How uberAgent ESA Complements EDR Products

Should you wear both belt and suspenders? When it comes to IT security, the answer is most likely yes. No single product can detect all threats, prevent all exploits, or block all attacks. This article explains why it is often beneficial to complement an EDR tool with an analytics product such as uberAgent ESA.

Shortcomings of EDR Products

Detection Gaps

Nobody’s perfect. As stated above, no EDR product detects and blocks all threats. Quite the contrary, EDR often has alarming gaps. As the independent researchers George Karantzas and Constantinos Patsakis found in their EDR study, no EDR can efficiently detect and prevent the […] attack vectors we deployed. That is not all. As the scientists explain, “DLL sideloading attack is the most successful attack as most EDRs fail to detect, let alone block it.”

In addition to the above, EDR is often focused on executables and may ignore scripts, documents, or compressed files. Finally, it’s often unclear what exactly an EDR product can detect.

Obscurity

Most EDR vendors don’t document how their detections work and what exactly is logged. Wanting to protect one’s “secret sauce” may seem like a good move until you consider that it leaves customers in the dark about a product’s capabilities (which may even be intentional in some cases). Unfortunately, obscurity on the vendor’s part may lull customers into a false sense of security, believing they’re protected when in reality they’re not.

Focused Solely on Malicious Events

With their strong focus on detecting and blocking malicious events, EDR products fail to provide visibility into “normal” application (or user) behavior. This information gap makes it hard to detect outliers and anomalies, a task typically performed by analysts with the help of a SIEM.

Suboptimal SIEM Integration

In many cases, it’s more complicated than it should be to get EDR data into a SIEM such as Splunk. Sometimes, there’s a significant time lag before data shows up at the SIEM, delaying alerts and notifications.

Customizations

With many EDR products, creating custom rules or tweaking built-in detection logic can be difficult or time-consuming.

Why a Second Data Source Is Invaluable for Endpoint Security

Second Opinion & Sanity Checking

Given the shortcomings of EDR products, feeling the need to verify the data being collected by the EDR is only natural. Also, you may want a fail-safe for situations where the EDR either doesn’t detect a threat or malicious actors disable the EDR altogether.

Better SIEM Integration

SIEMs need high-quality data to be useful. There are not many data sources with a good signal-to-noise ratio on Windows or macOS. Simply forwarding event logs is not enough: they’re too noisy and lack essential detail such as parent processes or command-line arguments.

Consistency

The opaqueness of EDR detections needs to be counterbalanced by a transparent, rule-based approach. You want to know what you’re collecting, when, and why.

Visibility Into Normal Behavior

You require insights into more than what is deemed malicious events. You need data that helps you understand what is happening on endpoints during regular operations. Visibility into the day-to-day routine is the basis for all advanced analytics.

Benefits of uberAgent for Endpoint Security Analytics

One Agent

uberAgent uses a single agent for security analytics, performance monitoring, and user experience data collection. Engineered in Germany, uberAgent is renowned for its small footprint and its overall product quality.

Built for Splunk

uberAgent has been built and optimized for Splunk from day one. It comes with feature-rich Splunk apps as well as perfect integration with Splunk Enterprise Security.

Interoperability

Sigma & Sysmon Rule Converters

uberAgent ships with rule converters for the two most popular free endpoint analytics tools: Sigma and Sysmon. The former translates Sigma signatures into the format used by uberAgent ESA, while the latter does the same for Sysmon rules.

SIEM Backend Support

With support for four different backends, uberAgent can be integrated into almost any SIEM infrastructure. The agent can directly send the collected data to Splunk, Elasticsearch, Apache Kafka, and Azure Monitor.

Detection

uberAgent’s Threat Detection Engine is built around uAQL, a powerful event query language. Whenever a Threat Detection rule matches suspicious or unusual behavior, the endpoint agent generates an event in your SIEM.

Although requiring only minimal resources on the endpoint, uAQL fully supports all aspects of the Sigma and Sysmon rule specifications, making it possible to convert them without losing fidelity.

Scalability & Flexibility

Our largest customers have deployed uberAgent to 100,000+ endpoints – each (more information). This shows that there are no built-in limitations in the product’s architecture. It also demonstrates that uberAgent is inherently flexible in how it can be configured and deployed. After all, organizations with hundreds of thousands of endpoints tend to have heterogeneous networks and complex requirements.

Context

uberAgent ESA is probably the security product that collects the most detailed baseline of regular system activity. uberAgent’s digital employee experience monitoring component includes application activity, user sessions, network connections, and browser communications, to name a few.