--- name: Security Joes AI Analyst description: SecOps checks for endpoints: EDR, Sysmon, updates, EVTX on heartbeat, least privilege, network visibility, credential protection (Kerberos/NTLM/pass-the-hash), device inventory and known vulnerabilities, weekly assessment, and skill integrity (hash-on-wake, version-aware). Use when implementing or reviewing host posture, heartbeat logic, EDR/Sysmon/EVTX, privilege, network exposure, credential hardening, vuln assessment, weekly SecOps review, or skill compromise checks. version: 1.0.0 author: Security Joes authorUrl: https://www.securityjoes.com homepage: https://www.securityjoes.com license: MIT metadata: openclaw: emoji: "🔒" category: "security" tags: - security - secops - clawhub - edr - sysmon - evtx ---

Security Joes AI Analyst

You guide and implement SecOps checks for endpoints. Focus: EDR, Sysmon, updates, EVTX on heartbeat, least privilege, network visibility, credential protection (Kerberos/NTLM/pass-the-hash), device inventory and known vulnerabilities, and weekly assessment. Targets Windows; use PowerShell/WMI/registry and EVTX where appropriate.

Responsibilities

1. EDR sensor – Detect at least one EDR (Defender, CrowdStrike, etc.). Report presence/absence and basic health.
2. Sysmon – Confirm Sysmon is installed and logging; identify log location (typically EVTX).
3. System up-to-date – Check OS/build and patch level; report stale if beyond policy (e.g. 30+ days).
4. Heartbeat + EVTX – On heartbeat, query Security/Sysmon/Defender EVTX for recent alerts; attach summary or raise alert.
5. Least privilege – Check if the device/user runs with least privilege (not admin, UAC/token elevation as expected).
6. Network visibility – What other networks/interfaces the device sees (interfaces, ARP, WiFi, domain trust, net view/session).
7. Credential protection (network level) – Kerberos/NTLM hardening and pass-the-hash resistance (SMB signing, LDAP signing, NTLM restrictions, Credential Guard).
8. Device details and known vulnerabilities – Inventory OS, patches, installed software; correlate with known CVEs or vuln data for assessment.
9. Weekly assessment – Run a full SecOps checklist weekly; produce assessment report and optionally emit as event.
10. Skill integrity – On first wake, hash this skill and other known skills; store hashes. On each wake, re-hash and compare; use version changes to treat upgrades vs compromise and alert on unexpected changes.

When to apply

• User asks for host posture, endpoint health, “is this machine secure?”, or weekly SecOps review.
• Implementing or extending collector/heartbeat logic.
• User mentions EDR, Sysmon, EVTX, least privilege, network exposure, Kerberos, pass-the-hash, credential protection, vulnerabilities, weekly assessment, or skill integrity / compromise check.
• Reviewing or designing what “healthy endpoint” means for the dashboard.

---

1. EDR sensor checks

Microsoft Defender

• Service: WinDefend (Get-Service WinDefend).
• Optional: Get-MpComputerStatus (or MpCmdRun.exe -GetStatus) for signature version and real-time protection state.
• Registry (if needed): HKLM\SOFTWARE\Microsoft\Windows Defender and related product state keys.

CrowdStrike Falcon

• Service: CsAgent (Get-Service CsAgent -ErrorAction SilentlyContinue).
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\CsAgent or Falcon-specific keys under HKLM\SOFTWARE\CrowdStrike.

Others (SentinelOne, Carbon Black, etc.)

• Prefer service name + optional registry/process check. Document which EDR is “primary” for the environment.

Output

• At least: edr_present: true|false, edr_name: "Defender"|"CrowdStrike"|..., optional edr_healthy: true|false (e.g. service running, real-time on).

---

2. Sysmon

• Service: Sysmon64 or Sysmon (Get-Service Sysmon64, Sysmon -ErrorAction SilentlyContinue).
• Log: Usually EVTX – Microsoft-Windows-Sysmon%4Operational under C:\Windows\System32\winevt\Logs\ (path: ...\Microsoft-Windows-Sysmon%4Operational.evtx).
• Config: Optional – check for Sysmon config (e.g. Sysmon64 -s or known config path) to confirm logging scope.

Output

• sysmon_installed: true|false, sysmon_log_path: "..." (if available), optional sysmon_service_running: true|false.

---

3. System up-to-date

• Quick: Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 for last patch date; or (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuild (and optionally UB R) for build.
• Stricter: Windows Update status – e.g. WMI Win32_QuickFixEngineering or COM Microsoft.Update.Session to see last install time / pending reboots.
• Policy: Define “stale” (e.g. no patch in 30+ days or build behind current branch) and report up_to_date: true|false and optional last_patch_date or build.

---

4. Heartbeat and EVTX alerts

On heartbeat (or on a scheduled check that aligns with heartbeats):

1. Which EVTX

- Security: C:\Windows\System32\winevt\Logs\Security.evtx - Sysmon: Microsoft-Windows-Sysmon%4Operational.evtx - Microsoft-Windows-Windows Defender/Operational (Defender alerts) - Optional: Application, System for context.

1. What to look for

- Security: logon failures (e.g. 4625), sensitive privilege use (4672, 4688), account lockout, etc. - Sysmon: creation of executables in temp, suspicious parent/child, etc. (event IDs depend on config). - Defender: detection events (e.g. 1116, 1117), threats (1006, 1015). - Prefer time-bounded queries (e.g. last N minutes since previous heartbeat or last 24h) to avoid overload.

1. Implementation options

- PowerShell: Get-WinEvent -FilterHashtable @{ LogName='Security'; StartTime=$since } (and similar for Sysmon/Defender). - Or use a small script/tool that reads EVTX and outputs a compact JSON (event IDs, time, count) for the collector to emit as details or as an alert.

1. Emit

- Attach to heartbeat details (e.g. evtx_alert_count, evtx_summary[]) or raise an alert event when thresholds are exceeded (e.g. > N failures, or any Defender detection).

---

5. Least privilege

Check whether the device/user runs with least privilege (not over-privileged).

• Current user elevation: whoami /groups to see group membership; token elevation type via (Get-Process -Id $PID).StartInfo.Verb or WMI/CIM. For elevation: check if process token has elevation (e.g. [System.Security.Principal.WindowsIdentity]::GetCurrent().Groups and look for S-1-16-12288 = High Mandatory Level).
• Admin membership: net localgroup Administrators (or Get-LocalGroupMember -Group Administrators) – report if the current user or common service accounts are in Administrators.
• UAC: Registry HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = 1 (UAC on). Optional: ConsentPromptBehaviorAdmin, PromptOnSecureDesktop.
• Privileged sessions: Optional – check for RDP/admin logons (Security EVTX 4624, logon type 10) and whether interactive admin is expected.

Output

• least_privilege: true|false, current_user_elevated: true|false, in_local_admins: true|false, optional uac_enabled: true|false.

---

6. Network visibility (what networks the device sees)

Assess what networks and neighbors the device can see (exposure and lateral movement surface).

• Interfaces: Get-NetAdapter, Get-NetIPAddress – list adapters, IPs, gateways. Optional: Get-NetRoute.
• ARP table: Get-NetNeighbor or arp -a – what other hosts the device has recently talked to (L2/L3 neighbors).

...