comodosecurity/openedr

Open EDR public repository

OpenEDR

We at OpenEDR believe in creating a cybersecurity platform with its source code openly available to the public, where products and services can be provisioned and managed together. EDR is our starting point. OpenEDR is a full-blown EDR capability. It is one of the most sophisticated, effective EDR code base in the world and with the community’s help, it will become even better.

OpenEDR is free and its source code is open to the public. OpenEDR allows you to analyze what’s happening across your entire environment at the base-security-event level. This granularity enables accurate root-causes analysis needed for faster and more effective remediation. Proven to be the best way to convey this type of information, process hierarchy tracking provides more than just data, they offer actionable knowledge. It collects all the details on endpoints, hashes, and base and advanced events. You get detailed file and device trajectory information and can navigate single events to uncover a larger issue that may be compromising your system.

OpenEDR’s security architecture simplifies breach detection, protection, and visibility by working for all threat vectors without requiring any other agent or solution. The agent records all telemetry information locally and then will send the data to locally hosted or cloud-hosted ElasticSearch deployments. Real-time visibility and continuous analysis are vital elements of the entire endpoint security concept. OpenEDR enables you to perform analysis into what's happening across your environment at base event level granularity. This allows accurate root cause analysis leading to better remediation of your compromises. Integrated Security Architecture of OpenEDR delivers Full Attack Vector Visibility including MITRE Framework.

Quick Start

The community response to OpenEDR has been absolutely amazing! Thank you. We had a lot of requests from people who want to deploy and use OpenEDR easily and quickly. We have a roadmap to achieve all these. However in the meanwhile, we have decided to use the Comodo Dragon Enterprise platform with OpenEDR to achieve that. By simply opening an account, you will be able to use OpenEDR. No custom installation, no log forwarding configuration, or worrying about storing telemetry data. All of that is handled by the Comodo Dragon Platform. This is only a short-term solution until all the easy-to-use packages for OpenEDR is finalized. In the meanwhile do take advantage of this by emailing [email protected] to get you up and running!

Components

The Open EDR consists of the following components:

• Runtime components
  • Core Library – the basic framework;
  • Service – service application;
  • Process Monitor – components for per-process monitoring;
    • Injected DLL – the library which is injected into different processes and hooks API calls;
    • Loader for Injected DLL – the driver component which loads injected DLL into each new process
    • Controller for Injected DLL – service component for interaction with Injected DLL;
  • System Monitor – the genetic container for different kernel-mode components;
  • File-system mini-filter – the kernel component that hooks I/O requests file system;
  • Low-level process monitoring component – monitors processes creation/deletion using system callbacks
  • Low-level registry monitoring component – monitors registry access using system callbacks
  • Self-protection provider – prevents EDR components and configuration from unauthorized changes
  • Network monitor – network filter for monitoring the network activity;
• Installer

Generic high-level interaction diagram for runtime components

For details, you can refer here: https://techtalk.comodo.com/2020/09/19/open-edr-components/

Community

• Community Forums: https://community.openedr.com/
• Join Slack
• Registration

Roadmap

Please refer here for project roadmap : https://github.com/ComodoSecurity/openedr_roadmap/projects/1

Getting Started

Please take a look at the following documents.

1. Getting Started
2. Build Instructions
3. Docker Installation
4. Setting up Elasticsearch Kibana and Logstash
5. Setting up Openedr and File beat
6. Editing Alerting Policies
7. Setting Up Kibana

Releases

https://github.com/ComodoSecurity/openedr/releases/tag/release-2.5.1

Screenshots

How OpenEDR integration with a platform looks like and also a showcase for openedr capabilities

Detection / Alerting

Event Details

Dashboard

Process Timeline

Process Treeview

Event Search

openedr's Issues

is this project dead???

is this project dead???

Bug: curl_lib func:Curl_pin_peer_pubkey() may cause a memory leak

edrav2/eprj/curl/lib/vtls/vtls.c:

CURLcode Curl_pin_peer_pubkey(struct Curl_easy *data,
const char *pinnedpubkey,
const unsigned char *pubkey, size_t pubkeylen)
{
........

/* compute sha256sum of public key */
sha256sumdigest = malloc(CURL_SHA256_DIGEST_LENGTH);
if(!sha256sumdigest)
  return CURLE_OUT_OF_MEMORY;

//sha256sumdigest malloc ok

encode = Curl_ssl->sha256sum(pubkey, pubkeylen,
                    sha256sumdigest, CURL_SHA256_DIGEST_LENGTH);

if(encode != CURLE_OK)
  return encode;
**// here  maybe memleak**

encode = Curl_base64_encode(data, (char *)sha256sumdigest,
                            CURL_SHA256_DIGEST_LENGTH, &encoded,
                            &encodedlen);
Curl_safefree(sha256sumdigest);

if(encode)
  return encode;

.....

Output Events not in CRLF format

Hey guys, I realized that the logs in the output folder C:\ProgramData\edrsvc\log\output_events, although they are a valid JSON, do not have a proper CRLF (carriage return line ending) (as you can see in line 57 below).

This is a bit problematic if you want to read the logs with Filebeat for instance. Is it possible to add a CRLF per line? Or even better that the JSON are not beautified (not pretty output)? That way we save time because there will be a JSON log per line with a proper carriage return.

Can this tool replace common anti-virus software?

I wonder if OpenEDR can replace anti-virus software like trendmicro officescan. If so, then there must be some signature-based or other form of virus rule updates every day or week. Then how do I know if it is reliable to detect viruses and threats?

Check out error when clone this repository.

Error Message:

Updating files: 100% (66966/66966), done.
Downloading edrav2/build/buildpipe/Tools/7za.exe (740 KB)
Error downloading object: edrav2/build/buildpipe/Tools/7za.exe (ea308c7): Smudge error: Error downloading edrav2/build/buildpipe/Tools/7za.exe (ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d): batch response: This repository is over its data quota. Account responsible for LFS bandwidth should purchase more data packs to restore access.

Stop calling it Open Source if you only provide Commons Clause license

Your README and the press are calling this Open Source software.
But your License.md is the Commons Clause which explicitly says it is not Open Source:

Is this “Open Source”?
No.
“Open source”, has a specific definition that was written years ago and is stewarded by the Open Source Initiative, which approves Open Source licenses. Applying the Commons Clause to an open source project will mean the source code is available, and meets many of the elements of the Open Source Definition, such as free access to source code, freedom to modify, and freedom to re-distribute, but not all of them.

The difference is of course major for anyone who wants to join you in providing OpenEDR as a product.

Please fix your README.

Unite that project with Xylent Antivirus

Is your feature request related to a problem? Please describe.
Yes #30 #30 this feature request is so big but if replace it then Comodo have open source anti-virus and can make profit with that

Describe the solution you'd like
Just create a team for that and unite with Xylent. I know it's so revolutinary idea but it going to make Comodo profit so big
Describe alternatives you've considered
Alternative solution is if no one accept that project then I going to create my team for that project
Additional context
Auto containment techonology should under with that project if we do that and use otherrules etc. the antivirus become very strong than you imagine

Filebeat Configuration (ELK Stack)

Hi,

can someone share their Filebeat.yml configuration file? I can't seem to configure it right to show the logs that the OpenEDR collects... it only sends the metadata etc...

My filebeat.yml configuration:

**filebeat.inputs:

• type: log
  enabled: true
  paths:
  • c:\programdata\edrsvc\log\output_events*
    json.keys_under_root: true
    json.add_error_key: true
    json.message_key: log**

Maybe something to do with multiline.pattern?

Thanks ahead!

Yara rules support for endpoint scans

Add option to search for IoC on endpoints with using Yara rules. These rules could be imported to central console and distributed via console requests to endpoints_

Looking for some direction on research to defeat / improve the tool (pentesting research)

So I'm fairly new to security research, not sure if EDR developers are typically friendly to research aiming to break into their product, but I do think it's ultimately a good thing for this kind of thing to be done, especially when it's published for all to learn from / respond to rather than quietly developed to be abused for cyber crime. After doing this I'll definitely share a write-up of the results, maybe even privately with the contributors here if possible ahead of a public paper.

Some questions I want to answer:

1. Could an open source project implement edge of the art payload anti-detection tradecraft in such a way to allow any non-sophisticated threat actor to leverage it easily?
2. Can publicly available endpoint threat detection tools (i.e. not custom tools or private tech for defense contractors / nation-states) deal with edge of the art payload anti-detection tradecraft effectively? Even get close?
3. If not, could we make an open-source tool (or improve one, for example this one) to be good enough to do that?

If we can demonstrate 1 to be true and 2 to be false (by defeating all the publicly available EDRs), then it would be really important to answer 3 (preferably in the affirmative).

I decided to start out testing against OpenEDR, since the source being available should make it the easiest tool to build a testing pipeline for. Some things I intend to test against this EDR:

• A new (maybe?) form of binary obfuscation. At least I haven't seen any literature on it, but I find relevant research I hadn't seen before every day, so who knows.
• A fresh take on some well known approaches to evading hooks to include getting rid of any visible jump tables
• Avoiding common OS API and standard lib hooks by importing obfuscated fresh copies of those libraries
• Using uncertainty in jump destinations to prevent behavior analysis outside of the intended target environment (evasion)
• If Event Tracing for Windows is being leveraged, I'll be testing some defeat methods (see last few paragraphs on that post) against that.
• To get really close to what I think might be the edge of the art in this problem-space, Windows does expose some built-in kernel hooking APIs which seem most useful (short of hooks injected via direct kernel patching, which Windows has long since prevented from happening) and if this EDR is using them, I'll be researching some ways to defeat those.

And if anyone close to the project's development would be willing to have discussion on some of the low-level advanced concepts involved, maybe exchange some back-and-forths on penetration approaches, perhaps we could all learn something.

The links above all point to posts by my reddit account, so it shouldn't be hard to get in touch if anyone likes, or else I'd be happy to have some discussion here openly within this issue. Basically for now I'm just hoping to learn about the core components of the EDR and sort of where this tool stands between 'state-of' and 'edge-of' the art against the various defeat methods I'm interested in testing. It would save me a lot of time to have that dialogue.

Hook evasion research: A little more on my research and why I say kernel hooks are most useful; It's just because of the way evasion (due to the existence of dynamic jump destinations based on conditions fundamentally uncertain to the defender combined with the variable-length nature of the x86 instruction set) makes it impossible for endpoint defense products to reliably predict what a program will do. The true control flow is fundamentally unknown. But in order to create an effect, the attacker must interface with the hardware or other processes in some way, which it must ask the kernel for permission to do (system calls). By 'hooking' (redirecting control flow to intermediately executed security subroutines) any calls to the kernel, the defender can gain valuable insight into the behavior of the program when it executes on its intended target, despite evasive behavior, and potentially recognize / stop the threat. So as the attacker, we really need to avoid these kernel hooks. Windows actually really hurts the defender here by forcing its own implementation of this (here's an example of this for filesystem interaction), so by exploiting this single implementation, every single endpoint security product which leverages Windows kernel hooks can potentially be subverted.

Binary obfuscation research: So right now I would say most attacks don't involve great obfuscation. Some of the best source code obfuscation tools out there (like Tigress) are aimed at preventing reverse engineering (because that's where the money is) moreso than avoiding detection, resulting in very recognizable control flow graph patterns and well, binary obfuscation is hard. But binary obfuscation is much more powerful, and it is likely possible to innovate in this space, through the approach I mentioned previously and others. Even where we might struggle to evade certain kernel-level system call hooks, we can add noise to this analysis channel. This could fool some signatures based on analyzing system call sequences, although other heuristic based signatures might not be fooled, hence the importance of the previous bullet for attacking those more robust defenses by evading the hooks themselves. Still other signature metrics exist beyond system call sequences, to include resource usage patterns, register activity patterns, and so on, all of which an EDR endpoint sensor might seek to analyze.

But this list will probably double in size as I probe the EDR and see what mechanisms and detection strategies are used. I'll comment on this thread as I find potential attack vectors against the tool and better understand its inner workings, and seek further discussion with anyone interested in this. As I said, I'm no veteran researcher and I surely have much to learn on the topic. Thanks ahead of time for any advice or insight given!

Help.

Sirs, good morning.

It is possible to customize the dashboards.

Agent writes events to a specific folder in a form that can be read by filebeat (No "}{" lines. Event should start on its own line.)

Currently we have a parse problem for filebeat, every event should start on new line.
Lets have multi-line and single-line option as configurable

Only Protobuf .pb.cc errors on compiling openedr project with Visual Studio 2019. Except project libcloud and edrsvc, All project have been successfully built.

I'm encountering errors while trying to build the openedr project. Despite multiple attempts, I haven't been able to resolve it. I have built all except libcloud and edrsvc.
Since I'm stuck, I've reached out to the maintainer for assistance. Could you please lend a hand in getting this project built successfully?
Feels like I am lost now so please give your helping hand.
@ozercomodo @Cunfuu @ComodoMelih @seroza @yucecengiz @stnert @pbasilcom

Describe the bug
I am trying to build an openEdr project that uses this library in Visual Studio 2019 with C++ Language runtime ISO C++17 Standard (/std:c++17). Once it compiles .pb.cc files, it generates lots of error 400+.

I am done with all the required library in eproj dir and finally, these errors were getting.
Except for libcloud and edrsvc all other projects have been built successfully.
I am getting Errors in the project libcloud and edrsvc only.

To Reproduce
Steps to reproduce the behavior:

1. Go to 'https://github.com/ComodoSecurity/openedr'
2. Clone the repo
3. Build all the eproj libraries.
4. Go to dir 'edrav2/build/vs2019' and open the .sln file in Visual Studio with admin.
5. See errors in Visual Studio

Expected behavior
The project should be built successfully and generate .dll,.lib, .sys, and .exe files wherever applicable without any errors.

Screenshots

Build started... 1>------ Build started: Project: libcloud, Configuration: Debug x64 ------ 1>annotations.pb.cc 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/stubs/status.h(97,15): warning C4251: 'google::protobuf::util::status_internal::Status::error_message_': class 'std::basic_string<char,std::char_traits<char>,std::allocator<char>>' needs to have dll-interface to be used by clients of class 'google::protobuf::util::status_internal::Status' 1>C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30037\include\xstring(4905): message : see declaration of 'std::basic_string<char,std::char_traits<char>,std::allocator<char>>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/stubs/logging.h(100,15): warning C4251: 'google::protobuf::internal::LogMessage::message_': class 'std::basic_string<char,std::char_traits<char>,std::allocator<char>>' needs to have dll-interface to be used by clients of class 'google::protobuf::internal::LogMessage' 1>C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30037\include\xstring(4905): message : see declaration of 'std::basic_string<char,std::char_traits<char>,std::allocator<char>>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/io/coded_stream.h(1282,28): warning C4251: 'google::protobuf::io::CodedOutputStream::default_serialization_deterministic_': struct 'std::atomic<bool>' needs to have dll-interface to be used by clients of class 'google::protobuf::io::CodedOutputStream' 1>C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30037\include\atomic(2859): message : see declaration of 'std::atomic<bool>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/arena_impl.h(307,23): warning C4251: 'google::protobuf::internal::SerialArena::space_allocated_': struct 'std::atomic<unsigned __int64>' needs to have dll-interface to be used by clients of class 'google::protobuf::internal::SerialArena' 1>C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30037\include\atomic(2871): message : see declaration of 'std::atomic<unsigned __int64>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/arena_impl.h(412,29): warning C4251: 'google::protobuf::internal::ThreadSafeArena::alloc_policy_': class 'google::protobuf::internal::TaggedAllocationPolicyPtr' needs to have dll-interface to be used by clients of class 'google::protobuf::internal::ThreadSafeArena' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/arena_impl.h(112): message : see declaration of 'google::protobuf::internal::TaggedAllocationPolicyPtr' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/arena_impl.h(415,29): warning C4251: 'google::protobuf::internal::ThreadSafeArena::threads_': struct 'std::atomic<google::protobuf::internal::SerialArena *>' needs to have dll-interface to be used by clients of class 'google::protobuf::internal::ThreadSafeArena' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/arena_impl.h(415): message : see declaration of 'std::atomic<google::protobuf::internal::SerialArena *>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/arena_impl.h(416,29): warning C4251: 'google::protobuf::internal::ThreadSafeArena::hint_': struct 'std::atomic<google::protobuf::internal::SerialArena *>' needs to have dll-interface to be used by clients of class 'google::protobuf::internal::ThreadSafeArena' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/arena_impl.h(415): message : see declaration of 'std::atomic<google::protobuf::internal::SerialArena *>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/arenastring.h(77,43): warning C4251: 'google::protobuf::internal::LazyString::inited_': struct 'std::atomic<const std::string *>' needs to have dll-interface to be used by clients of class 'google::protobuf::internal::LazyString' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/arenastring.h(77): message : see declaration of 'std::atomic<const std::string *>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/arenastring.h(323,26): warning C4251: 'google::protobuf::internal::ArenaStringPtr::tagged_ptr_': class 'google::protobuf::internal::TaggedPtr<std::string>' needs to have dll-interface to be used by clients of struct 'google::protobuf::internal::ArenaStringPtr' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/arenastring.h(118): message : see declaration of 'google::protobuf::internal::TaggedPtr<std::string>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/metadata_lite.h(261,15): warning C4251: 'google::protobuf::internal::LiteUnknownFieldSetter::buffer_': class 'std::basic_string<char,std::char_traits<char>,std::allocator<char>>' needs to have dll-interface to be used by clients of class 'google::protobuf::internal::LiteUnknownFieldSetter' 1>C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30037\include\xstring(4905): message : see declaration of 'std::basic_string<char,std::char_traits<char>,std::allocator<char>>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/message_lite.h(445,30): warning C4251: 'google::protobuf::MessageLite::_internal_metadata_': class 'google::protobuf::internal::InternalMetadata' needs to have dll-interface to be used by clients of class 'google::protobuf::MessageLite' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/metadata_lite.h(62): message : see declaration of 'google::protobuf::internal::InternalMetadata' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/implicit_weak_message.h(93,15): warning C4251: 'google::protobuf::internal::ImplicitWeakMessage::data_': class 'std::basic_string<char,std::char_traits<char>,std::allocator<char>>' needs to have dll-interface to be used by clients of class 'google::protobuf::internal::ImplicitWeakMessage' 1>C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30037\include\xstring(4905): message : see declaration of 'std::basic_string<char,std::char_traits<char>,std::allocator<char>>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/generated_message_util.h(193,20): warning C4251: 'google::protobuf::internal::CachedSize::size_': struct 'std::atomic<int>' needs to have dll-interface to be used by clients of class 'google::protobuf::internal::CachedSize' 1>C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30037\include\atomic(2866): message : see declaration of 'std::atomic<int>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/stubs/mutex.h(136,40): warning C4251: 'google::protobuf::internal::WrappedMutex::mu_': class 'google::protobuf::internal::CallOnceInitializedMutex<std::mutex>' needs to have dll-interface to be used by clients of class 'google::protobuf::internal::WrappedMutex' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/stubs/mutex.h(136): message : see declaration of 'google::protobuf::internal::CallOnceInitializedMutex<std::mutex>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.h(1627,25): warning C4251: 'google::protobuf::FileDescriptor::LazyInitData::once': struct 'std::once_flag' needs to have dll-interface to be used by clients of struct 'google::protobuf::FileDescriptor::LazyInitData' 1>C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30037\include\xcall_once.h(21): message : see declaration of 'std::once_flag' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.h(2041,27): warning C4251: 'google::protobuf::DescriptorPool::tables_': class 'std::unique_ptr<google::protobuf::DescriptorPool::Tables,std::default_delete<google::protobuf::DescriptorPool::Tables>>' needs to have dll-interface to be used by clients of class 'google::protobuf::DescriptorPool' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.h(2041): message : see declaration of 'std::unique_ptr<google::protobuf::DescriptorPool::Tables,std::default_delete<google::protobuf::DescriptorPool::Tables>>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.h(2051,31): warning C4251: 'google::protobuf::DescriptorPool::unused_import_track_files_': class 'std::map<std::string,bool,std::less<std::string>,std::allocator<std::pair<const std::string,bool>>>' needs to have dll-interface to be used by clients of class 'google::protobuf::DescriptorPool' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.h(2051): message : see declaration of 'std::map<std::string,bool,std::less<std::string>,std::allocator<std::pair<const std::string,bool>>>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/io/zero_copy_stream_impl_lite.h(243,30): warning C4251: 'google::protobuf::io::CopyingInputStreamAdaptor::buffer_': class 'std::unique_ptr<uint8_t [],std::default_delete<uint8_t []>>' needs to have dll-interface to be used by clients of class 'google::protobuf::io::CopyingInputStreamAdaptor' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/io/zero_copy_stream_impl_lite.h(243): message : see declaration of 'std::unique_ptr<uint8_t [],std::default_delete<uint8_t []>>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/io/zero_copy_stream_impl_lite.h(334,30): warning C4251: 'google::protobuf::io::CopyingOutputStreamAdaptor::buffer_': class 'std::unique_ptr<uint8_t [],std::default_delete<uint8_t []>>' needs to have dll-interface to be used by clients of class 'google::protobuf::io::CopyingOutputStreamAdaptor' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/io/zero_copy_stream_impl_lite.h(243): message : see declaration of 'std::unique_ptr<uint8_t [],std::default_delete<uint8_t []>>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/unknown_field_set.h(206,29): warning C4251: 'google::protobuf::UnknownFieldSet::fields_': class 'std::vector<google::protobuf::UnknownField,std::allocator<google::protobuf::UnknownField>>' needs to have dll-interface to be used by clients of class 'google::protobuf::UnknownFieldSet' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/unknown_field_set.h(206): message : see declaration of 'std::vector<google::protobuf::UnknownField,std::allocator<google::protobuf::UnknownField>>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/extension_set.h(1070,26): warning C4251: 'google::protobuf::internal::RepeatedPrimitiveDefaults::default_repeated_field_int32_t_': class 'google::protobuf::RepeatedField<int32_t>' needs to have dll-interface to be used by clients of class 'google::protobuf::internal::RepeatedPrimitiveDefaults' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/repeated_field.h(1045): message : see declaration of 'google::protobuf::RepeatedField<int32_t>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/extension_set.h(1071,26): warning C4251: 'google::protobuf::internal::RepeatedPrimitiveDefaults::default_repeated_field_int64_t_': class 'google::protobuf::RepeatedField<int64_t>' needs to have dll-interface to be used by clients of class 'google::protobuf::internal::RepeatedPrimitiveDefaults' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/repeated_field.h(1047): message : see declaration of 'google::protobuf::RepeatedField<int64_t>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/extension_set.h(1072,27): warning C4251: 'google::protobuf::internal::RepeatedPrimitiveDefaults::default_repeated_field_uint32_t_': class 'google::protobuf::RepeatedField<uint32_t>' needs to have dll-interface to be used by clients of class 'google::protobuf::internal::RepeatedPrimitiveDefaults' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/repeated_field.h(1046): message : see declaration of 'google::protobuf::RepeatedField<uint32_t>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/extension_set.h(1073,27): warning C4251: 'google::protobuf::internal::RepeatedPrimitiveDefaults::default_repeated_field_uint64_t_': class 'google::protobuf::RepeatedField<uint64_t>' needs to have dll-interface to be used by clients of class 'google::protobuf::internal::RepeatedPrimitiveDefaults' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/repeated_field.h(1048): message : see declaration of 'google::protobuf::RepeatedField<uint64_t>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/extension_set.h(1074,25): warning C4251: 'google::protobuf::internal::RepeatedPrimitiveDefaults::default_repeated_field_double_': class 'google::protobuf::RepeatedField<double>' needs to have dll-interface to be used by clients of class 'google::protobuf::internal::RepeatedPrimitiveDefaults' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/repeated_field.h(1050): message : see declaration of 'google::protobuf::RepeatedField<double>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/extension_set.h(1075,24): warning C4251: 'google::protobuf::internal::RepeatedPrimitiveDefaults::default_repeated_field_float_': class 'google::protobuf::RepeatedField<float>' needs to have dll-interface to be used by clients of class 'google::protobuf::internal::RepeatedPrimitiveDefaults' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/repeated_field.h(1049): message : see declaration of 'google::protobuf::RepeatedField<float>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/extension_set.h(1076,23): warning C4251: 'google::protobuf::internal::RepeatedPrimitiveDefaults::default_repeated_field_bool_': class 'google::protobuf::RepeatedField<bool>' needs to have dll-interface to be used by clients of class 'google::protobuf::internal::RepeatedPrimitiveDefaults' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/repeated_field.h(1044): message : see declaration of 'google::protobuf::RepeatedField<bool>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(48,76): warning C4251: 'TableStruct_google_2fprotobuf_2fdescriptor_2eproto::aux': union 'google::protobuf::internal::AuxiliaryParseTableField' needs to have dll-interface to be used by clients of struct 'TableStruct_google_2fprotobuf_2fdescriptor_2eproto' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/generated_message_table_driven.h(141): message : see declaration of 'google::protobuf::internal::AuxiliaryParseTableField' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(488,93): warning C4251: 'google::protobuf::FileDescriptorSet::file_': class 'google::protobuf::RepeatedPtrField<google::protobuf::FileDescriptorProto>' needs to have dll-interface to be used by clients of class 'google::protobuf::FileDescriptorSet' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(470): message : see declaration of 'google::protobuf::RepeatedPtrField<google::protobuf::FileDescriptorProto>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(873,49): warning C4251: 'google::protobuf::FileDescriptorProto::_has_bits_': class 'google::protobuf::internal::HasBits<1>' needs to have dll-interface to be used by clients of class 'google::protobuf::FileDescriptorProto' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/has_bits.h(83): message : see declaration of 'google::protobuf::internal::HasBits<1>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(875,58): warning C4251: 'google::protobuf::FileDescriptorProto::dependency_': class 'google::protobuf::RepeatedPtrField<std::basic_string<char,std::char_traits<char>,std::allocator<char>>>' needs to have dll-interface to be used by clients of class 'google::protobuf::FileDescriptorProto' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/repeated_ptr_field.h(1235): message : see declaration of 'google::protobuf::RepeatedPtrField<std::basic_string<char,std::char_traits<char>,std::allocator<char>>>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(876,89): warning C4251: 'google::protobuf::FileDescriptorProto::message_type_': class 'google::protobuf::RepeatedPtrField<google::protobuf::DescriptorProto>' needs to have dll-interface to be used by clients of class 'google::protobuf::FileDescriptorProto' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(667): message : see declaration of 'google::protobuf::RepeatedPtrField<google::protobuf::DescriptorProto>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(877,93): warning C4251: 'google::protobuf::FileDescriptorProto::enum_type_': class 'google::protobuf::RepeatedPtrField<google::protobuf::EnumDescriptorProto>' needs to have dll-interface to be used by clients of class 'google::protobuf::FileDescriptorProto' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(685): message : see declaration of 'google::protobuf::RepeatedPtrField<google::protobuf::EnumDescriptorProto>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(878,96): warning C4251: 'google::protobuf::FileDescriptorProto::service_': class 'google::protobuf::RepeatedPtrField<google::protobuf::ServiceDescriptorProto>' needs to have dll-interface to be used by clients of class 'google::protobuf::FileDescriptorProto' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(703): message : see declaration of 'google::protobuf::RepeatedPtrField<google::protobuf::ServiceDescriptorProto>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(879,94): warning C4251: 'google::protobuf::FileDescriptorProto::extension_': class 'google::protobuf::RepeatedPtrField<google::protobuf::FieldDescriptorProto>' needs to have dll-interface to be used by clients of class 'google::protobuf::FileDescriptorProto' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(721): message : see declaration of 'google::protobuf::RepeatedPtrField<google::protobuf::FieldDescriptorProto>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(880,53): warning C4251: 'google::protobuf::FileDescriptorProto::public_dependency_': class 'google::protobuf::RepeatedField<int32_t>' needs to have dll-interface to be used by clients of class 'google::protobuf::FileDescriptorProto' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/repeated_field.h(1045): message : see declaration of 'google::protobuf::RepeatedField<int32_t>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(881,53): warning C4251: 'google::protobuf::FileDescriptorProto::weak_dependency_': class 'google::protobuf::RepeatedField<int32_t>' needs to have dll-interface to be used by clients of class 'google::protobuf::FileDescriptorProto' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/repeated_field.h(1045): message : see declaration of 'google::protobuf::RepeatedField<int32_t>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(1075,49): warning C4251: 'google::protobuf::DescriptorProto_ExtensionRange::_has_bits_': class 'google::protobuf::internal::HasBits<1>' needs to have dll-interface to be used by clients of class 'google::protobuf::DescriptorProto_ExtensionRange' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/has_bits.h(83): message : see declaration of 'google::protobuf::internal::HasBits<1>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(1249,49): warning C4251: 'google::protobuf::DescriptorProto_ReservedRange::_has_bits_': class 'google::protobuf::internal::HasBits<1>' needs to have dll-interface to be used by clients of class 'google::protobuf::DescriptorProto_ReservedRange' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/has_bits.h(83): message : see declaration of 'google::protobuf::internal::HasBits<1>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(1593,49): warning C4251: 'google::protobuf::DescriptorProto::_has_bits_': class 'google::protobuf::internal::HasBits<1>' needs to have dll-interface to be used by clients of class 'google::protobuf::DescriptorProto' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/has_bits.h(83): message : see declaration of 'google::protobuf::internal::HasBits<1>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(1595,94): warning C4251: 'google::protobuf::DescriptorProto::field_': class 'google::protobuf::RepeatedPtrField<google::protobuf::FieldDescriptorProto>' needs to have dll-interface to be used by clients of class 'google::protobuf::DescriptorProto' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(721): message : see declaration of 'google::protobuf::RepeatedPtrField<google::protobuf::FieldDescriptorProto>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(1596,89): warning C4251: 'google::protobuf::DescriptorProto::nested_type_': class 'google::protobuf::RepeatedPtrField<google::protobuf::DescriptorProto>' needs to have dll-interface to be used by clients of class 'google::protobuf::DescriptorProto' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(667): message : see declaration of 'google::protobuf::RepeatedPtrField<google::protobuf::DescriptorProto>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(1597,93): warning C4251: 'google::protobuf::DescriptorProto::enum_type_': class 'google::protobuf::RepeatedPtrField<google::protobuf::EnumDescriptorProto>' needs to have dll-interface to be used by clients of class 'google::protobuf::DescriptorProto' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(685): message : see declaration of 'google::protobuf::RepeatedPtrField<google::protobuf::EnumDescriptorProto>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(1598,104): warning C4251: 'google::protobuf::DescriptorProto::extension_range_': class 'google::protobuf::RepeatedPtrField<google::protobuf::DescriptorProto_ExtensionRange>' needs to have dll-interface to be used by clients of class 'google::protobuf::DescriptorProto' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(1461): message : see declaration of 'google::protobuf::RepeatedPtrField<google::protobuf::DescriptorProto_ExtensionRange>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(1599,94): warning C4251: 'google::protobuf::DescriptorProto::extension_': class 'google::protobuf::RepeatedPtrField<google::protobuf::FieldDescriptorProto>' needs to have dll-interface to be used by clients of class 'google::protobuf::DescriptorProto' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(721): message : see declaration of 'google::protobuf::RepeatedPtrField<google::protobuf::FieldDescriptorProto>' 1>C:\openedrBuild\openedrNew\openedr-release-2.5.1\openedr-release-2.5.1\edrav2\eprj\protobuf\include\google/protobuf/descriptor.pb.h(1600,94): warning C4251: 'google::protobuf::DescriptorProto::oneof_decl_': class

Desktop (please complete the following information):

• OS: Windows
• Browser: NA
• Version: OS 10

Additional context
Protobuf Version: main/v3.19.4
Openedr version: V2.5.1.0
Language: C++
IDE: Visual Studio 2019 community edition

I don't understand how to resolve it. Please help me to resolve these issues. I will be very thankful to you for a great community.
Please help me, your helping hand will be appreciated a lot.
I am lost and trying a lot to resolve this issue but couldn't get success.
Now your expertise can save me.
@ozercomodo @Cunfuu @ComodoMelih @seroza @yucecengiz @stnert @pbasilcom

Thanks, community.

whether openEDR agent support macOS

Endpoint - "Contained Files" does not reset after having classified the files as: trusted.

investigate to switch to v2 policy format

[Security bug] Vulnerabilities in the DLL injector module

I have found two issues that can be chained by an attacker with high privileges in order to inject arbitrary hooks into any monitored process in an endpoint running openEDR.

1. Unsigned DLL Loading in the Injector Module

The EDR's injector driver loads specific DLLs into monitored processees to hook certain Windows APIs. However, the driver does not check correctly the loaded DLLs' signatures at all. This allows an attacker with high integrity privileges to use this legitimate driver, signed by Comodo, to load a malicious DLLs and perform userland hooking.

The isDllVerified() function is not being used and does not work correctly in current Windows versions.

2. DLL Hijacking in the Injector Module

The injector driver searches for DLLs to inject into the monitored processes in a predefined list of paths in priority order. The issue stems from the fact that, even though the second of these paths is properly protected, the first is not. This allows a user with high integrity privileges to drop a malicious DLL into this path, or overwrite a legitimate DLL in such path.

Password reset and after resetting the MFA, TOTP does not validate the code

My OpenEDR requested a password reset because it had expired, after that, I reset the password, and when trying to log in to the dashboard, the KeePassXC TOTP that I use says that the TFA is invalid.

Please follow the screenshot for more information.

Thanks.

OpenEDR should works with the editable local policy defined in the agent distribution

We need to get rid of encryption so the user can change the local file and apply changes.
The local policies should be the same as JSON format we use in paid-EDR
In local mode, it should read local policy changes and then apply it without restarting agent.

Deloy OpenEDR on self-host

Hi everybody. I'm new and started learning about OpenEDR but when I read the documentation to deploy on my local machine I couldn't understand it. So can anyone guide me step by step to build OpenEDR on self-host? Sincerely thank.

Testing help needed OpenEDR without MadcHook

We were silent but working hard to replace MadcHook. As you know This was blocker since MadcHook is a licenced product.
Now we have replaced all but we need extensive testing for compatibility.

We will make our binaries available before pushing it to public repo. Please let us know if you can contribute

Replace MadcHook with Microsoft Detours

Due to the commercial licensing of MadcHook, we want to replace it with Microsoft Detours https://github.com/microsoft/Detours . We need contributors to implement that with us. We will break it down into subtasks,

Error message: Browser's cookie functionality turned off!

I encountered this error when I went to log in. And yes, I don't have any cookie blocker enabled on the domain.

Maintainers - @ozercomodo

Where is the nfapi.h

Describe the bug
nfapi.h not found
To Reproduce
Run project at Visual Studio 2019

Expected behavior
No compile problems

Screenshots

Desktop (please complete the following information):
Windows 11

Build Instructions

Dear Sirs,

Please explain how it is possible to contribute to this project?

I ask because it implies it is "open", however it requires the madhookcode library which you have to purchase at http://www.madcodehook.com/madCodeHookDescription.htm

I will try contacting the developer directory.

OpenEDR logs to Elasticsearch

Hi,
As per readme at the time it publish the elasticsearch does not have openedr module. Is it supported now ?

Thanks

OpenEDR Roadmap

For roadmap items, I created another repository to make it visible to everyone. Please check: https://github.com/ComodoSecurity/openedr_roadmap/projects/1

Multiline json logs make filebeat->elasticsearch impossible

I have filebeat picking up the logs from C:\\ProgramData\edrsvc\log\output_events\*.log and sending them to elasticsearch. However, I cannot parse the logs, as they are multiline json with no newline between (}{).

If we could make each log take up one line, or at least put a newline between json objects, that should make it possible for filebeat->elasticsearch to parse them.

Bug:An exception branch handling may cause a memory leak

edrav2/eprj/curl/lib/escape.c

char *curl_easy_escape(struct Curl_easy *data, const char *string,
int inlength)
{
....

alloc = (inlength?(size_t)inlength:strlen(string)) + 1;
newlen = alloc;

//malloc the ns memery
ns = malloc(alloc);
if(!ns)
return NULL;
//malloc ok

length = alloc-1;
while(length--) {
unsigned char in = string; / we need to treat the characters unsigned */

if(Curl_isunreserved(in))
  /* just copy this */
  ns[strindex++] = in;
else {
  /* encode it */
  newlen += 2; /* the size grows with two, since this'll become a %XX */
  if(newlen > alloc) {
    alloc *= 2;
    testing_ptr = Curl_saferealloc(ns, alloc);
    if(!testing_ptr)
      return NULL;
      // Here  will cause the memery leak.
    
.....

}

log ingesting with filebeat impossible in current release

Hi there,
the parsing of pretty json log messages is not possible even with the multiline json option in filebeat.
The problem is that there is no newline after closing curly bracket and beginning of the new document.
}{

i read in the issues that this has been fixed.
Can you run another build with fixed stuff and put it into release?

Thanks in advance

I want to compile OpenEdr,

I want to compile OpenEdr, and I also purchased Netfilter Sdk and MadcHook, but when I was compiling, I found nfapi::cmdedr related classes. May I ask if this class can be open source.

Doubt regarding "nfwfpdrv"

Hey I'm trying to figure out how this project works, can someone tell me where the "nfwfpdrv" driver is located how it is being installed and where I can find its source code if available

Is the project still alive? I want to contribute

Hello. I am a security enthusiast who wants to start contributing to OpenEDR.
I am currently working in a well known XDR solution.
I have a real security background including DFIR, Malware analysis, Tools, POC's, etc'
At the moment I am in the Linux/Mac dev team in Cynet, Writing in C, C++, C#, Lua.

However, I visited your GitHub and I see almost no activity in the year.
Is the project still alive?

Testing the first release

Urgent help wanted to test first release, please also express your environment, test steps and expected result : success or failure

cannot uninstall openedr from Add/Remove program

I cannot uninstall openedr from Add/Remove program , it says no permission

i tried this from command line as system user and it works

msiexec /x OpenEDR-installation-2.0.0.0-x64.msi

Is it a real open source software? for academic use, I can not rebuild it using VS 2019

Hello, Everyone

 Does someone rebuild this "open source" EDR successfully? I tried, but failed. Under Visual Studio 2019, the compilation failed with errors: 1) madCHook.h, No Such File or Directory. 2) System Includes.h No such file or directory. 3) No libboost_date_time-vc142-mt-sgd-x64-1_70.lib。

I'm not sure whether this project is indeed going to work for everyone. If not, I will try other open source projects for academic use. If yes, please give more instructions about how to compile and rebuild this project.

Thanks

How to stop edrsvc service

Hi,

when i try (as admin or system) to stop edrsvc using sc stop edrsvc, i am getting this

**[SC] ControlService FAILED 1052:

The requested control is not valid for this service.**

Thanks for help

Linux

Hello,

Only Windows, any linux build? :(