Endpoint Protection Cloud - service and update points for monitoring

[JonNorth]

Hi all

 

I am looking to build an interrogation script for Endpoint Protection Cloud for an RMM product, to alert if the service(s)/process(es) is/aren't running, and if it's failed to update in x days. To that end I just need two simple questions answered please:

 

• What processes and/or services need to be running in order for the agent to be running correctly?
• Where is the date of the signature file stored?

 

I think the answer to the first question is “C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe and/or C:\Program Files\Malwarebytes Endpoint Agent\MBCloudEA.exe” and I think the answer to the second question is “the db_pub_date value (in Epoch time) from C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json” –can anyone please confirm, or not, that I’m in the right places here, and which of those services is the critical one, or if they both are?

Hope you guys can help!

Many thanks
Jon

[djacobson]

Malwarebytes Endpoint Agent, MBEndpointAgent, "C:\Program Files\Malwarebytes Endpoint Agent\MBCloudEA.exe", is your communication service to your cloud portal.
Malwarebytes Service, MBAMService, "C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe", is your protection software.
They are both vital.

"C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json" is the correct place to get your database package version and date, but also your controller and program versions. 

 

[JonNorth]

thanks Dyllon ... as far as i can tell "C:\Program Files\Malwarebytes Endpoint Agent\MBCloudEA.exe" is for the endpoint cloud protection and "C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe" is for MBAM right? if i remove MBAM the "C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe" will be deleted leaving "C:\Program Files\Malwarebytes Endpoint Agent\MBCloudEA.exe" running successfully and independently for the AV, yes?

 

Cheers

 

[djacobson]

MBAMservice is all your protection items, the scan engine, the realtime for malicious file, web, ransomware and exploit. If it is removed, MBCloudEA will have nothing to control.

[JonNorth]

so it's installed as part of the AV install then? i thought it was a separate (consumer level) product?

[djacobson]

The MBEP business version's protection software is based on the consumer MB3 technology, but highly modified to be controlled by your cloud portal.

[JonNorth]

brilliant thanks dyllon, exactly what i was after. so i need both services and that epoch value. thanks again chap!