Listen to this Post
After testing, it’s clear that BitDefender does not meet the requirements for the EDR Telemetry Project. The key issue is that its visibility is entirely dependent on detection alerts. There’s no raw telemetry access for proactive threat hunting.
🔴 Why it doesn’t qualify:
❌ No ability to search logs unless an alert fires
❌ No continuous event ingestion for full system visibility
❌ Functions more like a traditional NGAV than a true EDR
For an EDR to qualify, it must provide real-time event ingestion and raw telemetry access—not just visibility tied to alerts. This requirement is outlined in the eligibility criteria here:
EDR Eligibility Criteria
You Should Know:
To ensure your EDR solution meets the necessary requirements for proactive threat hunting, here are some key commands and steps to verify telemetry and logging capabilities:
Linux Commands for Log Inspection:
1. Check System Logs:
sudo journalctl -xe
This command provides a detailed view of system logs, which is crucial for identifying anomalies.
2. Monitor Real-Time Logs:
sudo tail -f /var/log/syslog
Use this to monitor logs in real-time, ensuring continuous event ingestion.
3. Search Logs for Specific Events:
sudo grep "error" /var/log/syslog
This helps in searching logs for specific keywords, such as errors or alerts.
4. Audit Logs with Auditd:
sudo auditctl -l
This lists all active audit rules, ensuring comprehensive logging.
Windows Commands for Telemetry Verification:
1. Check Event Logs:
Get-WinEvent -LogName Security
This retrieves security-related events, which are critical for threat hunting.
2. Enable Advanced Auditing:
auditpol /set /category:"Detailed Tracking" /success:enable /failure:enable
This enables detailed tracking for both success and failure events.
3. Export Logs for Analysis:
Export-Csv -Path "C:\Logs\SecurityLogs.csv" -InputObject (Get-WinEvent -LogName Security)
Export logs for further analysis, ensuring raw telemetry access.
4. Monitor Real-Time Events:
Get-WinEvent -LogName Security -MaxEvents 10 -Wait
This monitors real-time events, ensuring continuous visibility.
Steps to Verify EDR Capabilities:
1. Test Log Retention:
Ensure your EDR retains logs for at least 7 days without requiring additional add-ons.
2. Verify Raw Telemetry Access:
Confirm that you can access raw telemetry data without relying solely on detection alerts.
3. Check for Continuous Ingestion:
Ensure the EDR ingests events continuously, not just when an alert is triggered.
4. Evaluate Threat Hunting Features:
Test the EDR’s ability to perform proactive threat hunting using raw telemetry data.
What Undercode Say:
BitDefender’s failure to meet EDR Telemetry Project requirements highlights the importance of raw telemetry access and continuous event ingestion for effective threat hunting. To ensure your EDR solution is up to par, regularly verify its logging and telemetry capabilities using the commands and steps outlined above. A robust EDR should provide comprehensive visibility, enabling proactive threat detection and response. For more details on EDR eligibility, visit EDR Telemetry Project.
Additional Resources:
References:
Reported By: Kostastsale Edr – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
