Tripwire Jobs¶

Tripwire Jobs enable you to deploy custom Tripwires to selected assets without waiting for a NodeZero pentest to place them. Use a Job to extend early-threat detection to:

Your most important "crown-jewel" assets, even where there’s no known exploitable weakness.
Assets with lower-priority weaknesses.

Before You Begin¶

Make sure that:

Your organization has access to the Tripwires feature.
A NodeZero Runner is installed, online, and able to reach the assets you want to protect.
The Runner is not currently running a pentest or another Tripwire Job. Jobs do not queue behind other operations.
You have administrator-level credentials for the assets in scope.
The assets are Windows or Linux hosts, or supported network shares. (Tripwire Jobs do not currently support S3 buckets.)

Tripwire Jobs and EDR¶

Tripwire Jobs use the Runner and the existing NodeZero credential-injection and deployment mechanisms. Jobs might use the Remote Access Tool (RAT) where possible, and this can trigger EDR (Endpoint Detection and Response)) controls to prevent a deployment. Do not disable EDR solely to run a Tripwire Job – instead, follow your organization’s security procedures.

Open Tripwire Jobs¶

Sign in to the NodeZero Portal.
From the Portal's top navigation, open the Tripwires dashboard.
Near the bottom left, click Start Tripwire Job.

Configure a Tripwire Job¶

In the resulting multi-page Run a Tripwire Job UI, configure the following steps.

Set Tripwire Basics¶

Name your job, and select which types of Tripwires you want to drop.

The Windows Suspicious Process Monitor (WSPM) type is disabled by default, because it can generate noise when monitored processes run as part of normal operations. Enable it only for asset targets where those processes are not expected during normal activity.

Select a Runner¶

Choose an active Runner. This first configuration page shows Runners that have checked in recently and are available to run the job. You cannot select a Runner that is offline or busy with another operation.

Choose Assets¶

Click Choose Assets to open the asset selector page. Where possible, this page displays recommended Tripwire opportunities. These are generally assets discovered during previous NodeZero pentests that meet the requirements for one or more supported Tripwire deployments. These recommendations also foreground assets that the selected Runner is expected to reach.

You can:

Add or remove recommended assets.
Select or deselect all assets.
Click the filter button to find older assets, or to remove the Last Seen by Selected Runner filter entirely.
Add a custom asset that has not been included in a previous NodeZero pentest – for example, a crown-jewel host that you want to proactively protect. (Custom assets are limited to supported Windows and Linux targets.)

Add Credentials¶

Click Add Credentials to proceed to the Asset Credentials page. Here, you provide credentials to access the assets in scope. Use credentials with the privileges required to access each asset's host and to deploy the Tripwires you've selected. These vary by target type.

Windows assets use domain-level credentials. Add extra credential entries when more than one domain or credential set is needed. A Windows credential need not be explicitly mapped to a particular asset.
Linux assets generally require a credential for each host.
If this page groups an asset under an unknown operating system, then before running the Job, follow the credential instructions shown for that asset, and verify that the target is supported.

Credentials pass through the same injection path that other NodeZero operations use. By default, they are not stored. If you explicitly choose to save a credential for reuse, it is stored securely on the selected NodeZero host or Runner.

Review and Run¶

Click next to proceed to the Review Your Job Details page. Here, review the Runner, assets, and credentials you've selected. If necessary, click a pencil button to return to an earlier step to make changes. (You'll need to loop through subsequent configuration steps again.)

When everything looks correct, click Run Tripwires Job.

After the job starts, the Portal opens the Tripwire Jobs list. The Job details page is available while the job is still running.

Monitor a Job and Review Coverage¶

Open the job details page to see deployment progress. Refresh the page to monitor the number of Tripwires deployed and the assets covered.

A successful deployment means that a Tripwire was placed on the target asset. It does not mean that the asset was fully pentested or that the asset is free of weaknesses. A Tripwire Job is a focused deployment operation, not a replacement for a NodeZero pentest.

After deployment:

Use the Tripwire details page to review the individual Tripwire and its asset.
Click the Test Tripwire button to validate alert generation and delivery. (This test exercises Horizon3 infrastructure and does not create activity on the target asset.)
Treat a real Tripwire alert as an indicator of potentially unauthorized activity, and follow your incident-response process.

Troubleshooting Deployment Failures¶

A Tripwire might not deploy when:

The Runner cannot reach the target asset.
The supplied credential is invalid, or has insufficient administrative access.
A required remote-access service is unavailable.
EDR blocks the RAT or another deployment step.
The asset or Tripwire type is not supported.

Confirm that the Runner is online, that the target is reachable from that Runner, and that the supplied credentials have the required privileges. If the Job reports no coverage, check the selected assets and credential assignments before re-running the Job.

Limitations¶

Tripwire Jobs currently target supported Windows and Linux hosts and related shares; S3 buckets are not supported.
The selected Runner must remain online for the Job's duration.
A Runner cannot run a Tripwire Job concurrently with a pentest or another Tripwire Job.
Tripwire deployment might be blocked by EDR and network controls.