How do we notice when a server's endpoint protection goes silent?

Make silence itself an alert in your endpoint console, and keep an independent view from the network. Most EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine. and antivirus consoles can report agents that have not checked in for a set time; switch that on, send it to a mailbox someone reads, and decide in advance what you do when a server goes quiet: call the owner, check whether it was a planned reinstall, and look at what the machine did on the network. Review once a month the list of machines that should have an agent against the ones that do. Restrict the right to uninstall or pause the agent to a few named accounts with multi-factor authentication. The network view is the second witness: NetSenX does not read your EDR's status, but it keeps flagging the server if it starts beaconing, scanning, moving laterally or sending unusual volumes out, so a silent agent does not mean a silent attack.

← All 40 questions on NDR, EDR, SIEM, XDR, MDRAll topics