{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45290,"path":"security-management/spc-controls-policies-for-edr.md","title":"Mitigation controls and policies required for Exploit Protection \\(EDR\\) mitigation controls","bundle":null,"doc_type":null,"release":"australia","body":"\n# Mitigation controls and policies required for Exploit Protection \\(EDR\\) mitigation controls\n\nThis category of mitigation controls covers mitigations available on your assets in the form of endpoint protection agent configuration. This applies to endpoint protection agents such as CrowdStrike and SentinelOne.\n\nExploit mitigation settings such as ‘Force Address Space Layout Randomization’ and ‘Force DEP’ can be enabled in endpoint protection tools like CrowdStrike. SPC automatically detects this configuration on devices with the help of the policies included with the application and the API integration with endpoint protection tools.\n\nRoles required: SPC Admin Group and SPC Analyst Group.\n\n## Prerequisites for CrowdStrike Exploit Protection \\(EDR\\) mitigation control detection\n\n1.  Verify that you have activated the CrowdStrike Service Graph Connector. This application is available in the ServiceNow Store. The installation and configuration information is included on the app listing. See [Install and configure the CrowdStrike integrations for mitigation controls monitoring](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/spc-install-config-controls.md) for more information.\n2.  Verify that the CrowdStrike API integration is activated in the Security Posture Control Workspace.\n\n## Prerequisites for Microsoft Exploit Protection \\(EDR\\) mitigation control detection\n\nMicrosoft SCCM credentials that include the Script Authors role. The Script Authors role provides required permissions to create a script that is required to import mitigation information on the SCCM server.\n\nYou must activate the SCCM integration to identify mitigation controls configured in Microsoft Defender.\n\nSee [Install and configure the Service Graph Connector for Microsoft SCCM and the Microsoft Defender Mitigation Control Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/spc-install-config-sccm-defender.md) for more information.\n\n-   Defender – Exploit Mitigation – CFG\n\n    Microsoft Defender Control Flow Guard.\n\n-   Defender – Exploit Mitigation – DEP\n\n    Microsoft Defender Data Execution Prevention.\n\n-   Defender – Exploit Mitigation – Mandatory ASLR and Bottom-Up ASLR\n\n    Microsoft Defender force ASLR.\n\n-   MITRE tactics addressed: Initial Access, Execution, Credential Access, Defense Evasion, Privilege Escalation, Lateral Movement.\n\n1.  Verify that you have activated the SentinelOne Service Graph Connector.\n\n    This application is available in the ServiceNow Store. The installation and configuration information is included on the app listing. See [Install and configure the Service Graph Connector for SentinelOne and the SentinelOne Mitigation Control Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/spc-install-config-sentinelone-mc.md) for more information.\n\n2.  Verify that the SentinelOne API integration is activated in the Security Posture Control Workspace.\n\n"}}