Creating Target Groups, adding Agents, and Queries

ALERT  LEGACY ARTICLE: The content in this article is no longer updated and is available for reference purposes only. Features and workflows described may be deprecated, significantly changed, or no longer supported.

Environment

  • Datto EDR

Description

Target Groups

Target Groups are groupings of endpoints or IP ranges. Data collected during the scan is always associated with a target group for analysis and reporting. Target groups assist you and your team in logically dividing your network by location, function, asset type, or any other logical division.  Additionally, Target Groups allow for Real-Time Security Monitoring and Scheduled deep scans.

Devices are added to a Target Group by either creating a Query and Enumerating to discover devices, or by adding specific installed agents to the Target Group.

To create your first target group, navigate to the Discover Tab, select œAdd New Target Group € and provide a descriptive name.

Add_TG_button.png

Pro-Tip: Target groups can contain machines discovered by both Agent and Agentless methodologies.

Adding Agents to a Target Group

Agents can be enabled and assigned to Target Groups at the time of Agent Installation with an Agent Registration Key, or can be enabled and assigned manually after installation.

Agent Registration key

Host / Agent association with a default Target Group will happen automatically if an Agent Registration Key is generated and used during the installation of an Agent (See the Agent Installation Article).

1. Create a €œRegistration Key € to install agents by clicking “Add New Registration Key€ within the Agent Registration admin panel.

2. Assign the  Registration Key  to the desired Target Group.

3. Utilize the Registration Key  during the installation process.

Agents installed with a Registration Key will automatically be approved and added to the default target group selected.

agentregistration.png

Manually adding agents to target groups

To add agents to a designated Target Group navigate to the profile icon in the top right corner, select Admin, and navigate to Agents on the left navigation pane. If you have not previously enabled the Agent, click on the ellipses to the right of the Agent and select Enable.

Once the desired Agents are enabled, select one or more Agents to add to a Target Group and click the Add To Target Group button in the right corner.

Add_TG_button.png

then select the desired Target Group and click Save.

Select_Target_Group.png

Queries (Agentless)

Asset Discovery is a necessary step for agentless scanning and is supported by defining Queries which can be a list of hostnames, IP Addresses, IP Ranges, CIDR Blocks or AD/LDAP domains.

These queries dictate membership into Target Groups anytime the agentless architecture is used.

Prerequisites

  1. Domain or Local Admin Credentials configured and input for use in Datto EDR.
     Search œCredential Manager € for more information.
  2. An existing Target Group.

Creating a query

  1. Under the Discover tab select the Target Group for the new Query.
  2. Click the Add Query Button
    Add_Querry_Button.png
  1. Provide a Friendly Name for the Query (utilized to identify the query during enumeration tasks).
  2. Select the Credentials for the Query to use.
  3. Select SSH Credentials if Applicable.
  4. Select a query type, or alternatively leave the type set to Auto Detect.
    Proper format is needed to utilize the Auto Detect option.
    CIDR [XXX.XXX.XXX.XXX/(bit)]
    IP Scope [XXX.XXX.XXX.XXX - XXX.XXX.XXX.XXX]
    Domain [ldap://FQDN]
    Hostname [FQDN]
    IP Address [XXX.XXX.XXX.XXX]
    Pro-Tip:  An alternate method of copy and pasting in the above formats can be accomplished via the Raw Data Option.
  5. Save the QueryNew_Query_Screenshot.png
  6. Once you have saved a query, you can enumerate the query to find all of the devices specific to it. You do so by clicking the Find Host button. This step may take a good amount of time depending on the size of the query.