security-tooling-checks.conf

{
  "queries": {
    "endpoint_security_tool_backend_server_registry_misconfigured": {
      "query": "SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\\Software\\EndpointSecurityTool\\BackendServerLocation' AND data!='https://expected_endpoint.local';",
      "interval": 3600,
      "description": "Returns the content of the key if the backend server does not match the expected value",
      "platform": "windows"
    },
    "endpoint_security_tool_not_running": {
      "query": "SELECT IFNULL(process_count,0) as process_exists FROM (SELECT count(*) as process_count from processes where path='/Applications/EndpointSecurityTool' OR lower(path)='c:\\endpointsecuritytool.exe') where process_exists!=1;",
      "interval": 28800,
      "description": "Returns an event if a EndpointSecurityTool process is not found running from /Applications/EndpointSecurityTool' (OSX) or 'c:\\endpointsecuritytool.exe' (Windows)",
      "platform": "windows,darwin",
      "snapshot": true
    },
    "backup_tool_not_running": {
      "query": "SELECT IFNULL(process_count,0) as process_exists FROM (SELECT count(*) as process_count from processes where path='/Applications/BackupTool' OR lower(path) LIKE 'c:\\backuptool.exe') where process_exists!=1;",
      "interval": 28800,
      "description": "Returns an event if a BackupTool process is not found running from '/Applications/BackupTool' (OSX) or 'c:\backuptool.exe' (Windows)",
      "platform": "windows,darwin",
      "snapshot": true
    }
  }
}