EDR High-Level Design

Introduction

OffStrike EDR is an Endpoint Detection and Response (EDR) system that provides real-time threat detection and automated incident response capabilities. It leverages machine learning to analyze system events and identify malicious activity, enabling proactive protection against advanced threats.

Competitors & Market Trends

SentinelOne Singularity, a comparable AI-powered cybersecurity platform, exhibits strengths in AI-driven threat prevention, autonomous response, and comprehensive protection across endpoints, cloud, and identity. However, it also faces challenges related to cost, complexity, and limited on-premises deployment options. User reviews highlight the effectiveness of its AI prevention and autonomous response capabilities, while also expressing concerns about its cost and complexity. These insights inform potential improvements for OffStrike, such as focusing on cost-effectiveness, simplified management, and offering on-premises deployment options. By addressing these aspects, OffStrike can enhance its appeal and accessibility to a broader range of organizations.

Competitors and Market Research

Competitor Name	Sentiment	Feedback
CrowdStrike Falcon	Positive	“Excellent protection, proactive threat hunting is a lifesaver.”
	Negative	“Expensive, can be complex to manage.”
SentinelOne Singularity	Positive	“AI-powered prevention is impressive, autonomous response saves time.”
	Negative	“High cost, complex configuration.”
Microsoft Defender for Endpoint	Positive	“Good integration with Windows, decent basic protection.”
	Negative	“Limited advanced features compared to others.”
Elastic Security	Positive	“Open-source flexibility, good for customized deployments.”
	Negative	“Steeper learning curve requires more technical expertise.”

Overall positive trends:

1. Strong emphasis on AI and ML for threat detection and response.
2. Proactive threat hunting and prevention capabilities.
3. Comprehensive endpoint protection beyond just basic antivirus.

Overall negative trends:

1. High cost, especially for smaller organizations.
2. Complexity in configuration and management.
3. Limited on-premises deployment options for some solutions.

Stakeholders

OffStrike EDR’s stakeholders include primary users like security analysts, IT administrators, and the incident response team, as well as secondary stakeholders such as management, end-users, and the development team. Each group has specific needs and priorities, ranging from real-time visibility and threat detection for analysts to ease of deployment and management for IT administrators. Understanding these diverse needs is crucial for the successful development and implementation of the EDR system, ensuring it effectively serves its purpose for all stakeholders.

Stakeholder Needs

Stakeholder	Priority	Needs
Security Analysts	High	Real-time visibility into endpoint activity, accurate threat detection, efficient incident investigation tools, automated response options, clear and concise reporting.
IT Administrators	High	Easy deployment and management of agents, centralized control and configuration, integration with existing IT infrastructure, minimal performance impact on endpoints.
Incident Responders	High	Detailed incident information, tools for containment and remediation, collaboration features, ability to conduct threat hunting exercises.
Management	Medium	High-level summaries of security posture, reports on incidents and trends, metrics to measure the effectiveness of the EDR system.
End-users	Medium	Minimal disruption to their workflow, protection from malware and other threats, privacy safeguards for their data.
Developers	Medium	Access to data for analysis and improvement of the ML models, feedback from users on system performance and usability, resources for ongoing development.

Target Audience/End User

The primary target audience and end-user group for OffStrike is the Incident Response Team. This team is responsible for handling security incidents, and they will directly interact with the system to investigate and remediate threats. They require comprehensive tools and information to understand the scope of an incident, contain its impact, and take appropriate action to restore security. OffStrike will provide them with detailed incident reports, analysis of the events, and tools for just-in-time response and remediation. While other stakeholders like security analysts and IT administrators will also interact with the system, the Incident Response Team’s needs are prioritized in the design and functionality of OffStrike, as they are the primary users who will rely on the system to effectively manage and resolve security incidents.

User Stories

1. As a security analyst, I want to view real-time events from all endpoints so that I can quickly identify potential threats.
2. As an incident responder, I want to receive alerts for high-severity events so that I can take immediate action to contain and investigate them.
3. As an IT administrator, I want to easily deploy the agent to new endpoints so that I can ensure comprehensive coverage across the organization.
4. As a security analyst, I want to search and filter events based on various criteria so that I can efficiently investigate suspicious activity.
5. As an incident responder, I want to initiate a remote shell to an endpoint from the server console so that I can perform just-in-time response actions.
6. As a security manager, I want to receive reports on detected threats and incident response actions so that I can monitor the overall security posture.
7. As an end-user, I want the agent to have a minimal impact on my system performance so that I can continue my work without disruption.
8. As a security analyst, I want to understand the rationale behind the ML model’s predictions so that I can validate and improve its accuracy.

Use Case

Use Case Title: Analyze and Report on Suspicious Activity

User Type: Incident Responder

Goal of User: To receive a clear and concise analysis of potentially malicious events, with recommended remediation actions.

Preconditions:

• The EDR agent is deployed on endpoints and actively collecting event logs.
• The server is receiving and processing event data from agents.
• The LLM is configured and ready to perform analysis.

Triggers:

• The server aggregates a group of related events based on timestamps and severity.

Post-Conditions:

• The LLM analyzes the event group and produces a detailed report.
• The report includes:
  • A clear description of the suspicious activity (what, when, why, who, how, where).
  • Confirmation of whether the activity is true or false positive.
  • Automated actions taken (if any) to contain the threat.
  • Recommended remediation actions for the operator.

Scenario:

1. The server aggregates a group of related events.
2. The LLM analyzes the events, correlating them with MITRE ATT&CK framework patterns.
3. The LLM determines if the activity is malicious and generates a detailed report.
4. If the activity is benign (false positive), the LLM moves on to the next event group.
5. If the activity is malicious, the report includes information about the attack, automated actions taken, and recommended remediation steps.
6. The incident responder reviews the report and takes further action as needed.

Exceptions:

• The LLM may fail to accurately classify the event as malicious or benign.
• The LLM may not have sufficient information to generate a complete report.
• The recommended remediation actions may not be effective or applicable.

Define Scope & Features

OffStrike will focus on delivering a streamlined and effective EDR solution with a specific emphasis on automated analysis and incident reporting.

Major Features:

1. Agent-based Log Collection and Transmission: The agent will collect comprehensive logs from endpoints and transmit them securely to the server.
2. MITRE ATT&CK-based Event Correlation: The server will correlate events based on patterns defined in the MITRE ATT&CK framework to identify potential threats.
3. LLM-powered Analysis and Reporting: The LLM will analyze correlated events, determine their maliciousness, and generate detailed incident reports with remediation recommendations.

Minor Features:

1. User Authentication and Authorization: Secure access control to the server interface.
2. Real-time Event Monitoring Dashboard: A dashboard to visualize real-time event activity.
3. Basic Threat Containment Actions: Automated actions to contain threats, such as process termination or network blocking.
4. Incident Report Archiving and Search: Storage and retrieval of past incident reports.
5. Agent Health Monitoring: Monitoring the status and health of deployed agents.
6. System Configuration and Settings: Configuration options for server and agent settings.