Hello, I'm trying to deploy/make use of the AEDA (advanced environmental drift analysis) module. How do i use it effectively in my environment?
Simple guide for AEDA?
+1AEDA is a tool that runs scheduled jobs in MSV on a regular basis and detects if the tests meet your requirements. Any change can be documented in a notification from the MSV platform. AEDA tests are best if they are relatively small. (No more than 20-25 actions, generally, per AEDA monitor.)
It is recommended to choose actions that you expect to not be blocked, as well as those that you expect to be blocked. For example, doing a network monitor, you could do one action that is an SSH protocol (which is expected to not be blocked) and another using FTP (that is expected to be blocked). Changes to either one of these results would show a huge change in the environment and warrant investigation.
Another nice explanation can be found here: https://www.googlecloudcommunity.com/gc/Security-Validation/Mandiant-Security-Validation-AEDA-as-your-pre-flight-checklist/m-p/766299#M102
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.