Many customers use runZero to get a consolidated view into their assets. Once you’ve integrated your endpoint protection platform with runZero, there are a variety of ways you can monitor the state of your deployment from within runZero.

Who is this playbook for and why?

This playbook will be useful for security and IT personnel who are responsible for managing their organization’s endpoint protection platform. It can help find gaps in your endpoint protection coverage and ensure that you’re getting full value out of your investment.

How will runZero help?

runZero is able to discover assets on your network without an agent and import asset information from your endpoint protection platform. This allows you to identify gaps in coverage as well as other health information about your EDR implementation.

What will I need to do?

To find gaps in your endpoint protection coverage, start by scanning your entire network. Then, if applicable, you will configure a runZero integration with your endpoint protection platform to merge that data with the runZero data. Lastly, you will query asset data to find assets that do not have the platform installed.

Prerequisites

• A complete asset inventory
• An endpoint protection platform supported by runZero

Steps to implement

1. Configure endpoint protection integration:
   • CrowdStrike
   • SentinelOne
   • Microsoft 365 Defender
2. (Optional) If your EDR is not listed in our native integrations, you can check out our Custom Integrations Repository or Create your own custom integration.
3. Use sample queries to search your inventory for assets missing endpoint protection.
4. Set up alerts to automatically notify you of gaps or to initiate a workflow.

Sample Queries

There are endless ways to combine terms and operators into effective queries, and the examples below can be used as-is or adjusted to meet your needs.

CrowdStrike Falcon

The following queries can be used to monitor the state of your CrowdStrike deployment from within runZero.

Identify assets that do not have CrowdStrike installed

(type:server OR type:desktop OR type:laptop) AND not edr.name:CrowdStrike

Identify assets running CrowdStrike in Reduced Functionality Mode (RFM)

(type:server OR type:desktop OR type:laptop) AND @crowdstrike.dev.reducedFunctionalityMode:yes

Identify assets running CrowdStrike where a Protection Policy has not been deployed

(type:server OR type:desktop OR type:laptop) AND @crowdstrike.dev.provisionStatus:NotProvisioned

Identify assets that are quarantined

(alive:true OR scanned:false) AND @crowdstrike.dev.status:Contained

SentinelOne

The following queries can be used to monitor the state of your SentinelOne deployment from within runZero.

Identify assets that do not have SentinelOne installed

(type:server OR type:desktop OR type:laptop) AND not edr.name:SentinelOne

Identify assets that have been decommissioned in SentinelOne

(alive:true OR scanned:false) AND @sentinelone.dev.isDecommissioned:true

Identiy assets that are running an outdated agent

(type:server OR type:desktop OR type:laptop) AND @sentinelone.dev.isUpToDate:false

Identify assets that are quarantined

(alive:true OR scanned:false) AND @sentinelone.dev.networkQuarantineEnabled:true

Microsoft 365 Defender

The following queries can be used to monitor the state of your Microsoft 365 Defender deployment from within runZero.

Identify assets that do not have Defender installed

(type:server OR type:desktop OR type:laptop) AND not edr.name:"=Microsoft Defender for Endpoint"

Identiy assets that are potentially running an outdated agent

(type:server OR type:desktop OR type:laptop) AND edr.name:"=Microsoft Defender for Endpoint" AND not @ms365defender.dev.defenderAVStatus:="Updated"

Identify assets that are not active

(alive:true OR scanned:false) AND edr.name:"=Microsoft Defender for Endpoint" AND not @ms365defender.dev.avMode:"=Active"

Outcome demo

This video is a short demo of what the outcome of finding gaps in your EDR deployment may look like.

Getting help

If you need assistance in building out this process, you can book a session with a runZero Customer Success Engineer to discuss further.