Skip to main content

Home
Help Center
Field Effect Portal
System Status
Compliance

Login
English
English French

Home
Help Center
For Users
Using the MDR SIEM Dashboard

Recent Searches

No recent searches

Popular Articles

Articles

Topics

Tickets

Sorry! nothing found for

Using the MDR SIEM Dashboard

Explore the Help Center

Click a section below to navigate there, or expand it to reveal more.

How Field Effect MDR Works

A comparative summary of the Field Effect service tiers

What are the Different Portals Used for?

Tour the MDR Portal: Video Overview

Tour the MDR SIEM Dashboard

Tour the Vision Portal

Getting Started as a Field Effect Partner

Resources available to Partners

First steps with the MDR Portal

Setting up your first Client

Deploying your first Network Sensor

License Management Portal (LMP): Overview

Manage Users & Access in the License Management Portal

Manage Your Partner Profile

Onboard a New LMP Customer

Manage Volume Licenses

Update a Customer's Details in the LMP

Purchasing Additional Licenses

Offboarding a Customer Account

Purchasing Daily Dark Web Monitoring from the LMP

Viewing Beauceron Volume Agreements from the LMP

Using the Contact Us Form

Changing Client License Types in the LMP

Quick Guide: Purchase a Compact One via the TD SYNNEX Portal

Co-Branding & Themes for Partners

Report Settings: Client Visibility

MDR Portal: Partner-Centric Feature Overview

Deployment Overview for New Partners

Partner Playbook: Deploying Field Effect MDR

Using Field Effect MDR with an ITSM or PSA System

The Organization Selector for Partners

The Clients View for Partners

Risk & Vulnerabilities Page for Partners: Overview

Offboarding Clients (for Partners)

Default Settings for Partners

Setting a Default DNS Policy for New Clients

Client Configuration Page for Partners

Network Sensor Management for Partners

Returning Sensors: Overview

What are Your First Steps as an Administrator?

Protecting Your First Endpoint

Deploying Your First Network Sensor

Create Your Field Effect MDR Account

Accessing the MDR Portal for the First Time

Using the Onboarding Wizard

Additional Features

Deployment Overview for New Clients

Client Playbook: Deploying MDR Complete

Client Playbook: Deploying MDR Core

Client Playbook: Deploying MDR Endpoint

Client Playbook: Deploying MDR Cloud

Deployment Checklist: MDR Complete

Deployment Checklist: MDR Core

Deployment Checklist: MDR Endpoint

Deployment Checklist: MDR Cloud

Endpoint Agents: Overview

Endpoint Agent Operating System Requirements

Windows Agent Installation

macOS Agent Installation

Linux Agent Installation

Installing the Agent with RMM Tools

Action1 Agent Installation

Atera Agent Installation

Datto Agent Installation

NinjaOne Agent Installation

Intune Agent Installation: Windows

SuperOps Agent Installation

Other Tools: PowerShell Script for Agent Installation

Intune Agent Installation: macOS

JAMF, Addigy, and JumpStart Agent Installation

Windows Agent Uninstall

Windows 11 Agent Uninstall via Command Line

macOS Agent Uninstall

Linux Agent Uninstall

Uninstalling the Endpoint Agent in Bulk

Configuring AI Detection & Response (AIDR)

Network Sensor Management for Clients

Sensor-Hosted Endpoint Agent Installers: Overview

Sensor Deployment Guide

Physical Network Sensors: Overview and Specs

Virtual Network Sensors: Overview

Installing a Virtual Appliance in AWS

Installing a Virtual Appliance in Azure

Installing a Virtual Appliance on a VMware ESX Cluster

Configuring a Virtual Appliance in a Hyper-V Environment

Configuring Traffic Monitoring in Azure

Installing the Sensor in a Port Mirrored Configuration

Installing the Sensor in an Inline Configuration

Configuration Guide: Compact Sensor

Configuration Guide: Shuttle Sensor Series

Configuration Guide: Oskar

Configuration Guide: Business One (version 2)

Configuration Guide: Business One (version 1)

Configuration Guide: Enterprise One

Configuration Guide: Enterprise One Hundred

What are Your First Steps?

Accessing the MDR Portal for the first time

Getting to Know AROs

Working with AROs

Responding to AROs

Using Field Effect Cyber Risk Tools

Using Field Effect Insights

Field Effect Portal - Landing Page Overview

The Sidebar for Clients

The Sidebar for Partners

Service Overview - The MDR Portal Homepage

The Status Page

The Anatomy of an ARO

ARO Comments & the Activity Feed

Watching & Assigning AROs

Downloading AROs (PDF)

Supplemental Insights & Raw Data

Compliance Mapping for AROs

Enabling Optional AROs from Analytics

ARO Suppressions Page: Overview

Investigations Page: Overview

Risk Score View: Overview

Devices Page: Overview

Devices Page: Bulk Editing

Devices Page: Sorting, Searching, and Filtering

The Accounts Page: Overview

Making Travel Exceptions from the MDR Portal

Cloud Tenant View

Overview: Insights Section

Cloud Monitoring: Overview & Setup

Insights: DNS Firewall

Active Response View (MDR Portal & Mobile)

Active Response: Overview

Response Policies: Overview

Response Actions: Overview

Configure Active Response

Enable Active Response for Cloud Services

Active Response: End-User Notifications

Active Response: Example Scenarios And Common Response Events

Introduction to SEAS

Using SEAS: The End User Workflow

View SEAS Submissionsin the MDR Portal

Understanding the SEAS Page

Installing the SEAS Outlook Add-in

Using the SEAS Outlook Add-On

Using the SEAS Gmail Add-On

Installing the SEAS Gmail Add-On

Using Google Routing Rules with SEAS

The Reports View

Monthly Service Report

Monthly Summary

Risk Score Report

Vulnerability Report

Dark Web Monitoring Report

Account Investigation Reports

The Supplemental Data Page - Overview

Supplemental Data Table: Email Protection DNS Record Configuration Issues

Supplemental Data Table: Vulnerable Software

Supplemental Data Table: AI Tools Summary

Supplemental Data Table: Out-of-Date and End of Life Operating Systems

The Downloads Page

For Partners: Generating a Cloud Registration Link

The Organization Profile: Overview

The Service Profile Page: Overview

The Monitoring Profile: Overview

Appliance Assets Page

Escalation Contacts: Overview

The User Management Page: Overview

Invite Users to the MDR Portal

How to Edit User Permissions

Remove Users from the MDR Portal

Single Sign-On (SSO): Overview

The Data Management Page

Field Effect MDR Syslog Monitoring

The Integrations Page: Overview

AWS - Identity Containment (Optional)

Google Workspace

Authorizing Microsoft 365 Cloud Monitoring

Beauceron Security

Palo Alto Cortex

DNS Firewall: Overview & Setup

Adjust DNS Firewall Content Blocking Categories

Using the Custom Allowlist or Blocklist

Partners: Setting Up a Default DNS Policy

Mapping Safe Networks

Control AI Tool Access Using the DNS Firewall

Endpoint Agent Preferences

Antivirus Management: Overview

Enabling Antivirus Management

Add File & Process Exclusions to Antivirus Management

Log Retention: View Your Current Configuration

Uploading Files to the MDR Portal

Access Your Account Settings

Add a Mobile Number to Your Profile

Change the MDR Portal's Default Language

Multi-Factor Authentication (MFA): Overview

Add an Avatar to Your MDR Portal Account

Change Your MDR Account Password in the MDR Portal

Account Locking in the MDR Portal

Single Sign-On: Link an Account

Logging into the MDR SIEM Portal

The Alerts Page

The Agents Page

The Software Page

The Sensors Page

The DNS Activity Page

The DNS Reports Page

The Local Systems Page

The Network Activity Page

The TLS Activity Page

The Sensor Status Page: Overview

Using the Appliance Management Console (v2)

Using the MDR SIEM Management Console (v1)

Quick Start | Validating Your Field Effect Setup

Field Effect Endpoint Service Validation

Firewall Exceptions for Network Sensors and Endpoint Agents

Diagnostics Page: Overview

Access Your Account Settings in Vision

Single Sign-On: Link an Account in Vision

Add a Mobile Number to Your Account using Vision

Change Your Default Language Using Vision

Configure Multi-Factor Authentication (MFA) in Vision

Add an Avatar to Your MDR Account Using Vision

Change Your MDR Account Password in Vision

Create an API Key in Vision

Installing the Field Effect Mobile App

Signing into the Mobile App

The Organization Selector for Partners

The Profile Tab

Watching AROs from the Mobile App

Sign Up for Mobile Notifications

Field Effect APIs: Overview

Create an API Key

Obtaining your Organization ID

What events are collected by Field Effect?

Audit Policy Requirements for Field Effect MDR

Can Field Effect ingest application logs?

Does Field Effect protect against log tampering by the originator?

Can Field Effect store (retain) logs for a required period?

Do Field Effect logs go through an analytic process?

Can Field Effect collect logs from all sources?

What is a One-day, n-day, and zero-day vulnerability?

Do you recommend disabling SMTP, IMAP and POP protocols in Office 365 for regular users?

How does Field Effect leverage AI/ML?

What are Field Effects thoughts on the use of AI?

What is the Field Effect Business Continuity Plan (BCP)?

What does Field Effect MDR do at a high level?

Does Field Effect use Sysmon and if so, how is it configured?

What technology underpins your NIDS?

Does Field Effect isolate my entire network?

How does Field Effect protect my data and information?

What is the status.json file?

How do I remove duplicate endpoints?

Would Field Effect qualify as a Data Loss Prevention (DLP) Solution?

Can I send email notifications to any email address?

Can Field Effect replace my current antivirus?

What happens to Microsoft Defender Antivirus?

How is this different from Field Effect's earlier protection?

Can I disable or uninstall Defender AV with Field Effect MDR?

Can I still use Defender AV if Field Effect NGAV is operating as my primary AV?

Can I still use Defender AV as my primary AV solution?

What happens when Field Effect MDR finds a malicious file?

How does Field Effect determine if a file is malicious?

When will Field Effect automatically remediate threats?

What if Field Effect quarantines a file that is not malicious?

How does Field Effect manage resource efficiency of the agent with both EDR and NGAV running?

What happens if an endpoint is offline or not connected to the internet?

How quickly can a newly identified threat be blocked across the entire fleet?

Will users be able to login if a computer is isolated?

Can Field Effect MDR send an automated email to our ticketing systems when a computer is isolated?

How do I recover an isolated system? Can I do it myself?

How long would Field Effect take to notice an end point was infected with RansomWare?

What if my organization has another EDR service or solution with blocking capabilities?

How can I manage Active Response for a single endpoint?

Why is Active Response showing as "Off" after I set a policy?

Why did I Receive an ARO late?

What is an "Impossible Travel" scenario?

ARO: Suspected Typosquat Domain Detected

What's the difference between Resolving and Dismissing an ARO?

ARO: Removable Drive Detected

ARO: Secure Shell (SSH) Brute Force Attempt Detected

ARO: Tools for Remote Administration Detected on your Network

ARO: Audit Log was Cleared

ARO: New Administrative Account Detected

ARO: Insecure Encryption Supported by Server

ARO: Hosts Observed Without Field Effect Agent Installed

ARO: User Authentication Detected

Which remote control software do you monitor for?

Can I manage the travel itinerary for a user?

ARO: New Server detected

I dismissed an ARO but I just received it again!

Azure alerted me to a "User at risk detected", but Field Effect didn't send me an ARO?

ARO: Legacy Authentication Protocol Detected

Should I have MFA setup on a no-reply mailbox?

ARO: Malware Detected on SharePoint

Why didn't I get an ARO for a very high CVE

How do I disable DES and RC4 on my Domain Controller

ARO: Microsoft Windows Support Diagnostic Tool Remote Code Execution Vulnerability

ARO: VPN Authentication Detected

ARO: Email Domain Protection Recommendations

ARO: Vulnerable Software Detected - Overview

ARO: RDP Protocol Observed

My DUO 2FA code isn't working

How does cloud monitoring work?

What is detected with the Cloud Monitoring service?

Where are the cloud sensors deployed?

Is there an account limit on Office 365 domains?

Can I monitor two instances of the same cloud service?

Does the DNS firewall work with Chromebooks?

Do I need to worry about attacks on our Firewall?

Troubleshooting DNS Firewall

Looking Up Domains for the DNS Firewall

Error: The organization name already exists in the DNS Firewall Service

Partners: What are the Impacts of Removing a User from the Default DNS Policy?

Why are Usernames shown as Unavailable on the DNS Firewall Page

Troubleshooting the Endpoint Agent

What Endpoint agents are currently available?

Troubleshooting manual endpoint installation issues for Windows

Installing the Agent on QNAP Devices

Why am I getting the error "Missing License File"

Can I use a different license.key after I have installed an agent?

How can I stop users uninstalling the Field Effect endpoint agent?

Access the Windows Command Prompt as an administrator

Why can't I see a new Endpoint in the MDR Portal?

How do I remove a device from the Endpoint Devices page?

Am I running Windows 32-bit or 64-bit?

Using Field Effect MDR alongside other Security Solutions & AVs

What is the refresh time for an endpoint agent?

Windows Events Logged by the Endpoint Agent

Can I move endpoints between my clients?

Updating our MDM Configuration for macOS

Does Field Effect MDR perform Windows Event Log archiving or collection?

Where are the logs stored?

What’s the price to store logs for longer than 90 days?

How will I be charged?

Which data types can be retained?

Can I store system logs generated by external systems, like a VPN solution?

Can I access the logs that are stored?

Is there a best practice recommendation around log sources that should be part of log retention?

How does Log Retention affect compliance requirements?

Why cant I log into the physical sensor?

Troubleshooting Physical Sensors

Can I have confidence that my data is safe on an appliance?

We need to move the MDR SIEM Sensor, what do I need to consider?

How does Network Monitoring Work?

Where should the sensor be located within my network architecture?

What is the difference between an inline and port mirrored install configuration?

Should the sensor be in front of or behind my firewall?

What happens if the sensor loses power? Won’t my network stop?

My router or firewall has multiple physical networks on the LAN side. Can I still use the sensor?

Can the MDR SIEM monitor internal traffic that does not go to the Internet?

Does the network sensor accept inbound connections?

What does the security key do?

How does the appliance deal with VLANs or Network segmentation?

How does the Network Capture (PCAP) process work?

How is network sizing determined for a client's environment?

What are the log retention capabilities of Field Effect MDR?

How can I check my physical appliance is operating correctly?

Finding Your Sensor's Service Tags and MAC Addresses

What happens to my data when I migrate between sensors?

Why would the Field Effect sensor need to access Tor?

How can I troubleshoot appliance connectivity issues?

What happens if the primary appliance is offline?

Best Practices: Traffic for Appliances Using the Passive Configuration

WatchGuard HTTP Is Blocking Access to Field Effect Sensors

PSAs - How can I quickly Navigate to the MDR Portal from my Integration?

Autotask - The integration card is missing on the Integrations page?

Autotask - What happens if I delete an ARO task in Autotask?

Autotask - Why was I was notified that my thread threshold is exceeded?

ConnectWise - My companies aren’t available for mapping in the MDR Portal?

ConnectWise - What if I need to change the name of an organization?

ConnectWise - How can I remove unmapped statuses as choices for ARO Statuses?

ConnectWise - Why is my URL not seen as being a valid domain?

ConnectWise - Can I Move AROs to another Service Board?

ConnectWise - As a Partner, how do I deal with offboarding clients?

ConnectWise - How do I disable this Integration for a single company?

ConnectWise - What if ConnectWise become unreachable?

ConnectWise - Why won’t my status changes to AROs in the Portal sync to ConnectWise?

ConnectWise - How do I change my ConnectWise board for AROs?

ConnectWise - Why aren't my AROs syncing between the MDR Portal and ConnectWise

Why am I seeing TOR Project exit nodes in my report?

Can I breakdown the Security Events summary in the Weekly Report?

Why am I seeing logins from unexpected countries on my Monthly Report?

Can I find out more about the Most Resolved Domains listed in the Monthly Report?

Can I find out more about the My Network Summary graph?

What are the "Beacons" mentioned in a report?

As a partner, why am I not receiving reports for one of my clients?

Why are "Private Networks" displayed in the Country table?

Why is my Configuration Risk Score 0, but there are risks listed in the table

Why is My Risk Score larger than the sum of scores?

Is there an alternative to using the SEAS plugins

Why did my SEAS submission come back as Inconclusive?

Do I need to use DMARC?

Resolving the "This add-in had previously been uploaded" error

Recovering an Email Removed by SEAS

Why is the SEAS Integration not Appearing on The Outlook Mobile App?

Why is the SEAS Add-in Not Visible in the Outlook Mobile App?

Error: Google Hasn't Verified this App

An employee is leaving, how should I manage their Field Effect access?

What's the difference between Partner and Client users?

Can I change an email address associated with a login?

How do I reset MFA

FIELDEFFECT.COM • TERMS OF SERVICE • PRIVACY POLICY

Copyright © Field Effect Software Inc. All Rights Reserved.