Continuous Monitoring
Category | Requirement | CSCC | SAMA CSF | ECC-1 |
|---|---|---|---|---|
Continuous Monitoring | Continuous inventory of IT assets and continuous monitoring of security posture and controls | 2-11 | 3.3.14 | 2-3-4 |
You can trigger Lucidum to update data as frequently as needed. This includes ingesting new data and updating existing dashboards and queries.
You can also create automated actions that aid continuous monitoring. These actions can run as frequently as needed.
These automated actions include sending data to slack, sending data via email, creating Jira tickets, creating ServiceNow CIs, and performing automatic mitigation tasks.
Actions for AWS
Stop Instance. Stops one or more AWS instances.
Start Instance. Starts one or more previously stopped AWS instances.
Tag Instance. Adds a tag (descriptive key: value pair) to one or more AWS instances.
Untag Instance. Removes a tag (descriptive key: value pair) from one or more AWS instances.
Actions for Active Directory
Change Computer Group. Changes the AD group membership for one or more assets.
Disable Computer. Disables one or more computer objects in AD. When a computer object is disabled in AD, domain accounts cannot log in to the computer.
Enable Computer. Enables one or more computer objects in AD. When a computer object is enabled in AD, domain accounts can log in to the computer.
Change Computer OU. Changes the AD OU (organizational unit) for one or more computers.
Change User Group. Changes the AD group membership for one or more users.
Disable User. Disables one or more user objects in AD. When a user object is disabled in AD, the user cannot log in to the domain.
Enable User. Enables one or more user objects in AD. When a user object is enabled in AD, the user can log in to the domain.
Change User OU. Changes the AD OU (organizational unit) for one or more users.
Actions for Automox
Patch Device. Applies all available software patches to one or more devices.
Reboot Device. Reboots one or more devices.
Actions for Email
Send Email. Sends data about one or more assets or users to one or more recipients.
Actions for Jira Cloud Platform
Create Jira Issue. Creates a Jira issue. For each record that matches the base query, the output fields are attached to the Jira ticket.
Actions for Microsoft Defender
Isolate Machine. Disconnects one or more devices from the network while retaining connectivity to the Defender for Endpoint service, which continues to monitor the device.
Unisolate Machine. Reconnects one or more devices to the network.
Devices that are behind a full VPN tunnel won't be able to reach the Microsoft Defender for Endpoint cloud service after the device is isolated. Microsoft recommends using a split-tunneling VPN for Microsoft Defender for Endpoint traffic.
Actions for Opsgenie
Create Alert. Send an alert from Lucidum to Opsgenie. Opsgenie will deliver the alert according to its policies.
Actions for ServiceNow
Create ServiceNow Assets (IRE API). Creates one or more new configuration items (CIs) in ServiceNow.
Create/Update ServiceNow Assets (IRE API). Creates one or more new configuration items (CIs) in ServiceNow. If the one or more of the CIs already exist, this action updates the existing CIs.
Actions for Slack
Post on Slack. Sends data (outputfields) from the specified records (from the base query) to a slack channel.