Skip to main content

Home
Help Center
Field Effect Portal
System Status
Compliance

Login
English
English French

Home
Help Center
Using the MDR Portal
Administration / Log Retention

Recent Searches

No recent searches

Popular Articles

Articles

Topics

Tickets

Sorry! nothing found for

Administration / Log Retention

Explore the Help Center

Click a section below to navigate there, or expand it to reveal more.

How Field Effect MDR Works

What are the different portals used for?

Tour the MDR Portal

Tour the Appliance Dashboard

Tour the Mobile App

Tour the Vision Portal

Getting Started as a Field Effect Partner

Resources available to Partners

First steps with the MDR Portal

Setting up your first Client

Deploying your first Network Sensor

License Management Portal (LMP): Overview

Manage LMP Users & Access

Manage Your Partner Profile

Onboard a New Volume License Customer

Choosing a Deployment Solution: Example Scenarios

Manage Volume Licenses

Updating Customer Details in the LMP

Purchasing Additional Licenses

Offboarding a Customer Account

Purchasing Daily Dark Web Monitoring from the LMP

Viewing Beauceron Volume Agreements from the LMP

Using the Contact Us Form

Changing Client License Types in the LMP

Co-Branding & Themes for Partners

Report Settings: Client Visibility

MDR Portal Setup: Partner-Centric Features

Deployment Overview for New Partners

Partner Playbook: Deploying Field Effect MDR

The Organization Selector for Partners

The Clients View for Partners

Default Settings for Partners

Offboarding Clients (for Partners)

Setting a Default DNS Policy for New Clients

Returning Appliances: Overview

Risk & Vulnerabilities Page for Partners: Overview

Client Configuration Page for Partners

Network Sensor Asset Management

What are Your First Steps as an Administrator?

Protecting Your First Endpoint

Deploying Your First Network Sensor

Create your MDR Portal Account

Accessing the MDR Portal for the First Time

Using the Onboarding Wizard

Additional Features

Deployment Overview for New Clients

Client Playbook: Deploying MDR Complete

Client Playbook: Deploying MDR Core

Client Playbook: Deploying mEDR

Client Playbook: Deploying MDR Cloud

Deployment Checklist: MDR Complete

Deployment Checklist: MDR Core

Deployment Checklist mEDR

Deployment Checklist: MDR Cloud

Endpoint Agents: Overview

Endpoint Agent Preferences

Endpoint Agent: Operating System Requirements

Endpoint Agent System Notifications

Agent Install Guide - Windows

Agent Uninstall Guide - Windows 11

Agent Uninstall Guide - Windows 11, Command Line

Agent Install Guide - macOS

Agent Uninstall Guide - macOS

Agent Install Guide - Linux

Uninstalling the Endpoint Agent - Linux

Best Practices: Automated Agent Deployments

Sensor-Hosted Endpoint Agent Installers: Overview

Uninstalling the Endpoint Agent in Bulk

Windows Install PowerShell Script for RMM/MDM

Deploying the macOS Agent via Intune

Deploying the Windows Agent via Intune

Deploying the macOS Agent via JAMF, Addigy, and JumpStart

Installing the Windows MDR Agent Using NinjaOne RMM

Installing the Windows MDR Agent Using Datto

Installing the Windows MDR Agent Using Atera

Installing the Windows Agent Using Action1 RMM

Appliance Deployment Guide

Physical Network Appliances: Overview and Specs

Virtual Appliances: Overview

Installing a Virtual Appliance in AWS

Installing a Virtual Appliance in Azure

Installing a Virtual Appliance on a VMware ESX Cluster

Configuring a Virtual Appliance in a Hyper-V Environment

Configuring Traffic Monitoring in Azure

Installing the Appliance in a Port Mirrored Configuration

Installing the Appliance in an Inline Configuration

Configuration Guide: Compact Sensor

Configuration Guide: Shuttle Appliance Series

Configuration Guide: Oskar

Configuration Guide: Business One (version 2)

Configuration Guide: Business One (version 1)

Configuration Guide: Enterprise One

Configuration Guide: Enterprise One Hundred

What are Your First Steps?

Accessing the MDR Portal for the first time

Accessing the Appliance Dashboard

The Sidebar for Clients

The Sidebar for Partners

Service Overview - The MDR Portal Homepage

The Profile Page

Adding a Mobile Number to Your Profile

Changing Your Language in the MDR Portal

Viewing & Managing Notifications

Multi-Factor Authentication (MFA): Overview

Add an Avatar to Your MDR Portal Account

Changing Your Password

Account Locking in the MDR Portal

Single Sign-On: Link an Account

The Status Page

Getting to Know AROs

The Anatomy of an ARO

Working with AROs

ARO Comments & the Activity Feed

Watching & Assigning AROs

Downloading AROs (PDF)

Supplemental Insights & Raw Data

Compliance Mapping for AROs

Risk Score View: Overview

Devices Page: Overview

Devices Page: Bulk Editing

Devices Page: Sorting, Searching, and Filtering

The Accounts Page: Overview

Making Travel Exceptions from the MDR Portal

Insights: Overview

Active Response View (MDR Portal & Mobile)

Cloud Monitoring

Insights: DNS Firewall

The Reports View

The Supplemental Data Page - Overview

Cloud Monitoring: Overview & Setup

Authorizing Microsoft 365 Cloud Monitoring

Google Workspace

Active Response: Overview

Response Policies: Overview

Response Actions: Overview

Configure Active Response

Enable Active Response for Cloud Services

Active Response: End-User Notifications

Active Response: Example Scenarios And Common Response Events

Introduction to SEAS

Using SEAS: The End User Workflow

Viewing SEAS Reports in the MDR Portal

Installing the SEAS Outlook Add-in

Using the SEAS Outlook Add-On

Using the SEAS Gmail Add-On

Installing the SEAS Gmail Add-On

Using Google Routing Rules with SEAS

DNS Firewall: Overview & Setup

Adjusting DNS Firewall Categories

Using the Custom Allowlist or Blocklist

Partners: Setting Up a Default DNS Policy

Mapping Safe Networks

Control AI Tool Access Using the DNS Firewall

Monthly Service Report

Monthly Summary

Risk Score Report

Vulnerability Report

Dark Web Monitoring Report

The Downloads Page

For Partners: Generating a Cloud Registration Link

The Organization Profile: Overview

The Service Profile Page: Overview

The Monitoring Profile: Overview

Escalation Contacts: Overview

The User Management page

Editing User Permissions

Searching and Filtering for users

Single Sign-On (SSO): Overview

The Data Management Page

Syslogs & Field Effect MDR

Field Effect's Optional Analytics Configurations

The Integrations Page: Overview

Palo Alto Cortex

Beauceron Security

Antivirus Management: Overview

Enabling Antivirus Management

Uploading Files to the MDR Portal

Logging into the Appliance Dashboard

The Alerts Page

The Agents Page

The Software Page

The Sensors Page

The DNS Activity Page

The DNS Reports Page

The Local Systems Page

The Network Activity Page

The TLS Activity Page

The Appliance Status Page: Overview

Using the Appliance Management Console (v2)

Using the Appliance Management Console (v1)

Checking Appliance Status Using the Appliance Management Console

Quick Start | Validating Your Field Effect Setup

Field Effect Endpoint Service Validation

Firewall Exceptions for Network Appliances and Endpoint Agents

Installing the Field Effect Mobile App

Signing into the Mobile App

The Organization Selector for Partners

The Profile Tab

Watching AROs from the Mobile App

Field Effect APIs: Overview

Create an API Key

Obtaining your Organization ID

What events are collected by Field Effect?

Audit Policy Requirements for Field Effect MDR

Can Field Effect ingest application logs?

Does Field Effect protect against log tampering by the originator?

Can Field Effect store (retain) logs for a required period?

Do Field Effect logs go through an analytic process?

Can Field Effect collect logs from all sources?

What is a One-day, n-day, and zero-day vulnerability?

Do you recommend disabling SMTP, IMAP and POP protocols in Office 365 for regular users?

How does Field Effect leverage AI/ML?

What are Field Effects thoughts on the use of AI?

What is the Field Effect Business Continuity Plan (BCP)?

What does Field Effect MDR do at a high level?

Does Field Effect use Sysmon and if so, how is it configured?

What technology underpins your NIDS?

Does Field Effect isolate my entire network?

How does Field Effect protect my data and information?

What is the status.json file?

How do I remove duplicate endpoints?

Would Field Effect qualify as a Data Loss Prevention (DLP) Solution?

Can I send email notifications to any email address?

Why was an ARO notification late?

What is an "Impossible Travel" scenario?

ARO: Suspected Typosquat Domain Detected

What's the difference between Resolving and Dismissing an ARO?

ARO: Removable Drive Detected

ARO: Secure Shell (SSH) Brute Force Attempt Detected

ARO: Tools for Remote Administration Detected on your Network

ARO: Audit Log was Cleared

ARO: New Administrative Account Detected

ARO: Insecure Encryption Supported by Server

ARO: Hosts Observed Without Field Effect Agent Installed

ARO: User Authentication Detected

Which remote control software do you monitor for?

Can I manage the travel itinerary for a user?

ARO: New Server detected

I dismissed an ARO but I just received it again!

Azure alerted me to a "User at risk detected", but Field Effect didn't send me an ARO?

ARO: Legacy Authentication Protocol Detected

Should I have MFA setup on a no-reply mailbox?

ARO: Malware Detected on SharePoint

Why didn't I get an ARO for a very high CVE

How do I disable DES and RC4 on my Domain Controller

ARO: Microsoft Windows Support Diagnostic Tool Remote Code Execution Vulnerability

ARO: VPN Authentication Detected

ARO: Email Domain Protection Recommendations

ARO: Vulnerable Software Detected - Overview

ARO: RDP Protocol Observed

Will users be able to login if a computer is isolated?

Can Field Effect MDR send an automated email to our ticketing systems when a computer is isolated?

What is the process to remove isolation and restore network connectivity to affected system in case of false positive? Can I do it myself?

How long would Field Effect take to notice an end point was infected with RansomWare?

What if my organization has another EDR service or solution with blocking capabilities?

How can I manage Active Response for a single endpoint?

Why is Active Response showing as "Off" after I set a policy?

My DUO 2FA code isn't working

How does cloud monitoring work?

What is detected with the Cloud Monitoring service?

Where are the cloud sensors deployed?

Is there an account limit on Office 365 domains?

Can I monitor two instances of the same cloud service?

Does the DNS firewall work with Chromebooks?

Do I need to worry about attacks on our Firewall?

Troubleshooting DNS Firewall

Looking Up Domains for the DNS Firewall

Error: The organization name already exists in the DNS Firewall Service

Partners: What are the Impacts of Removing a User from the Default DNS Policy?

Troubleshooting the Endpoint Agent

What Endpoint agents are currently available?

Troubleshooting manual endpoint installation issues for Windows

Troubleshooting manual endpoint installation issues for QNAP

Why am I getting the error "Missing License File"

Can I use a different license.key after I have installed an agent?

How can I stop users uninstalling the Field Effect endpoint agent?

Access the Windows Command Prompt as an administrator

Why can't I see a new Endpoint in the MDR Portal?

How do I remove a device from the Endpoint Devices page?

Am I running Windows 32-bit or 64-bit?

Using Field Effect MDR alongside other Security Solutions & AVs

What is the refresh time for an endpoint agent?

Windows Events Logged by the Endpoint Agent

Can I move endpoints between my clients?

Does Field Effect do any type of Windows Event Log archiving or collection?

Where are the logs stored?

What’s the price to store logs for longer than 90 days?

How will I be charged?

Which data types can be retained?

Can I store system logs generated by external systems, like a VPN solution?

Can I access the logs that are stored?

Is there a best practice recommendation around log sources that should be part of log retention?

How does Log Retention affect compliance requirements?

Why cant I log into the physical appliance?

Troubleshooting Physical Appliances

Can I have confidence that my data is safe on an appliance?

We need to move the Appliance, what do I need to consider?

How does Network Monitoring Work?

Where should the appliance be located within my network architecture?

What is the difference between an inline and port mirrored install configuration?

Should the appliance be in front of or behind my firewall?

What happens if the appliance loses power? Won’t my network stop?

My router or firewall has multiple physical networks on the LAN side. Can I still use the appliance?

Can the appliance monitor internal traffic that does not go to the Internet?

Does the appliance accept inbound connections?

What does the security key do?

How does the appliance deal with VLANs or Network segmentation?

How does the Network Capture (PCAP) process work?

How is network sizing determined for a client's environment?

What are the log retention capabilities of Field Effect MDR?

How can I check my physical appliance is operating correctly?

Finding Your Appliance's Service Tags and MAC Addresses

What happens to my data when I migrate between appliances?

Why would the Field Effect appliance need to access Tor?

How can I troubleshoot appliance connectivity issues?

What happens if the primary appliance is offline?

Best Practices: Traffic for Appliances Using the Passive Configuration

PSAs - How can I quickly Navigate to the MDR Portal from my Integration?

Autotask - The integration card is missing on the Integrations page?

Autotask - What happens if I delete an ARO task in Autotask?

Autotask - Why was I was notified that my thread threshold is exceeded?

ConnectWise - My companies aren’t available for mapping in the MDR Portal?

ConnectWise - What if I need to change the name of an organization?

ConnectWise - How can I remove unmapped statuses as choices for ARO Statuses?

ConnectWise - Why is my URL not seen as being a valid domain?

ConnectWise - Can I Move AROs to another Service Board?

ConnectWise - As a Partner, how do I deal with offboarding clients?

ConnectWise - How do I disable this Integration for a single company?

ConnectWise - What if ConnectWise become unreachable?

ConnectWise - Why won’t my status changes to AROs in the Portal sync to ConnectWise?

ConnectWise - How do I change my ConnectWise board for AROs?

ConnectWise - Why aren't my AROs syncing between the MDR Portal and ConnectWise

Why are "Private Networks" displayed in the Country table?

Why is my Configuration Risk Score 0, but there are risks listed in the table

Why is My Risk Score larger than the sum of scores?

Why am I seeing TOR Project exit nodes in my report?

Can I breakdown the Security Events summary in the Weekly Report?

Why am I seeing logins from unexpected countries on my Monthly Report?

Can I find out more about the Most Resolved Domains listed in the Monthly Report?

Can I find out more about the My Network Summary graph?

What are the "Beacons" mentioned in a report?

As a partner, why am I not receiving reports for one of my clients?

Is there an alternative to using the SEAS plugins

Why did my SEAS submission come back as Inconclusive?

Do I need to use DMARC?

Resolving the "This add-in had previously been uploaded" error

Recovering an Email Removed by SEAS

Why is the SEAS Integration not Appearing on The Outlook Mobile App?

Why is the SEAS Add-in Not Visible in the Outlook Mobile App?

Error: Google Hasn't Verified this App

Supplemental Data Table: Email Protection DNS Record Configuration Issues

Supplemental Data Table: Out-of-Date and End of Life Operating Systems

Supplemental Data Table: Vulnerable Software

Supplemental Data Table: AI Tools Summary

An employee is leaving, how should I manage their Field Effect access?

What's the difference between Partner and Client users?

Can I change an email address associated with a login?

How do I reset MFA

Video Showcase: Account Creation & User Management

Video Showcase: The DNS Firewall

Video Showcase: Physical Appliances

Video Showcase: Deploying Field Effect as a Client (Port Mirrored Configuration)

Video Showcase: Using the Field Effect MDR Portal

FIELDEFFECT.COM • TERMS OF SERVICE • PRIVACY POLICY

Copyright © Field Effect Software Inc. All Rights Reserved.