User Experience Monitoring & Endpoint Security Analytics

Citrix Cloud

Citrix Cloud monitoring is uberAgent’s capability to monitor the Citrix CVAD control plane in Citrix Cloud. It collects information such as:

• Published applications
• Desktops & desktop groups
• Machines & catalogs

Application Identification

Tired of deciphering cryptic process names? We thought so. Process names are for machines, application names are for humans.

uberAgent’s automatic application identification does not require configuration – and it even works with Windows services, App-V, Java and UWP applications. On macOS, even XPC services and privileged helper tools are covered.

Experience Score

The experience score dashboard is the entry point of the uberAgent UXM Splunk app. It calculates and visualizes experience scores for the entire estate, breaking the data down by category and component, highlighting components where potential issues are originating from. The dashboard also provides quick access to important KPIs like logon duration, application responsiveness, or application errors.

MS Office & Acrobat Reader

uberAgent ESA comes with preconfigured rules that detect suspicious behavior with MS Office applications and Adobe Acrobat Reader such as:

• Child process creation
• Download operations
• Macro execution
• Suspicious DLLs

System Boot Performance

Boot duration is often equivalent to the number of disk IOs – if you want fast boots you need to reduce the IO count. And uberAgent shows you just what you need to know to do that.

LOLBAS

LOLBAS stands for Living Off the Land Binaries And Scripts, a type of activity that misuses tools and executables that are already there because they are part of the operating system. uberAgent ESA detects LOLBAS activity such as:

• Unusual child processes and DLL loads
• Starts from non-default locations
• Download operations
• Execution from alternate data streams

User Session Footprint

When sizing an SBC farm you need reliable data about RAM, CPU, and disk usage per user session. Such data can be hard to come by. With uberAgent, it is but a dashboard away.

Works with:

• Citrix Virtual Apps and Desktops
• VMware Horizon
• Azure Virtual Desktop (AVD)
• Nutanix Frame

Suspicious Network Activity

uberAgent ESA detects suspicious behavior related to network operations such as:

• PowerShell outbound network connections
• RDP connects from non-RDP software indicating lateral movement
• Network connects to suspicious ports

File System Permissions

uberAgent ESA has sophisticated features that greatly facilitate working with security descriptors (SDDL strings). uberAgent detects detect processes started from directories that are user-writable and process starts from directories with a low mandatory integrity label.

Citrix CVAD Sites

uberAgent detects if it is running on a Citrix Delivery Controller (DDC) or a Citrix Virtual Desktop Agent (VDA). On DDCs, uberAgent automatically activates additional metrics like machine registration status, license usage, and published application inventory.

Sigma Rule Converter

Sigma is an open-source project that collects generic signatures for SIEM systems. vast limits contributes a rule converter to the ESA Activity Monitoring rule format. This makes it possible to enable hundreds of additional detection rules simply by including another configuration file.

WiFi Connections

uberAgent’s WiFi connection monitoring keeps track of the relevant quality and security parameters of the WiFi network through which a user’s endpoint is connected to the internet and/or the corporate network.

Root CA Certificates

uberAgent ESA detects changes to root CA certificates such as certificate chain cloning and cloned root trust attacks.

SSH Sessions

uberAgent detects incoming SSH connections to macOS endpoints. Every SSH connection is given a unique identifier. Any processes that are executed within the SSH session are associated with it.

DNS Queries

DNS query monitoring tracks all outgoing DNS requests on the endpoints where uberAgent is installed. This makes it possible to detect data exfiltration via DNS, a powerful technique because it does not require a direct network connection between the source and target hosts.

Persistent Output Queue

Disk buffering via uberAgent’s persistent output queue ensures that no data is lost even in situations where the backend is unavailable for prolonged periods of time. The most important use case is with laptops.

uAQL Query Language

uAQL is a query language that is powerful yet efficient and easy to read. uAQL queries are used by the endpoint agent for ESA Activity Monitoring rules and for event data filtering.

User & Host Tags

Collect additional user or machine identifiers from Active Directory, the registry, or from environment variables.

Authenticode Signatures

uberAgent verifies the digital signature of each EXE/DLL that is executed or loaded into memory. uberAgent checks many properties of the signature, including the full chain of certificates.

Custom Scripts

uberAgent can collect data for arbitrary custom metrics through a generic script execution engine. It runs any type of script at any desired interval, either per machine or per user session.

Remote Thread Creation

Remote thread creation monitoring collects detailed information for any remote thread code injection event, including source & target process and the function that was called.

Event Data Filtering

Event data filtering allows defining rules that are evaluated for every event before it is sent to the backend. Rules control whether the event is sent to the backend or not. Additionally, rules can be used to clear the contents of fields.

Splunk Enterprise Security Integration

uberAgent supports all CIM fields populated by popular Sysmon add-ons. Data models include Endpoint, Malware, Change, and Network Resolution (DNS).

Configuration via Group Policy or Config File

uberAgent can be configured by means of a configuration file (all platforms) or via Group Policy (Windows).

Image File Hashing

Whenever a process is started or a DLL is loaded, uberAgent ESA calculates the hash of the file located on disk. uberAgent supports the hash variants MD5, SHA-1, SHA-256, and ImpHash both individually and simultaneously.

Citrix ADC

With Citrix ADC monitoring, uberAgent collects appliance & gateway performance, utilization, and inventory data from Citrix Application Delivery Controllers.

Scheduled Tasks

uberAgent ESA monitors changes to Windows scheduled tasks. Whenever a task is created, updated, or deleted, uberAgent generates an event with all available details. This includes properties that are not displayed in the Windows Task Scheduler UI, such as COM actions or custom triggers.

GPU Acceleration

As it becomes more and more common to utilize the GPU for effects, video decoding and even general-purpose computing administrators need a tool that helps them understand exactly how their applications make use of GPU acceleration in order to optimally size the hardware for the workload. uberAgent is that tool.

Process Tree

uberAgent ESA comes with a powerful Process Tree dashboard that makes it easy to identify a process’ descendants, listing important process properties such as the process lifetime, the command line, the elevation status, or the name and version of the application the process is a part of.

Sysmon Rule Converter

Sysmon is one of the most popular endpoint detection tools. Numerous quality rulesets are maintained by the security community. With our converter, Sysmon rulesets can be used with uberAgent ESA.