Remote Access Protection (RAP)

Remote Access Protection (RAP) represents a new security layer that allows you to monitor and control RDP access. This feature is designed to monitor, block, and manage RDP connection attempts made to Heimdal-protected endpoints, helping prevent unauthorized remote access while allowing granular control via allowlisting and group policy settings.

1. Description
2. How does Remote Access Protection (RAP) works?
3. Remote Access Protection view
4. Remote Access Protection settings

DESCRIPTION

The Remote Access Protection (RAP) submodule provides full visibility and control over RDP connection attempts to devices protected by the Heimdal Agent.
When enabled via Group Policy (Endpoint Settings -> click on a Windows GP -> Endpoint Detection -> Firewall & RAP -> RAP):

• All inbound RDP traffic is monitored.
• Connections are blocked by default, unless the source IP is allowlisted or belongs to a private IP range permitted through the "Do not block private IPs" setting from the GP.

Each RDP attempt is logged in the Dashboard, allowing administrators to:

• Review the connection source and target.
• Allowlist trusted IPs.
• Set expiration dates for the allowlist entries.
• Acknowledge connection attempts (marking them as Blocked).

HOW DOES REMOTE ACCESS PROTECTION (RAP) WORKS?

This module is designed to monitor incoming Remote Desktop Protocol (RDP) traffic and prevent unauthorized access by default, blocking any connection not explicitly allowlisted.

REMOTE ACCESS PROTECTION settings

Note: Remote Access Protection can be enabled only if the Firewall module is also active.

General Settings:

• RAP-monitored ports – specifies one or more ports for monitoring when it comes to incoming RDP connections:
• Multiple values will be separated by a comma (e.g., 3389,3390).

• When edited, in either the Brute Force Attack Protection or RAP sections, the value is automatically synchronized to ensure consistency across both modules.

  Do not block private IPs – allows all incoming RDP connections from private IPs

• Extra validation on allowlist when user risk score is higher than
  

Allowlist:

• Authorizes IT administrators to manually specify IPv4 addresses or IPv4 ranges that are permitted to connect via RDP.
• Entries can also be added via the Import functionality, enabling bulk management of trusted IPs or ranges.
• IP ranges can be added using the hyphen (-) notation (e.g., 192.168.0.1-192.168.0.255)

Each allowlist entry can have an optional expiration date:

• If no expiration date is set, the entry remains valid until manually removed.
• If an expiration date is configured, the entry remains valid until it expires, but remains visible in the dedicated product grid, post-expiration, for traceability purposes.
• When setting or editing an expiration date, the system enforces that the selected date is after the current date, ensuring that expired or same-day entries cannot be configured.
• Allowlist entries can be edited or deleted as needed.
  
  Automatically acknowledge greylist detection blocking after 7-30 days – entries with the status Default blocked, not actioned, will be automatically updated to Blocked after the configured number of days has passed since the recorded Timestamp, unless manually acknowledged earlier.
  
  The product view, from the Heimdal dashboard (Products → Endpoint Detection → Firewall → Remote Access Protection):
  
  and the client specifics view (post clicking a hostname from the Remote Access Protection view grid):
  
  display all detected RDP connection attempts with their associated status:
• Default blocked, not actioned – detected & blocked RDP connections that are not acknowledged by the Dashboard user.
• Blocked – detected & blocked RDP connections that were acknowledged by the Dashboard user.

Allowlisted – detected & blocked RDP connections that were later allowlisted by the Dashboard user.

The other columns available in the two earlier-mentioned views are:

• Hostname – name of the targeted machine.
• Last Known Username – most recent user logged into the machine.
• IP – source IP attempting the RDP connection.
• Expected User – retrieved by checking Login Anomaly Detection (LAD) based on the source IP and identifying the last connected user from that IP.
• if a match is found, the expected username is displayed.
• if no match is found or Login Anomaly Detection (LAD) is not licensed or configured, the field will show N/A.
• MFA Enabled – displays an Enabled or Disabled status icon, based on the current MFA configuration of the user identified in the Expected User column.
• available only if M365 User Security and Login Anomaly Detection (LAD) settings are active.
• if M365 User Security is not licensed or enabled, the field displays N/A.
• Strong Password enabled – displays an Enabled or Disabled status icon, based on the current strong password configuration of the user identified in the Expected User column.
• available only if M365 User Security and Login Anomaly Detection (LAD) settings are active.
• if M365 User Security is not licensed or enabled, the field displays N/A.
• State – reflects the status of each recorded RDP connection:
• Default blocked, not actioned (default state) – The connection was automatically blocked by the RAP module and has not yet been reviewed by an administrator.
• Blocked – Manually acknowledged by an administrator or auto-updated after 7–30 days if the Greylist auto-acknowledge Group Policy option is enabled.
• Allowlisted – The connection was permitted based on the corresponding Group Policy Allowlist entry, as long as the entry has not expired.
• Risk Score – displays the risk score of the user identified in the Expected User column:

• if M365 User Security is not licensed or enabled, the value displayed is 0.

  Timestamp – when the connection attempt occurred.

When it comes to actionability on the RAP entries, the following actions (Select what action to take drop-down list) can be taken, post selecting one or multiple entries from the RAP product/ client specifics views, depending on the state:

For Default blocked, not actioned entries:

• Acknowledge – changes the state to Blocked.
• Add to Allowlist:
• When adding an IP to the allowlist, the modal allows for single or multi-GP selection.
• Expiration date can be configured.

If the M365 validation is enabled and the risk score exceeds the threshold, an additional confirmation dialog is shown.


For Blocked entries:

• Add to Allowlist:
  • When adding an IP to the allowlist, the modal allows for single or multi-GP selection.
  • Expiration date can be configured.
  • If the M365 validation is enabled and the risk score exceeds the threshold, an additional confirmation dialog is shown.

for Allowlisted entries:

• Remove from Allowlist:
  • available only when the allowlist entry is an exact match with the listed IP address.
  • When removing an IP from the allowlist, the modal allows for single or multi-GP selection.
  • Removal is not supported for IPs that are part of a defined IP range in the Group Policy Allowlist.

The Allowlist action can be made on a single GP selection, and the following validation modal window will be displayed:


or on Multiple GP selection, scenario depicted in the below modal window:

IMPORTANT

The Remote Access Protection (RAP) submodule relies on Windows Firewall and inherits its limitations (e.g., ~500 entries per rule).