Endpoint security
![../../../_images/endpoint_protection_scenario.png](../../../_images/endpoint_protection_scenario.png)
CyberApp scenarios
Typical
Typical endpoint security CyberApps include the following:
- Establishing connection to the ISV cloud.Connection parameters and credentials to allow endpoint protection data to be transferred to Acronis Cyber Platform using the CyberApp enablement form extension point.
- Mapping customers.Pairing ISV customers to Acronis tenants to be able to report the list of protected workloads to the correct tenant using the Custom integration setting extension point.
Reporting protected workloads and their statuses to the Devices list in Acronis Cyber Protection Console, using the Workloads and actions extension point.
Reporting alerts on detected threats and security issues to the Alerts list in Acronis Cyber Protection Console using the Alerts extension point.
Extended
To increase the value of the CyberApp for MSPs, it is recommended to enhance it with additional monitoring and management functionalities:
Create CyberApp-specific widgets to monitor endpoint protection status using the Widgets and reports extension point.
Provide the ability to configure tenant-level settings in Acronis Cyber Protection Console using the Main menu extension point.
Recommended extension points
To be able to extend Acronis Cyber Platform with endpoint security capabilities, the following extension points should be used.
CyberApp enablement form
Client ID and client secretRequired to authenticate in the ISV cloud and fetch the list of end customers.These settings enable the CyberApp for the Partner. Customers mappingA list of customers fetched from the ISV cloud that allows the specification of an existing customer mapping or the creation of a new corresponding customer mapping in Acronis Cyber Platform.Mapping an ISV customer to an Acronis customer results in enabling the CyberApp for the specific customer.
CyberApp configuration and mapping can be done only by the Acronis Partner. It cannot be done by end customers.
Workloads and actions
Workload name in ISV cloud.
Endpoint protection status.
Endpoint protection agent version and status.
Timestamp of last Malware definitions update.
Timestamp of last system scan.
Workload network parameters (IP address and MAC address).
Alerts
Threat name.
Action executed upon the threat detection.
MD5, SHA1, SHA256 checksums of the detected object.
File path.
File name.
Workload name.
Widgets and reports
An endpoint security CyberApp should create several widgets to report the endpoint protection state:
Pie-chart diagram with endpoint agents protection status.
Pie-chart diagram with malware definitions status.
List of 10 latest alerts generated by endpoint protection.
These widgets should be declared by the CyberApp. The widget data must be based only on alerts or workload attributes submitted by the CyberApp.
It is recommended to add CyberApp-specific widgets to the Overview dashboard in Acronis Cyber Protection Console and in the Detected Threats report. Additionally, the CyberApp can register a new custom report on endpoint protection with all the widgets created by the CyberApp.