This document describes an EDR (Endpoint Detection and Response) system implementation project for Invinsense. The system was developed using technologies like React JS, C language, Python REST API, Docker, Kubernetes, and deployed on both Windows and Linux agents. It provides features like agent monitoring, antivirus scanning, log collection and analysis. Screenshots show interfaces for login, agent details, scanning, dashboards, reports. Future enhancements proposed include SSO, AI/ML, Mac OS agent, Ansible deployment.

1. MCA (Master of Computer Application)
Department Faculty of Management & Information
Sciences Dharmsinh Desai University, Nadiad
Internal Guide
Dr. Narayan Joshi
Professor & Head,
Department of MCA,
Dharmsinh Desai University,
Nadiad.
External Guide
Mr. Sunny Rajwadi
Head Technology,
Infopercept Consulting Pvt Ltd,
Ahmedabad.
Presented by
• Panchal Anuj Shantibhai
[MA032]
• Parekh Smit Nitinkumar [MA034]
• Tank Sandip Pravinbhai [MA050]
EDR (Endpoint Detection And Response)
Implementation in Invinsense

2. Agenda
✔Project Definition
✔Challenges
✔Project Profile
✔Functionalities/Features
✔System Design
✔Screenshots of the System
✔System Reports
✔Future Enhancement
✔Bibliography
2

3. Project Definition
EDR is the asset tracking module
for the management, monitor IT
organization assets like system
Server. Whenever security threats
found, agent send alerts to the
administrator and administrator
also keep remotely monitoring
their assets.
3

4. Challenges
✔ Understanding client and server communication on the private network using C language.
✔ Understanding secured communication between client and server.
✔ Create custom active-response in EDR.
✔ Decoding different type of logs with different OS.
✔ Graph generation.
✔ Real-time dashboard.
✔ Scalability.
4

5. Project Profile
Project Title EDR Implementation in Invinsense
Aim of Project EDR (Endpoint Detection and Response)
Front End React JS
Back End C Language, Python REST API
Tools CLION, Docker, Kubernetes
Methodology OOAD
Database EDR Indexer
Internal Guide Dr. Narayan Joshi
External Guide Mr. Sunny Rajwadi
Developed By Panchal Anuj Shantibhai [MA032]
Parekh Smit Nitinkumar [MA034]
Tank Sandip Pravinbhai [MA050]
Duration 6th December 2022 to 12th April 2023
5

6. Hardware/Software Requirements
For Development
EDR server requirements
✔ Hardware requirements:
• Operating system: Ubuntu 22.04 or other
Linux base system/Windows System
• CPU: 8 cores minimum
• RAM: 8 GB minimum
• Storage: 50 GB minimum
✔ Software requirements:
• Vs Code, Python 3.8 or Above
EDR agent requirements
✔ Hardware requirements:
• Operating system: Windows and Linux
• CPU: 4 core
• RAM: 8 GB RAM
• Storage: 25 GB HDD
✔ Software requirements:
• CLion
• GCC (For Linux)/Mingw (For Windows)
6

7. Hardware/Software Requirements
For Deployment
EDR server requirements
✔ Hardware requirements:
• Operating system: Ubuntu 20.04 or other Linux
base system
• CPU: 2 cores minimum
• RAM: 4 GB minimum (8 GB recommended)
• Storage: 20 GB minimum (SSD recommended)
✔ Software requirements: Java 11 or later
EDR agent requirements
✔ Hardware requirements:
• Operating system: Windows and Linux
• CPU: 1 core
• RAM: 256 MB minimum
• Storage: 100 MB minimum
✔ Software requirements:
• For windows: .NET Framework 4.5 or later
• For linux: Python 2.7 or later
7

8. Functionalities/Features
• EDR plugin :
✔ Login
✔ Agent information
✔ OS information
✔ Network information
✔ Application information
✔ Hardware / Software information
✔ On-demand antivirus scan and generate alert on
dashboard
✔ Add new agent (For linux and windows both)
✔ View system logs
✔ Deployment
✔ EDR deployment in docker
✔ EDR deployment in kubernetes
8

9. System Design
✔ Use case diagram
✔ EDR system
✔ Monitor auditing and policy usecase
✔ K8s deployment usecase
✔ Activity diagram
✔ On-demand antivirus scan process
✔ Sequence diagram
✔ Login
✔ View all agent details
✔ Change password
✔ Add new agent
✔ View system log
✔ View system inventory data
✔ Remove agent
✔ Search and filter agent
✔ On-demand antivirus scan
✔ Visualize security events and logs
✔ Analyze vulnerabilities
9

10. EDR Agent on Windows Manage Agent
Screenshots
10

11. Dashboard
Login Page
11

12. Antivirus Scan Screen
12

13. EDR Server Communication
13

14. EDR Server
14

15. Add New Agent
EDR Agent Information
15

16. Log Information
16

17. Chart Generation
17

18. Security Events
18

19. Log Data Analysis
19

20. Regulatory-Compliance Dashboard
20

21. System Reports
21

22. Kubernetes Workspace
Login Page
22

23. Application Pods
Cluster Usage
23

24. Future Enhancement
✔ SSO implementation with KeyCloak.
✔ Implementation of AI and ML.
✔ Agent Implementation for Mac OS.
✔ Deployment of EDR using Ansible.
Bibliography
✔ Docker:
o https://docs.docker.com/
o https://docs.docker.com/get-started/
o https://docs.docker.com/get-docker/
o https://docs.docker.com/get-started/overview/
o https://docs.docker.com/desktop/
✔ Kubernetes:
o https://kubernetes.io/docs/home/
o https://kubernetes.io/training/
o https://www.edx.org/course/introduction-to-
kubernetes
✔ React JS:
o https://react.dev/learn
o https://react.dev/reference/react
o https://react.dev/community
✔ Python REST API:
o https://documentation.wazuh.com/current/user-
manual/api/examples.html
24

25. Thank you
25