Skip to content
This repository was archived by the owner on Jun 6, 2025. It is now read-only.
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 0 additions & 16 deletions core/mondoo-edr-policy.mql.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -182,30 +182,26 @@ queries:
mondoo.com/filter-title: windows

- uid: mondoo-edr-policy-ensure-crowdstrike-agent-is-running-macos
title: Ensure CrowdStrike Agent is running
filters: |
asset.platform == 'macos'
package('Falcon').installed
mql: |
macos.systemExtensions.where(identifier == "com.crowdstrike.falcon.Agent").all(enabled == true && active == true && state == "activated_enabled")
- uid: mondoo-edr-policy-ensure-crowdstrike-agent-is-running-linux
title: Ensure CrowdStrike Agent is running
filters: |
asset.family.contains('linux')
package('falcon-sensor').installed
mql: |
service('falcon-sensor').running
service('falcon-sensor').enabled
- uid: mondoo-edr-policy-ensure-crowdstrike-agent-is-running-windows
title: Ensure CrowdStrike Agent is running
filters: |
asset.family.contains('windows')
package('CrowdStrike Sensor Platform').installed
mql: |
service('CSFalconService').running
service('CSFalconService').enabled
- uid: mondoo-edr-policy-ensure-sentinelone-agent-is-running-macos
title: Ensure SentinelOne Agent is running
filters: |
asset.platform == 'macos'
package('SentinelOne Extensions').installed
Expand All @@ -220,15 +216,13 @@ queries:
service('com.sentinelone.sentineld-guard').running
service('com.sentinelone.sentineld-guard').enabled
- uid: mondoo-edr-policy-ensure-sentinelone-agent-is-running-linux
title: Ensure SentinelOne Agent is running
filters: |
asset.family.contains('linux')
package('SentinelAgent').installed || package('sentinelagent').installed
mql: |
service('sentinelone').running
service('sentinelone').enabled
- uid: mondoo-edr-policy-ensure-sentinelone-agent-is-running-windows
title: Ensure SentinelOne Agent is running
filters: |
asset.family.contains('windows')
package('Sentinel Agent').installed
Expand All @@ -238,7 +232,6 @@ queries:
services.where(name == /SentinelStaticEngine/).any(running == true)
services.where(name == /SentinelStaticEngine/).any(enabled == true)
- uid: mondoo-edr-policy-ensure-eset-agent-is-running-macos
title: Ensure ESET Agent is running
filters: |
asset.platform == 'macos'
package('ESET Endpoint Security').installed
Expand All @@ -247,23 +240,20 @@ queries:
services.where(name == 'com.eset.enterpriseinspector.eiagent').any(enabled == true)
services.where(name == 'com.eset.remoteadministrator.agent').any(enabled == true)
- uid: mondoo-edr-policy-ensure-eset-agent-is-running-linux
title: Ensure ESET Agent is running
filters: |
asset.family.contains('linux')
file('/opt/eset/RemoteAdministrator/Agent').exists
mql: |
service('eraagent').running
service('eraagent').enabled
- uid: mondoo-edr-policy-ensure-eset-agent-is-running-windows
title: Ensure ESET Agent is running
filters: |
asset.family.contains('windows') &&
['ESET Endpoint Security', 'ESET Server Security'].one(package(_).installed)
mql: |
service('EraAgentSvc').running
service('EraAgentSvc').enabled
- uid: mondoo-edr-policy-ensure-defender-agent-is-running-and-updated-windows
title: Ensure Windows Defender Agent is running
filters: |
asset.family.contains('windows')
service('WinDefend').installed
Expand All @@ -272,23 +262,20 @@ queries:
service('WinDefend').enabled
parse.json(content: powershell("Get-MpComputerStatus | Select-Object -Property AntivirusSignatureAge | ConvertTo-JSON").stdout).params.AntivirusSignatureAge == 0
- uid: mondoo-edr-policy-ensure-wazuh-agent-is-running-macos
title: Ensure Wazuh Agent is running
filters: |
asset.platform == "macos"
file('/Library/Ossec').exists
mql: |
service('wazuh-agentd').running
service('wazuh-agentd').enabled
- uid: mondoo-edr-policy-ensure-wazuh-agent-is-running-windows
title: Ensure Wazuh Agent is running
filters: |
asset.platform == "windows"
package('Wazuh Agent').installed
mql: |
service('WazuhSvc').running
service('WazuhSvc').enabled
- uid: mondoo-edr-policy-ensure-sophos-endpoint-defense-is-running-windows
title: Ensure Sophos Endpoint Defense Agent is running
filters: |
asset.family.contains('windows') &&
['Sophos Endpoint Defense', 'Sophos Endpoint Agent'].all(package(_).installed)
Expand All @@ -298,23 +285,20 @@ queries:
service('Sophos MCS Agent').running
service('Sophos MCS Agent').enabled
- uid: mondoo-edr-policy-ensure-cortex-xdr-agent-is-running-macos
title: Ensure Cortex XDR Agent is running
filters: |
asset.platform == 'macos' &&
['Cortex XDR', 'Cortex XDR Agent'].all(package(_).installed)
mql: |
service('com.paloaltonetworks.cortex.agent').running
service('com.paloaltonetworks.cortex.agent').enabled
- uid: mondoo-edr-policy-ensure-cortex-xdr-agent-is-running-windows
title: Ensure Cortex XDR Agent is running
filters: |
asset.family.contains('windows') &&
packages.where(name == /Cortex XDR/i).any(installed)
mql: |
service('cyserver').running
service('cyserver').enabled
- uid: mondoo-edr-policy-ensure-watchguard-agent-is-running-windows
title: Ensure WatchGuard Agent is running
filters: |
asset.family.contains('windows') &&
package('WatchGuard EPDR').installed
Expand Down