QRadar EDR (formerly ReaQta): Policies and configuration

The ReaQta-Hive solution supports 4 different types of policies, created by the Dashboard user, and delivered to the Agent. Through the policies, it is possible to configure some of the behaviors of the agent, such as: suppress the generation of an alert, block, or alert when a process is executed, automatically block a behavior. ReaQta supports the following policy types:

1. Log in to the ReaQta Hive dashboard.
2. Go to the policies page and click "Create Policy" button, a new drop-down box is displayed with the supported policies, select allowlist:
   
   
3. Complete the next Create allowlist Policy fields:
   
   Policy Name: Name of the policy to reflect the specific behavior you are looking for across all your endpoints.
   Description (optional): Brief description of what the policy is intending to do.
   Targets: It represents the scope of the policy, where policies are applied, Global or Group.
   Matcher: Describes the matching criteria for the policy to get triggered. Two types of matchers are found here based on Application and Behavior. 

• Application: as its name implies it applies to the application itself and allow action can be configured in 2 ways:
  • App Directory: To allow the application, based on the directory the application is allocated.
    Example: 
    
    Results: Applications running within the specified App Directory are added to the allowlist and are trusted by the organization.
  • Binary Hash: To allow the application, based on the specific hash of the application.
    Example:
    
    Results: It adds "application.exe" to the allowlist granting it access without generating any alert as it is now trusted by the organization.
• Behavior-based: Focuses on the application only when it exhibits a behavior and as same as the application matcher it can be configured in 2 ways:
  • App Directory: To allow the application based on the directory the application it is allocated along with the trigger type that, represents the intended application behavior. 
    Example:
    
    Results: Trust files access from applications in 'Program Files'
  • Binary Hash:  To allow the application based on the specific hash of the application allocated along with the trigger type that, represent the intended application behavior. 
    Example:
    
    Results: Applications matching the specified hash and trigger type (application behavior) are added to the allowlist to become trusted by the organization.

1. Log in to the ReaQta Hive dashboard.
2. Go to the policies page and click "Create Policy" button, a new drop-down box is displayed with the supported policies, select blocklist:
   
   
3. Complete the next Create allowlist Policy fields:         

Policy Name: Name of the policy to reflect the specific behavior you are looking for across all of your endpoints.
Description (optional): Brief description of what the policy is intending to do.
Targets: It represents the scope of the policy, where policies are applied, Global or Group.
Matcher: Describes the matching criteria for the policy to get triggered. Two types of matchers are found here based on Application and Behavior.

• Application: as its name implies it applies to the application itself and allow action can be:
   
  • App Directory: To block the application based, on the directory the application is allocated.
    Example:
    
    Results: Any application running within the specified directory and subdirectories are blocked.
     
  • Binary Hash: To block the application based on the specific hash of the application.
    Example:
    
    Results:  Applications matching the specified hash are blocked.
     
• Behavior-based: Focuses on the application only when it exhibits a behavior and as same as the application matcher it can be configured in 2 ways:
   
  • App Directory: To block the application based on the directory the application is allocated along with the trigger type that, represents the intended application behavior. 
    Example:
    
    Results: Any application running within the specified directory and subdirectories exhibiting ransomware behavior are blocked.
     
  • Binary Hash:  To block the application based on the specific hash of the application allocated along with the trigger type that, represent the intended application behavior.
    Example:
    
    Results: Applications matching the specified hash and trigger type (application behavior) are blocked.

1. Give it a name to reflect the specific behavior you are looking for across all your endpoints.
2. Select one or more binding events that it looks for the customized logic against.
3. Select the applicable operating system that it would specifically apply to. If it applies to all operating systems, it can be a multiselection.
4. Select the target, which represents the scope of the policy, Global or Group.
5. Select the blank script environment to pre-fill the necessary logic to look for the specific events. To allowlist a behavior triggered by a DeStra policy, it is necessary to edit the policy script. The complete documentation can be found at the following address: ReaQta DeStra Docs

Example: 

1. From the dashboard, go to the Administration page and select Configure Anti-Malware.
   
2. Click “Create Exception”
   
3. Complete the fields of the Create Exception form and press the create button to finish
   

1. Directory based.
   Example: C:\Temp\*
    
2. Specific process based. Add the following into the path for the exception <process><PATH>\<processname>
   Example: <process>C:\ProgramFiles\Viruses\maliciousvirus.exe

• Scope: Subgroup > Group > Global.
• Type: Blocklist > Allowlist > Protection
• Matcher: Trigger Hash (higher) to Process Directory (lower)

1. From the Policies page, hover on the wanted policy. A check box is displayed on the left of the policy entry.
   
   
2. Check the box next to the policy or policies and a blue bar is displayed at the very end of the screen with the option to view priority.
   
   
3. Click Show Priority to open the View Priority window.