User Guide
The Genian EDR app lets you query the threats and endpoint events of a Genian Insights E console from Logpresso, and handle threats and response requests there. The app screens connect to the console directly instead of copying data into Logpresso, so they always show the current state of the console.
Before you start
The app screens need a connect profile of type Genian EDR.
- Endpoint URL - Console address. e.g.
https://hostname:8443 - User ID / Password - Console administrator account
- OTP secret key - Only when the console uses two-factor authentication (Google OTP)
See Getting Started for the registration steps.
is signed out, and when that user signs in again the app's session ends. Create a dedicated
integration account. If the console restricts access by IP, add the Logpresso server IP to the allow
list.
Basic flow
The basic flow of threat response is Threat Monitoring → Threat Management → Threat Details → Event Investigation → Response.
Check the overall picture in Threat Monitoring and pick the threats to handle in Threat Management. Review the detection evidence and the affected endpoints of a single threat in its details, then verify the behavior events of that endpoint in Event Investigation. Responses such as sample collection and artifact collection are requested from the threat details screen.
Menus
| Menu | Description | Guide |
|---|---|---|
| Threat → Threat Monitoring | Overview of threat status, TOP 10 lists, threat classifications and event trend | Threat Monitoring |
| Threat → Threat Management | Lists detected threats and manages them by state | Threat Management |
| Investigation → Event Investigation | Searches endpoint behavior events and traces process relationships | Event Investigation |
| Investigation → Collected Files | Saves files collected from endpoints into the file store | Collected Files |
| Policy → Custom IOC Management | Registers malicious and benign hashes and IPs for detection | Custom IOC Management |
| Policy → YARA Rule | Manages the YARA rules run on endpoints | YARA Rule |
The threat details screen is not a menu. It opens with the Details button of a threat in Threat Management, or when you click a threat under New threats in Threat Monitoring.
Selecting a period
Threat Management, Event Investigation and Collected Files share the same period picker.
- Quick ranges - Today, Yesterday, This Week, Last Week, Last N Day and so on. The list follows the console settings
- Custom range - Pick a start and end time on the calendar. Move to previous time period and Move to next time period move to the previous or next period of the same length
- Maximum range - The longest range you can pick follows the console settings; the default is one month
Periods are applied against the console server clock, not the Logpresso server clock.
Search conditions
The search boxes of Threat Management and Event Investigation use the same Lucene query syntax as the console.
- Enter conditions as
field:value. e.g.DetectType:XBA AND Score:[80 TO 100] - Typing a field name opens an autocomplete list, and after
field:the values present in that field are suggested - Threat Management does not support keyword search without a field. The console behaves the same way, so always name the field
Pages in this guide
| Page | Content |
|---|---|
| Getting Started | Every step from registering a connect profile to handling a threat |
| Threat Monitoring | Widgets and how to move from a widget to other screens |
| Threat Management | Filtering the threat list and the detail panel |
| Threat Details | Detection evidence, affected devices, attack story line, threat handling |
| Event Investigation | Event search, search filter, time chart, ATT&CK matrix, event details |
| Collected Files | Listing collected files and saving them into the file store |
| Custom IOC Management | Adding hashes and IPs, import and Excel export |
| YARA Rule | Adding rules, validation, status |
state changed in the console shows up in the app on the next query.
If you are new to the app, start with Getting Started.