Some event sources are extremely verbose and produce information that is often irrelevant to lateral movement analysis. An example of such event is a Windows Service that runs every few seconds and generates a local System logon event. One of the benefits of Logon Tracker is the ability to filter out these unwanted events and focus analysis on relevant activity. The settings in this section represent the recommended default values that control which events are captured, and which are dropped.
Note that there may be situations in which you want to modify these settings. An example would be “local” logon events, which are produced when a user/service logs into the system locally (that is, they are sitting in front of the computer). This type of logon activity is typically irrelevant in the context of a lateral movement investigation in which an attacker is running software on remote systems or logging into systems via RDP. However, this event could be useful to an insider threat investigation.
Another reason to modify these settings is to customize the filters to account for common events in your environment. By tuning the filters to your environment, the volume of receptive endpoints events can be reduced dramatically. The table provides a description of the filter values and recommended default values
Parameter | Description | Default Values | Default Value Description |
|---|---|---|---|
Ignore Addresses | The list of addresses to ignore. These filters are applied to the source or target address of the logon event based on the direction of the logon. For an outgoing logon, the target address is filtered. For an incoming logon the source address is filtered. These default values indicate logons that originated from the local system and are therefore less relevant. | 127.0.0.1 | IPv4 Loopback |
::1 | IPv6 Loopback | ||
<IPV4ADDR> | Special value used to denote the IPv4 address(es) assigned to the endpoint. Value is determined by the agent at runtime. | ||
<IPV6ADDR> | Special value used to denote the IPv6 address(es) assigned to the endpoint. Value is determined by the agent at runtime. | ||
Ignore Hosts | The list of hostnames to ignore. These filters are applied to the source or target hostname of the logon event based on the direction of the logon. For an outgoing logon, the target hostname is filtered. For an incoming logon the source hostname is filtered. These default values indicate logons that originated from the local system and are therefore less relevant. | localhost | Literal string representing a logon originating from the current system. |
<HOSTNAME> | Special value used to denote the host name of the endpoint. Value is determined by the agent at runtime. | ||
Ignore Accounts | The list of target logon accounts to ignore. These filters are only applied to the target account used to log into the system. These default values indicate logons that originated from the local system and are therefore less relevant. | <HOSTNAME>$ | Special value used to denote the endpoint’s system account, which contains a ‘$’ suffix. Hostname value is determined by the agent at runtime. |
<SYSTEM ACCOUNTS> | Any local computer system account. For Windows systems, these are all NT AUTHORITY, NT SERVICE, Font Driver Host, and Window Manager accounts. | ||
"" | Windows often records “empty” accounts (i.e., accounts with no value). Because the Endpoint UI does not support adding an empty value, this value is represented in the UI with two double quotation characters. | ||
< COMPUTER > | Filter computer accounts that are not the local computer account. | ||
Ignore Categories | The list of logon categories to ignore. Valid categories are: unknown, rdp, network share, local, ssh, service, and network | local | Local logons. For example, service or console logons. |
Ignore Status | The list of status to ignore. See Logon Status below for more information. | N/A | This list is empty by default. |
Filter Tunneled Logons | Filter events that Logon Tracker has determined to be tunneled | Toggled off | This setting will optionally drop events determined to be tunneled. The setting will override some (local IP/Host name) filters. This is due to the addresses/hosts being the same values in this case. |