command line matches a pattern. Click the edit icon on the row to set or change the pattern (see the supported patterns below).
• Rule - the XTP rule the exclusion applies to, selected from a searchable dropdown.
• Type - the exclusion type (File Name, File Path, Directory, or MD5).
• Action - removes the exclusion.

Click Show Custom Expressions Helper above the grid to see the patterns supported in the Command Line field: