Skip to main content

Home
Help Center
Field Effect Portal
System Status
Compliance

Login
English
English French

Home
Help Center
Using the MDR Portal
Insights / Active Response

Recent Searches

No recent searches

Popular Articles

Articles

Topics

Tickets

Sorry! nothing found for

Insights / Active Response

Cet article n'est pas disponible en French. Affichez-la en English

Explore the Help Center

Click a section below to navigate there, or expand it to reveal more.

How Field Effect MDR Works

What are the Different Portals Used for?

Tour the MDR Portal

Tour the MDR SIEM Dashboard

Tour the Vision Portal

Getting Started as a Field Effect Partner

Resources available to Partners

First steps with the MDR Portal

Setting up your first Client

Deploying your first Network Sensor

License Management Portal (LMP): Overview

Manage LMP Users & Access

Manage Your Partner Profile

Onboard a New Volume License Customer

Choosing a Deployment Solution: Example Scenarios

Manage Volume Licenses

Update a Customer's Details in the LMP

Purchasing Additional Licenses

Offboarding a Customer Account

Purchasing Daily Dark Web Monitoring from the LMP

Viewing Beauceron Volume Agreements from the LMP

Using the Contact Us Form

Changing Client License Types in the LMP

Co-Branding & Themes for Partners

Report Settings: Client Visibility

MDR Portal: Partner-Centric Feature Overview

Deployment Overview for New Partners

Partner Playbook: Deploying Field Effect MDR

The Organization Selector for Partners

The Clients View for Partners

Risk & Vulnerabilities Page for Partners: Overview

Offboarding Clients (for Partners)

Default Settings for Partners

Setting a Default DNS Policy for New Clients

Client Configuration Page for Partners

Network Sensor Asset Management and Configuration

Returning Sensors: Overview

What are Your First Steps as an Administrator?

Protecting Your First Endpoint

Deploying Your First Network Sensor

Create your MDR Portal Account

Accessing the MDR Portal for the First Time

Using the Onboarding Wizard

Additional Features

Deployment Overview for New Clients

Client Playbook: Deploying MDR Complete

Client Playbook: Deploying MDR Core

Client Playbook: Deploying mEDR

Client Playbook: Deploying MDR Cloud

Deployment Checklist: MDR Complete

Deployment Checklist: MDR Core

Deployment Checklist mEDR

Deployment Checklist: MDR Cloud

Endpoint Agents: Overview

Endpoint Agent Preferences

Endpoint Agent: Operating System Requirements

Endpoint Agent System Notifications

Agent Install Guide - Windows

Agent Uninstall Guide - Windows

Agent Uninstall Guide - Windows 11, Command Line

Agent Install Guide - macOS

Agent Uninstall Guide - macOS

Agent Install Guide - Linux

Uninstalling the Endpoint Agent - Linux

Best Practices: Automated Agent Deployments

Sensor-Hosted Endpoint Agent Installers: Overview

Uninstalling the Endpoint Agent in Bulk

Windows Install PowerShell Script for RMM/MDM

Deploying the macOS Agent via Intune

Deploying the Windows Agent via Intune

Deploying the macOS Agent via JAMF, Addigy, and JumpStart

Installing the Windows MDR Agent Using NinjaOne RMM

Installing the Windows MDR Agent Using Datto

Installing the Windows MDR Agent Using Atera

Installing the Windows Agent Using Action1 RMM

Appliance Deployment Guide

Physical Network Appliances: Overview and Specs

Virtual Appliances: Overview

Installing a Virtual Appliance in AWS

Installing a Virtual Appliance in Azure

Installing a Virtual Appliance on a VMware ESX Cluster

Configuring a Virtual Appliance in a Hyper-V Environment

Configuring Traffic Monitoring in Azure

Installing the Appliance in a Port Mirrored Configuration

Installing the Appliance in an Inline Configuration

Configuration Guide: Compact Sensor

Configuration Guide: Shuttle Sensor Series

Configuration Guide: Oskar

Configuration Guide: Business One (version 2)

Configuration Guide: Business One (version 1)

Configuration Guide: Enterprise One

Configuration Guide: Enterprise One Hundred

What are Your First Steps?

Accessing the MDR Portal for the first time

Accessing the MDR SIEM Dashboard

The Sidebar for Clients

The Sidebar for Partners

Service Overview - The MDR Portal Homepage

Access Your Account Settings

Add a Mobile Number to Your Profile

Change the MDR Portal's Default Language

View & Manage Notifications

Multi-Factor Authentication (MFA): Overview

Add an Avatar to Your MDR Portal Account

Change Your MDR Account Password

Account Locking in the MDR Portal

Single Sign-On: Link an Account

The Status Page

Getting to Know AROs

The Anatomy of an ARO

Working with AROs

ARO Comments & the Activity Feed

Watching & Assigning AROs

Downloading AROs (PDF)

Supplemental Insights & Raw Data

Compliance Mapping for AROs

Risk Score View: Overview

Devices Page: Overview

Devices Page: Bulk Editing

Devices Page: Sorting, Searching, and Filtering

The Accounts Page: Overview

Making Travel Exceptions from the MDR Portal

Overview: Insights Section

Active Response View (MDR Portal & Mobile)

Insights: Clouds Monitoring

Cloud Monitoring: Overview & Setup

Authorizing Microsoft 365 Cloud Monitoring

Google Workspace

Insights: AI Monitoring

Active Response: Overview

Response Policies: Overview

Response Actions: Overview

Configure Active Response

Enable Active Response for Cloud Services

Active Response: End-User Notifications

Active Response: Example Scenarios And Common Response Events

Introduction to SEAS

Using SEAS: The End User Workflow

Viewing SEAS Reports in the MDR Portal

Installing the SEAS Outlook Add-in

Using the SEAS Outlook Add-On

Using the SEAS Gmail Add-On

Installing the SEAS Gmail Add-On

Using Google Routing Rules with SEAS

Insights: DNS Firewall

DNS Firewall: Overview & Setup

Adjust DNS Firewall Content Blocking Categories

Using the Custom Allowlist or Blocklist

Partners: Setting Up a Default DNS Policy

Mapping Safe Networks

Control AI Tool Access Using the DNS Firewall

The Reports View

Monthly Service Report

Monthly Summary

Risk Score Report

Vulnerability Report

Dark Web Monitoring Report

The Supplemental Data Page - Overview

The Downloads Page

For Partners: Generating a Cloud Registration Link

The Organization Profile: Overview

The Service Profile Page: Overview

The Monitoring Profile: Overview

Escalation Contacts: Overview

The User Management Page: Overview

Invite Users to the MDR Portal

How to Edit User Permissions

Remove Users from the MDR Portal

Single Sign-On (SSO): Overview

The Data Management Page

Syslogs & Field Effect MDR

Field Effect's Optional Analytics Configurations

The Integrations Page: Overview

Palo Alto Cortex

Beauceron Security

Antivirus Management: Overview

Enabling Antivirus Management

Uploading Files to the MDR Portal

Logging into the MDR SIEM Dashboard

The Alerts Page

The Agents Page

The Software Page

The Sensors Page

The DNS Activity Page

The DNS Reports Page

The Local Systems Page

The Network Activity Page

The TLS Activity Page

The Sensor Status Page: Overview

Using the Appliance Management Console (v2)

Using the MDR SIEM Management Console (v1)

Quick Start | Validating Your Field Effect Setup

Field Effect Endpoint Service Validation

Firewall Exceptions for Network Sensors and Endpoint Agents

Installing the Field Effect Mobile App

Signing into the Mobile App

The Organization Selector for Partners

The Profile Tab

Watching AROs from the Mobile App

Field Effect APIs: Overview

Create an API Key

Obtaining your Organization ID

What events are collected by Field Effect?

Audit Policy Requirements for Field Effect MDR

Can Field Effect ingest application logs?

Does Field Effect protect against log tampering by the originator?

Can Field Effect store (retain) logs for a required period?

Do Field Effect logs go through an analytic process?

Can Field Effect collect logs from all sources?

What is a One-day, n-day, and zero-day vulnerability?

Do you recommend disabling SMTP, IMAP and POP protocols in Office 365 for regular users?

How does Field Effect leverage AI/ML?

What are Field Effects thoughts on the use of AI?

What is the Field Effect Business Continuity Plan (BCP)?

What does Field Effect MDR do at a high level?

Does Field Effect use Sysmon and if so, how is it configured?

What technology underpins your NIDS?

Does Field Effect isolate my entire network?

How does Field Effect protect my data and information?

What is the status.json file?

How do I remove duplicate endpoints?

Would Field Effect qualify as a Data Loss Prevention (DLP) Solution?

Can I send email notifications to any email address?

Why was an ARO notification late?

What is an "Impossible Travel" scenario?

ARO: Suspected Typosquat Domain Detected

What's the difference between Resolving and Dismissing an ARO?

ARO: Removable Drive Detected

ARO: Secure Shell (SSH) Brute Force Attempt Detected

ARO: Tools for Remote Administration Detected on your Network

ARO: Audit Log was Cleared

ARO: New Administrative Account Detected

ARO: Insecure Encryption Supported by Server

ARO: Hosts Observed Without Field Effect Agent Installed

ARO: User Authentication Detected

Which remote control software do you monitor for?

Can I manage the travel itinerary for a user?

ARO: New Server detected

I dismissed an ARO but I just received it again!

Azure alerted me to a "User at risk detected", but Field Effect didn't send me an ARO?

ARO: Legacy Authentication Protocol Detected

Should I have MFA setup on a no-reply mailbox?

ARO: Malware Detected on SharePoint

Why didn't I get an ARO for a very high CVE

How do I disable DES and RC4 on my Domain Controller

ARO: Microsoft Windows Support Diagnostic Tool Remote Code Execution Vulnerability

ARO: VPN Authentication Detected

ARO: Email Domain Protection Recommendations

ARO: Vulnerable Software Detected - Overview

ARO: RDP Protocol Observed

Will users be able to login if a computer is isolated?

Can Field Effect MDR send an automated email to our ticketing systems when a computer is isolated?

How do I recover an isolated system? Can I do it myself?

How long would Field Effect take to notice an end point was infected with RansomWare?

What if my organization has another EDR service or solution with blocking capabilities?

How can I manage Active Response for a single endpoint?

Why is Active Response showing as "Off" after I set a policy?

My DUO 2FA code isn't working

How does cloud monitoring work?

What is detected with the Cloud Monitoring service?

Where are the cloud sensors deployed?

Is there an account limit on Office 365 domains?

Can I monitor two instances of the same cloud service?

Does the DNS firewall work with Chromebooks?

Do I need to worry about attacks on our Firewall?

Troubleshooting DNS Firewall

Looking Up Domains for the DNS Firewall

Error: The organization name already exists in the DNS Firewall Service

Partners: What are the Impacts of Removing a User from the Default DNS Policy?

Troubleshooting the Endpoint Agent

What Endpoint agents are currently available?

Troubleshooting manual endpoint installation issues for Windows

Troubleshooting manual endpoint installation issues for QNAP

Why am I getting the error "Missing License File"

Can I use a different license.key after I have installed an agent?

How can I stop users uninstalling the Field Effect endpoint agent?

Access the Windows Command Prompt as an administrator

Why can't I see a new Endpoint in the MDR Portal?

How do I remove a device from the Endpoint Devices page?

Am I running Windows 32-bit or 64-bit?

Using Field Effect MDR alongside other Security Solutions & AVs

What is the refresh time for an endpoint agent?

Windows Events Logged by the Endpoint Agent

Can I move endpoints between my clients?

Does Field Effect MDR perform Windows Event Log archiving or collection?

Where are the logs stored?

What’s the price to store logs for longer than 90 days?

How will I be charged?

Which data types can be retained?

Can I store system logs generated by external systems, like a VPN solution?

Can I access the logs that are stored?

Is there a best practice recommendation around log sources that should be part of log retention?

How does Log Retention affect compliance requirements?

Why cant I log into the physical sensor?

Troubleshooting Physical Sensors

Can I have confidence that my data is safe on an appliance?

We need to move the MDR SIEM Sensor, what do I need to consider?

How does Network Monitoring Work?

Where should the sensor be located within my network architecture?

What is the difference between an inline and port mirrored install configuration?

Should the sensor be in front of or behind my firewall?

What happens if the sensor loses power? Won’t my network stop?

My router or firewall has multiple physical networks on the LAN side. Can I still use the sensor?

Can the MDR SIEM monitor internal traffic that does not go to the Internet?

Does the network sensor accept inbound connections?

What does the security key do?

How does the appliance deal with VLANs or Network segmentation?

How does the Network Capture (PCAP) process work?

How is network sizing determined for a client's environment?

What are the log retention capabilities of Field Effect MDR?

How can I check my physical appliance is operating correctly?

Finding Your Sensor's Service Tags and MAC Addresses

What happens to my data when I migrate between sensors?

Why would the Field Effect sensor need to access Tor?

How can I troubleshoot appliance connectivity issues?

What happens if the primary appliance is offline?

Best Practices: Traffic for Appliances Using the Passive Configuration

PSAs - How can I quickly Navigate to the MDR Portal from my Integration?

Autotask - The integration card is missing on the Integrations page?

Autotask - What happens if I delete an ARO task in Autotask?

Autotask - Why was I was notified that my thread threshold is exceeded?

ConnectWise - My companies aren’t available for mapping in the MDR Portal?

ConnectWise - What if I need to change the name of an organization?

ConnectWise - How can I remove unmapped statuses as choices for ARO Statuses?

ConnectWise - Why is my URL not seen as being a valid domain?

ConnectWise - Can I Move AROs to another Service Board?

ConnectWise - As a Partner, how do I deal with offboarding clients?

ConnectWise - How do I disable this Integration for a single company?

ConnectWise - What if ConnectWise become unreachable?

ConnectWise - Why won’t my status changes to AROs in the Portal sync to ConnectWise?

ConnectWise - How do I change my ConnectWise board for AROs?

ConnectWise - Why aren't my AROs syncing between the MDR Portal and ConnectWise

Why are "Private Networks" displayed in the Country table?

Why is my Configuration Risk Score 0, but there are risks listed in the table

Why is My Risk Score larger than the sum of scores?

Why am I seeing TOR Project exit nodes in my report?

Can I breakdown the Security Events summary in the Weekly Report?

Why am I seeing logins from unexpected countries on my Monthly Report?

Can I find out more about the Most Resolved Domains listed in the Monthly Report?

Can I find out more about the My Network Summary graph?

What are the "Beacons" mentioned in a report?

As a partner, why am I not receiving reports for one of my clients?

Is there an alternative to using the SEAS plugins

Why did my SEAS submission come back as Inconclusive?

Do I need to use DMARC?

Resolving the "This add-in had previously been uploaded" error

Recovering an Email Removed by SEAS

Why is the SEAS Integration not Appearing on The Outlook Mobile App?

Why is the SEAS Add-in Not Visible in the Outlook Mobile App?

Error: Google Hasn't Verified this App

Supplemental Data Table: Email Protection DNS Record Configuration Issues

Supplemental Data Table: Out-of-Date and End of Life Operating Systems

Supplemental Data Table: Vulnerable Software

Supplemental Data Table: AI Tools Summary

An employee is leaving, how should I manage their Field Effect access?

What's the difference between Partner and Client users?

Can I change an email address associated with a login?

How do I reset MFA

Insights / Active Response

Active Response: Overview
Response Policies: Overview
Response Actions: Overview
Configure Active Response
Enable Active Response for Cloud Services
Active Response: End-User Notifications
Active Response: Example Scenarios And Common Response Events

FIELDEFFECT.COM • TERMS OF SERVICE • PRIVACY POLICY

Copyright © Field Effect Software Inc. All Rights Reserved.