Skip to main content

SMBv1AuditAutofix

Purpose​

This solution contains the SMBv1 audit and autofix based on the EDF.

Associated Content​

ContentTypeFunction
Script - SMBv1 Status Audit/Autofix [DV,Param]ScriptThis script is created to run the detection/remediation for SMBv1 Enabled based on EDF. It will act only if the dropdown EDF "SMB1 Vulnerability" is set to 'Audit Only' or 'Audit With Autofix' at any client, location, or computer level.
Script - SMBv1 Enable Detection Ticketing - Per ClientClient ScriptThis client script creates a ticket for each client with the computer count where remediation is required.
Script - SMB1 Traffic Detection Monitor CreationClient ScriptRemote monitors "ProVal - Production - SMB1 Traffic Detection" will be set up on computers where the SMB1 Detection remote monitor identifies the SMB1 Server Status as Enabled. In the Dataview - SMBv1 Status Audit, the SMB1 Server Status column will display Enabled for these machines. Dataview - SMBv1 Status Audit gathers the state of the monitor failure to show the machines where the SMB1 is used.
Dataview - SMBv1 Status AuditDataviewThis dataview gathers the data from the script CWA Script - SMBv1 Enabled Detection & Remediation and depicts the status of SMB Enabled on the agent where it is deployed.
Remote Monitor - SMB1 DetectionRemote MonitorChecks whether SMB1 is enabled on the end machine. It runs the OS version compatible command to fetch the data.
Internal Monitor - SMB1 AutofixInternal MonitorThis internal monitor detects online Windows agents and performs autofix on computers where the "Audit with Autofix" is set via client, location, or computer level EDF "SMB1 Vulnerability". The Remote Monitor - SMB1 Detection shows failure, and the autofix Script - SMBv1 Status Audit/Autofix [DV, Param] has not run in the past week.
△ Custom - Execute Script - SMB1 Audit/AutofixAlert TemplateThis needs to be scheduled with the Remote Monitor - SMB1 Detection and the Internal Monitor - SMB1 Autofix to perform the Audit and Autofix based on EDF selection at the client, location, or computer level.

Implementation​

Remove Old Solution​

If this solution is approved, please remove the following DV and Remote monitor:

To remove them, please run the following query:

DELETE FROM groupagents WHERE NAME = 'ProVal - Production - SMB1 Detection';
DELETE FROM agents WHERE NAME = 'ProVal - Production - SMB1 Detection' AND computerid > 0; 
DELETE FROM dataviews WHERE name = 'SMB1 Status [Remote Monitor]';

Import New Solution​

  1. Import the following content using the ProSync Plugin:

    Import the EDFs, Searches, Groups, and Remote monitor following the document below:

    • Import - Remote Monitor - SMB1 Detection Query

  2. Reload the system cache:

    Reload Cache

  3. Configure the solution as outlined below:

    • Navigate to Browse → Groups (△ System Monitoring→△ Vulnerability Management) → Computers→ Remote monitors within the CWA Control Center and set the following:
      • Remote Monitor - SMB1 Detection
        • Validate that the monitor is configured with the alert template "Default - Do Nothing" and if it is not, assign the alert template manually to perform the status audit and autofix based on the EDF selection.
    • Navigate to Automation → Monitors within the CWA Control Center and set up the following:
    • Schedule the client script "Script - SMB1 Traffic Detection Monitor Creation" to gather the SMB1 live used state from the machines based on the event ID detection.
      • This client script will deploy the remote monitor to all the computers where "Remote Monitor - SMB1 Detection" has detected SMB1 enabled.
      • The Dataview - SMBv1 Status Audit gathers the state of the monitor "ProVal - Production - SMB1 Traffic Detection" and shows data as "Yes" or "No" if used or not used, respectively.
    Note: Group "△ Vulnerability Management" under "△ System Monitoring" is created as a standard group to maintain a record of all monitors being developed in the future to be applied from it.
    ![Group Monitoring](../../static/img/docs/343654e4-9263-4fec-87c1-3c3401a94e95/image_2.webp)

    It contains all Windows Servers and Workstations whose onboarding is completed and service plans are under contract.
    Therefore, it is mandatory to validate that the monitors applied to this group have their Limit applied based on the Audit or Audit with Autofix selection; otherwise, it will be applied to all Windows machines.

  4. NOTE: WE SHOULD ONLY BE PERFORMING THESE STEPS IF ASKED BY THE CONSULTANT

    To enable the solution, please make sure to select any one Audit option from the drop-down EDFs "SMB1 Vulnerability" at the computer, location, or client level. The 'Additional Field Default' value can also be selected here to enable the solution globally.

    Select Audit Option

    • Audit with Autofix → If this is selected, then SMB1 will be automatically disabled if found enabled on any device.
      • Both the SMB1 client and SMB1 server will be disabled.
    • Audit Only → If this is selected, then the SMB1 status will be audited only and will not be automatically disabled if found to be enabled.

    Note: The computer-level EDF "SMB1 Vulnerability" has the highest priority; if it is set to disabled, then it will be excluded. The location-level EDF "SMB1 Vulnerability" has the second-highest priority; if it is set to disabled, then all the endpoints at the location level will be excluded.

Optional Solutions​

Traffic Detection Ticketing​

Optionally, if the client wants, we can enable ticketing to monitor the SMB1 traffic live detection cases separately for each machine by setting up the system properties:

Traffic Detection Ticketing

Note: This should only be implemented if the consultant approves it.