Elevate24 Security Logging

Events will be uploaded to the supplied url via HTTP POST. Note that events can be uploaded to the supplied URL or to sentinel not both.

Headers to be included in the HTTP request.

By default events are uploaded in JSON format as an array of events. Some systems require events to be seperated with a new line.

Default: false

Tennant ID

Client ID

Client Secret

URL to upload events to Microsoft Sentinel

Max size of single HTTP request uploading data. (Uncompressed size in bytes default size is 1,000,000 bytes)

Default: 1000000

Deploys default rules to discard some events which can be considered noise.

Default: false

Deploys authorisation rules to attempt to stop the user making changes to Elevate24 database.

Default: false

Stops all blocking/logging operations. Effectively a switch to disable this tool.

Default: false

Enable the security monitoring to be sent to the Jigsaw24 Portal.

Default: false

Upload Events when connected to iPhone personal hotspot.

Default: false

When enabled, hides the blocked events history from the Elevate24 UI.

Default: false

Rules to restrict file operations. Allow rules can be used in conjunction with block rules to allow a process to execute under the specified conditions. File open operations can be restricted to read only access where required.

Rules to restrict execution of processes. Allow rules can be used in conjunction with block rules to allow a process to execute under the specified conditions. Multiple arguments can be specified by seperating them with a comma.

Default: [{}]

Set all event types to be logged. Use with caution, as this could produce a lot of data entries.

Default: false

Define which event types to log.

Depends on: logAllEvents ∈ [true]

Default: [{}]

Define rules to not store events matching the following rules.

Default: [{}]

Headers to be included in the HTTP request.

Range: File Open (file:open), File Delete (file:unlink)

Default: "block"

Range: Allow (allow), Block (block), Read Only (File Open Only) (readOnly)

Default: "block"

Range: Allow (allow), Block (block)

Default: "All"

Range: File Write (File:Write), File Delete (File:Unlink), File Clone (File:Clone), File Copy (File:CopyFile), File Create (File:Create), File Rename (File:Rename), User Create (User:Create), User Delete (User:Delete), Profile Add (Profile:Add), Profile Remove (Profile:Remove), Launch Item Add (LaunchItem:Add), Launch Item Remove (LaunchItem:Remove), Sudo Command (Sudo), Execute Process (Process:Exec)

Range: All (All), File Write (File:Write), File Delete (File:Unlink), File Clone (File:Clone), File Copy (File:CopyFile), File Create (File:Create), File Rename (File:Rename), User Create (User:Create), User Delete (User:Delete), Profile Add (Profile:Add), Profile Remove (Profile:Remove), Launch Item Add (LaunchItem:Add), Launch Item Remove (LaunchItem:Remove), Sudo Command (Sudo), Execute Process (Process:Exec)