Arctic Wolf Agent
Updated Feb 22, 2024Arctic Wolf Agent
Arctic Wolf® Agent is an endpoint security management tool that functions as a component of these solutions:
- Managed Detection and Response (MDR) — Agent forwards security-relevant event and audit logs from endpoint devices in your network to Arctic Wolf to support continuous threat monitoring.
- Managed Risk — Agent creates an inventory of endpoint devices in your network and performs routine scans to identify security risks.
Routine Arctic Wolf Agent scans
Agent performs these routine scans to identify security risks:
- Benchmark scans — Report when software or configuration best practices are not followed. Agent benchmark scan details include:
- Operation — Agent runs scans using Center for Internet Security (CIS) Benchmarks.
- Run time — A few minutes.
- Performance — While active, benchmark scans typically use about 30% of a 2.5 GHz single-core CPU, and 1 GB of memory.
Note: During highly intensive activities, you can see up to 100% of CPU utilization.
- Vulnerability scans — Report exploitable vulnerabilities. Agent vulnerability scan details include:
- Operation — Agent runs scans using Open Vulnerability and Assessment Language (OVAL) vulnerability definitions.
- Run time — Approximately 10 minutes.
- Performance — While active, vulnerability scans typically use about 30% of a 2.5 GHz single-core CPU, and 1 GB of memory.
Note: During highly intensive activities, you can see up to 100% of CPU utilization.
Arctic Wolf Agent Event logs
You can use Agent with or without Sysmon installed on the device. Without Sysmon, Agent captures a limited number of security-relevant Windows events. For example, Active Directory (AD) lockouts for administrator accounts, AD sign-in failures for high-criticality users, and Kerberos replay attacks. With Sysmon, Agent can detect more events. For example, process creation, loading drivers, and possible malicious PowerShell.
Agent does not forward all event logs to Arctic Wolf for storage. To meet industry compliance requirements, Agent is not a replacement for off-site log storage.