Managing endpoints

You can monitor the processes, services, and connections that are active on endpoints in your environment. You can also download or files from an endpoint, enable antiransomware detection, update policies on an endpoint, and isolate an endpoint from the network.

Monitoring an endpoint

Procedure

  1. Click Endpoints.
  2. Click an endpoint in the endpoint list.
  3. Click View Endpoint.
  4. Click Live Response.
  5. Click the + icon.
  6. To show a list of active processes on the endpoint, click show processes.
  7. To show a list of active services on the endpoint, click show services.
  8. To show a list of active connections on the endpoint, click show connections.

Downloading files from an endpoint

Procedure

  1. Click Endpoints.
  2. Click an endpoint in the endpoint list.
  3. Click View Endpoint.
  4. Click Live Response.
  5. To download a file from the endpoint, type the following command. 
    download file “<path_to_file>”

Results

The file is downloaded to your workstation. The file is also available to be downloaded from the QRadar EDR Brain. For more information about downloading the file from the QRadar EDR Brain to your workstation, see Downloading files from the QRadar EDR Brain to your workstation.

Deleting files from an endpoint

Procedure

  1. Click Endpoints.
  2. Click an endpoint in the endpoint list.
  3. Click View Endpoint.
  4. Click Live Response.
  5. To delete a file from the endpoint, type the following command. 
    delete file “<path_to_file>”

Results

The file is deleted from the endpoint.

Downloading forensic data from an endpoint

You can download a .zip archive that contains a forensic data package for an endpoint.

About this task

You can download a basic forensic data package, or an advanced forensic data package. It takes approximately 5 minutes to collect the data for the basic package, and approximately 15 minutes to collect the data for the advanced package. The package is available to download for 1 day.

The following table shows the forensic data that is available in the basic and advanced forensic data packages.

Table 1. Forensic data
Basic Advanced
Processes running All data from the basic package
Services Missing updates
Network connections Environment variables
AddressResolutionProtocolCache Prefetch files
DNS cache BitLocker information
System information Named pipes
Installed programs Samba sessions
Updates FILE associations
Security event logs Host file
Scheduled asks Extended event logs
Users and groups UAC settings
Shares Audit policy
Proxy information Firewall rules

Procedure

  1. Click Endpoints.
  2. Click an endpoint in the endpoint list.
  3. Click View Endpoint.
  4. Click Collect Forensic Data.
  5. Enter a name for the .zip archive in the Description field.
  6. Set an Unzip Password to be used to extract the archive.
  7. Choose the Basic or Advanced package.
  8. Click Collect.
  9. When the package is ready, click the Download link in the Forensic Data section of the Endpoint Details screen.

Exporting a list of endpoints

You can export a list of endpoints that you have permission to see in QRadar EDR Dashboard.

Procedure

  1. Click Endpoints.
  2. If you want to export a subset of the endpoints that you have permission to see, click Advanced Filters and filter the endpoints as needed.
  3. Click Export as CSV.

Results

The list of endpoints is downloaded in a .csv file.

Updating policies on an endpoint

Procedure

  1. Click Endpoints.
  2. Click an endpoint in the endpoint list.
  3. Click View Endpoint.
  4. Click Live Response.
  5. If you want to see the policies that are loaded on the endpoint, type the following command. 
    show pol
  6. To force the policies that are loaded on the endpoint to be deleted and refreshed, type the following command. 
    clean pol

Results

The policies that are loaded on the endpoint are deleted, and policies are downloaded to the endpoint from QRadar EDR. For more information, see Managing policies.

Isolating an endpoint

About this task

Windows-only

Procedure

  1. Click Endpoints.
  2. Click an endpoint in the endpoint list.
  3. Click View Endpoint.
  4. Click Isolate.

Results

The endpoint is isolated from the network, but can still communicate with QRadar EDR Dashboard.

Uninstalling the QRadar EDR Agent from an endpoint remotely

Agents are uninstalled automatically when your license expires, or when your client is deleted. You can also uninstall an agent for a specific endpoint from the dashboard if needed.

Procedure

  1. Click Endpoints.
  2. Click an endpoint in the endpoint list.
  3. Click View Endpoint.
  4. Click Uninstall.
  5. Click Uninstall.

Results

The agent is uninstalled from the endpoint.

Uninstalling the QRadar EDR Agent on a Linux endpoint locally

Procedure

Uninstall the agent by typing one of the following commands on the endpoint.
  • Debian-based Linux® endpoints
    sudo dpkg -r keeperx
  • RPM-based Linux endpoints
    sudo rpm -e keeperx

Uninstalling the QRadar EDR Agent on a Mac endpoint locally

Procedure

  1. Go to the /Library/IBM Security ReaQta directory by typing the following command. 
    cd /Library/IBM\ Security\ ReaQta
  2. Uninstall the agent by typing the following command. 
    sudo ./uninstall.sh
  3. Verify that the /Library/IBM Security ReaQta directory no longer exists by typing the following command. 
    ls /Library
  4. Verify that the /Applications/IBM Security ReaQta app no longer exists by typing the following command. 
    ls /Applications

Uninstalling the QRadar EDR Agent on a Windows endpoint locally when protected uninstallation is disabled

When protected uninstallation is disabled, a user can uninstall the agent from an endpoint without a token.

About this task

Windows-only

Procedure

Uninstall the agent by typing the following command on the endpoint. 
"C:\Program Files\ReaQta\keeper.exe" uninstall

Results

The agent is uninstalled from the endpoint.
If protected uninstallation was previously enabled but is now disabled, an offline endpoint is not aware that protected uninstallation is disabled. In this case, follow one of these options to uninstall the agent.

Uninstalling the QRadar EDR Agent on a Windows endpoint locally when protected uninstallation is enabled

When protected uninstallation is enabled, a user can uninstall the agent from an endpoint only if you provide them a token.

About this task

Windows-only

Procedure

  1. Click Endpoints.
  2. Click an endpoint in the endpoint list.
  3. Click View Endpoint.
  4. Click Uninstall.
  5. Click Generate Uninstallation Token.
  6. Enter a reason for uninstalling the agent from the endpoint, then click Generate & Download.
    Important: The token file expires 24 hours after it is created.
  7. Copy the token to the endpoint.
  8. Uninstall the agent by typing the following command on the endpoint. 
    "C:\Program Files\ReaQta\keeper.exe" uninstall <path_to_token>

Results

The agent is uninstalled from the endpoint.

If you can't generate a token because the QRadar EDR Dashboard is offline, follow the steps in Uninstalling the QRadar EDR Agent on a Windows endpoint locally in safe mode.