Managing endpoints

You can monitor a specific endpoint to view the active processes, services, and connections to help investigation by providing updated information and context on what is happening on the endpoint in real time.

1. Click Endpoints.
2. Click an endpoint in the endpoint list.
3. Click View Endpoint > Live Response.
4. Click the + icon.
5. To view a list of active processes on the endpoint, click show processes.
6. To view a list of active services on the endpoint, click show services.
7. To view a list of active connections on the endpoint, click show connections.

You can download files to help evaluate security incidents. You can use these files to collect malicious samples, for further manual analysis, or for working with other tools.

1. Click Endpoints.
2. Click an endpoint in the endpoint list.
3. Click View Endpoint > Live Response.
4. To download a file from the endpoint, type the following command.

   download file “<path_to_file>”

You can delete files from an endpoint as part of your response to a security incident. You can delete files from an endpoint to remove malicious artifacts such as code executables, configuration files, or service files.

1. Click Endpoints.
2. Click an endpoint in the endpoint list.
3. Click View Endpoint > Live Response.
4. To delete a file from the endpoint, type the following command.

   delete file “<path_to_file>”

You can download a .zip archive that contains a forensic data package for an endpoint to help identify anomalous or malicious behavior on the endpoint across processes, services, and connections. The forensic data package provides a snapshot of key information of an endpoint's state, configuration, and past security events, helping you to collect all the relevant information to assess the state of an endpoint.

1. Click Endpoints.
2. Click an endpoint in the endpoint list.
3. Click View Endpoint > Collect Forensic Data.
4. Enter a name for the .zip archive in the Description field.
5. Set an Unzip Password to be used to extract the archive.
6. Choose the Basic or Advanced package and click Collect.
7. When the package is ready, click the Download link in the Forensic Data section of the Endpoint Details screen.

You can export a list of endpoints that you have permission to see in QRadar EDR Dashboard to get an overview of all of the endpoints on which QRadar EDR is installed.

1. Click Endpoints.
2. If you want to export a subset of the endpoints that you have permission to see, click Advanced Filters and filter the endpoints as needed.
3. Click Export as CSV.

Policies define the malicious behaviors to be detected and for which alerts are generated and which are potentially blocked. You can view and manage the policies that are loaded on any specific endpoint.

1. Click Endpoints.
2. Click an endpoint in the endpoint list.
3. Click View Endpoint > Live Response.
4. If you want to see the policies that are loaded on the endpoint, type the following command.

   show pol

5. To force the policies that are loaded on the endpoint to be deleted and refreshed, type the following command.

   clean pol

Windows-only You can isolate a specific endpoint to stop all network access on the endpoint as part of your response to prevent network communications from the infected endpoint to other endpoints.

1. Click Endpoints.
2. Click an endpoint in the endpoint list.
3. Click View Endpoint > Isolate.

Agents are uninstalled automatically if your license expires, or when your client is deleted. If necessary, you can also uninstall an agent for a specific endpoint from the dashboard.

1. Click Endpoints.
2. Click an endpoint in the endpoint list.
3. Click View Endpoint > Uninstall.

You might want to decommission an endpoint from QRadar EDR, or in some cases remove QRadar EDR as part of support procedures to help resolve issues.

You might want to decommission an endpoint from QRadar EDR, or in some cases remove QRadar EDR as part of support procedures to help resolve issues.

1. Go to the /Library/IBM Security ReaQta directory by typing the following command.

   cd /Library/IBM\ Security\ ReaQta

2. Uninstall the agent by typing the following command.

   sudo ./uninstall.sh

3. Verify that the /Library/IBM Security ReaQta directory no longer exists by typing the following command.

   ls /Library

4. Verify that the /Applications/IBM Security ReaQta app no longer exists by typing the following command.

   ls /Applications

Windows-only You might want to decommission an endpoint from QRadar EDR, or in some cases remove QRadar EDR as part of support procedures to help resolve issues.

"C:\Program Files\ReaQta\keeper.exe" uninstall

Windows-only You might want to decommission an endpoint from QRadar EDR, or in some cases remove QRadar EDR as part of support procedures to help resolve issues.

1. Click Endpoints.
2. Click an endpoint in the endpoint list.
3. Click View Endpoint > Uninstall > Generate Uninstallation Token.
4. Enter a reason for uninstalling the agent from the endpoint, then click Generate & Download.
   Important: The token file expires 24 hours after it is created.
5. Copy the token to the endpoint.
6. Uninstall the agent by typing the following command on the endpoint.

   "C:\Program Files\ReaQta\keeper.exe" uninstall <path_to_token>

Windows-only If the standard QRadar EDR Agent uninstallation fails, you can uninstall the agent in safe mode.

1. Enter safe mode, then open the command prompt as an administrator.
2. Stop and delete keeper by typing the following command.

   sc stop keeper & sc delete keeper

3. Stop and delete rqtsentry by typing the following command.

   sc stop rqtsentry & sc delete rqtsentry

4. Stop and delete rqtnetsentry by typing the following command.

   sc stop rqtnetsentry & sc delete rqtnetsentry

5. Stop and delete i00 by typing the following command.

   sc stop i00 & sc delete i00

6. Remove the ReaQta folder by typing the following command.

   rmdir c:\Program Files\ReaQta

7. Remove the rqtsentry, rqtnetsentry, and i00 system files by typing the following commands.

   del c:\windows\system32\drivers\rqtsentry.sys

   del c:\windows\system32\drivers\rqtnetsentry.sys

   del c:\windows\system32\drivers\i00.sys

8. Open the registry editor by typing the following command.

   regedit

9. Search the registry for reaqta and remove any entries that are found.