Introduction

Field Effect MDR is a cybersecurity solution that includes endpoint, cloud, and (for MDR Complete customers) network monitoring. When a cybersecurity situation is detected that requires action or follow-up, you will be notified via our core reporting mechanism - an ARO (Action, Recommendation, or Observation).

This article covers how Field Effect MDR's various components work and communicate with each other across the following topics:

• How Field Effect MDR's Monitoring Works
  • The Network Appliance
  • Endpoint Monitoring
  • Cloud Monitoring
• How Endpoints Communicate with the Appliance
  • Communication Security
  • Additional Connections
    • Identity Server (epid.fieldeffect.net)
    • Log Server (installlogs.fieldeffect.net)
• Digging Deeper into Field Effect MDR

How Field Effect MDR's Monitoring Works

The following sections outlines the various aspects of our MDR service and how they interoperate.

The MDR SIEM

The MDR SIEM (formerly called the primary appliance) acts as the service's main controller. Field Effect usually hosts this but in some cases you can choose to host it on your network (physically or virtually). 

Endpoint Monitoring

Our endpoint agent (see availability here) communicates with the primary appliance either directly (when on the same network) or through an encrypted relay connection. Depending on how the service is configured, the agent can intervene (isolate, block, etc.) when a threat is detected.

Installers can be downloaded from the primary appliance and the MDR Portal, and they support several installation types including GPO, RMM, etc. See our Installer Guides for more on this.

Cloud Monitoring

Field Effect MDR integrates with several cloud services, which are set up in the MDR Portal. Once a cloud service is enrolled, we will monitor and analyze the service's telemetry and user activity for reporting and ARO creation, when appropriate. See our Cloud Monitoring Overview and integration guides for more.

Network Monitoring

You will require network sensors for each site you want included in Field Effect's network monitoring. Your appliance type depends on your service tier and network requirements, but our sales and support teams will help ensure that your select the appropriate appliance(s) for your deployment.

How Endpoints Communicate with the Sensor

The endpoint agent communicates with the primary sensor using secure encrypted connections over TCP port 443.

The agent can connect to the appliance in the following ways:

• Direct Network Connection – When the endpoint is on the same network as the appliance, communication occurs directly.
• Internet-Based Connection – When the endpoint is outside the local network (for example, remote users working from home or travelling), the agent securely connects to the appliance over TCP port 443.

This approach allows endpoints to maintain communication with the appliance regardless of their location while using a commonly permitted outbound port.

Agent Configuration

Field Effect automatically configures each endpoint agent during installation with the information required to locate and securely connect to its assigned appliance. The agent continuously validates the identity of the appliance using certificates and will only establish communications with trusted Field Effect infrastructure.

Communication Security

Our configurations are signed by our root of trust, which is hard coded into the agent. All messages sent from an agent to the appliance are additionally encrypted with a client-specific key using X25519. Messages sent from the appliance to the agent are ED25519 signed with this key. Further, sensitive messages such as those related to our EDR rules are separately ED25519 signed with keys that are not present on the MDR SIEM, minimizing the impact of an MDR SIEM compromise.

The following diagram shows how the components of Field Effect MDR fit into your network and communicate with each other.

Additional Connections

There are some scenarios when the endpoint will connect to one of two global servers, the Identity Server and Log Server.

Identity Server (epid.fieldeffect.net)

Immediately after an endpoint agent is installed, it connects to the Identity Server to retrieve its configuration (for your organization). If the agent loses its connection for more than a week, it will reconnect to in an attempt to restore reconfigure the agent and restore the connection. 

Log Server (installlogs.fieldeffect.net)

This server collects data used for debugging. Following an installation, the agent provides a one-time report that includes basic host telemetry to help investigate failures. The Log Server can also request remote diagnostics via this connection.

When an agent has an unexpected issue or disruption, it is reported to the Log Server. If it detects that the agent not running, it can automatically force the agent to restart.

Digging Deeper into Field Effect MDR

For MDR Complete customers that want to dive deeper into the telemetry, alerts, and data that determine when we generate AROs, you can access the Field Effect Appliance Dashboard.