Quick Start | Validating Your Field Effect Setup

Introduction

Your managed Field Effect security solution consists of robust threat monitoring, detection, and response technology that’s compatible across any combination of cloud assets, endpoints, on-premises networks, and operating systems.

The following tools are available to validate that your Field Effect deployment has proper connectivity and is functioning as intended.

Windows Agent Validation

Prerequisites:

Your Active Response policy must not be set to “Off” for blocking/terminating to function properly.
A Windows system with the Field Effect agent installed.

Validation	Command line instruction	Expected Result
Desktop notifications + AROs(1)	cmd.exe /C echo “CovEICARNotify”	The “CovEICARNotify” string will be echoed to the command line. A “Service Validation Test – Endpoint Event” ARO will be generated in the portal.
Block Windows processes + AROs(1)	cmd.exe /C echo “CovEICARBlock”	The command will be blocked, and the string will not be echoed to the command line. A “Service Validation Test – Endpoint Event” ARO will be generated in the portal.
Block & terminate Windows processes + AROs(1)	cmd.exe /C echo “CovEICARTerminate”	The command will be blocked, the source process will be terminated, and the string will not be echoed to the command line. A “Service Validation Test – Endpoint Event” ARO will be generated in the portal.

Validation

Command line instruction

Expected Result

Desktop notifications + AROs(1)

cmd.exe /C echo “CovEICARNotify”

The “CovEICARNotify” string will be echoed to the command line.

A “Service Validation Test – Endpoint Event” ARO will be generated in the portal.

Block Windows processes + AROs(1)

cmd.exe /C echo “CovEICARBlock”

The command will be blocked, and the string will not be echoed to the command line.

A “Service Validation Test – Endpoint Event” ARO will be generated in the portal.

Block & terminate Windows processes + AROs(1)

cmd.exe /C echo “CovEICARTerminate”

The command will be blocked, the source process will be terminated, and the string will not be echoed to the command line.

A “Service Validation Test – Endpoint Event” ARO will be generated in the portal.

These validation rules are designed to only allow one ARO for each endpoint to be active at a time. While the endpoint will behave as expected (blocking, terminating), running an additional test command won’t generate a new ARO if an existing Service Validation Test ARO is open, or has been previously dismissed, for that endpoint.

Network Validation

This test will validate that your Field Effect appliance has proper connectivity and Field Effect is providing network coverage:

Prerequisite:

This test must be performed from an endpoint device connected to the network being tested.

Validation	URL	Expected Result
Network coverage + ARO	Navigate to https://verify.fieldeffect.net/ and select Network Coverage test.	A “Service Validation Test – Network Event” ARO will be generated in the portal

DNS Firewall Validation

Validation	URL	Expected Result
DNS Firewall configuration	Navigate to http://phishing.d-zone.ca/	Your browser will display a Field Effect message that the page was blocked due to Malware/Phishing.

Additional References: