With the BlueApp for LevelBlue Forensics and Response, USM Anywhere can execute system-level functions instantly — through a user-executed or an automated rule or job — to coordinate forensics and response in a single action. Rather than manually connecting to each host and executing system-level tasks for investigation and protection purposes, you can use the BlueApp for LevelBlue Forensics and Response actions to gather forensic information or make system changes on assets monitored in USM Anywhere.
Important: Running the BlueApp for LevelBlue Forensics and Response actions requires that the target assets have assigned credentials that are suitable for administrative access to the host. See Configuring the BlueApp for LevelBlue Forensics and Response for more information.

​
Supported Actions

Each action that you run executes one or more functions on the host system for the target asset. Some of these functions collect system data and some perform enforcement operations. You can run an action manually from an event or alarm, or you can run an action from the BlueApp for LevelBlue Forensics and Response page for a specified asset. To automate these actions, you can schedule jobs to run an action for a specified asset, or you can create a response action rule to trigger an action from future events or alarms that meet your specified criteria. See Data Collection Functions and Enforcement System Functions for detailed information about the functions supported by the BlueApp for LevelBlue Forensics and Response actions.

​
Forensic Profile Actions

The BlueApp for LevelBlue Forensics and Response provides multiple actions that you can use to perform an investigation of the target system, by running a group of data collection functions. Each of these actions is designed to provide a level of forensic profile for the target asset:
USM Anywhere then generates an event for each executed function included in the forensic profile. See Viewing Forensics and Response Events and Alarms for more information about accessing these events.

​
Single Function Actions

For many of the most common functions, the BlueApp for LevelBlue Forensics and Response also provides actions to launch a simple execution of that function. The table below describes what each action does:
ActionDescriptionAvailability
Disable NetworkingExecutes the Disable Networking enforcement function on the interfaces currently connected to the selected asset.BlueApp for LevelBlue Forensics and Response page

Event or Alarm

Scheduled Job

Orchestration Rule
Get Active Directory InformationExecutes the Get Assets data collection function.Scheduled Job
Get Established ConnectionsExecutes the Get Established Connections data collection function. This displays information like the TCP State and Address Family. See the Microsoft documentation for more explanation on log fields.BlueApp for LevelBlue Forensics and Response page

Event or Alarm

Scheduled Job

Orchestration Rule
Get UsersExecutes the Get Users data collection function.BlueApp for LevelBlue Forensics and Response page

Event or Alarm

Scheduled Job

Orchestration Rule
Get Logged On UsersExecutes the Get Logged On Users data collection function.BlueApp for LevelBlue Forensics and Response page

Event or Alarm

Scheduled Job

Orchestration Rule
Get Processes with HashesExecutes the Get Processes with Hashes data collection function.BlueApp for LevelBlue Forensics and Response page

Event or Alarm

Scheduled Job

Orchestration Rule
Get Running ServicesExecutes the Get Running Services data collection function.BlueApp for LevelBlue Forensics and Response page

Event or Alarm

Scheduled Job

Orchestration Rule
Get System InfoExecutes the Get System Info data collection function.BlueApp for LevelBlue Forensics and Response page

Event or Alarm

Scheduled Job

Orchestration Rule
ShutdownExecutes the Shutdown enforcement function.BlueApp for LevelBlue Forensics and Response page

Event or Alarm

Scheduled Job

Orchestration Rule
Set Registry Key to StringExecutes the Set Registry Key to String enforcement function.BlueApp for LevelBlue Forensics and Response page

Event or Alarm

Orchestration Rule
Set Registry Key to DWORDExecutes the Set Registry Key to DWORD enforcement function.BlueApp for LevelBlue Forensics and Response page

Event or Alarm

Orchestration Rule
Launch QueryExecutes the specified data collection or enforcement function



See Defining a Launch Query Action for more information regarding app actions.		BlueApp for LevelBlue Forensics and Response page

Event or Alarm

Scheduled Job

Orchestration Rule

​
Launch Actions from USM Anywhere

The BlueApp for LevelBlue Forensics and Response page provides an easy way to manually run a single Forensics and Response action. However, if it is an action that you want to run regularly for a specific asset, you should define a scheduled job to run the action. If you want to run the action as a response to certain events or alarms, you should define an orchestration rule. To run an action in the BlueApp for LevelBlue Forensics and Response
  1. In USM Anywhere, go to Data Sources > BlueApps.
  2. Click the Available Apps tab.
  3. Search for the BlueApp, and then click the tile.
  4. Click the Actions tab.
  5. Review the list of actions to determine which action you want to run. Additional fields will be populated based on the action you’ve selected. Fill out the necessary fields for the app action. See Data Collection Functions and Enforcement System Functions topics for detailed information about each of the supported functions. If the needed function does not have a specific action, you can use the generic Launch Query action to specify the function parameters.
  6. Next to the action that you want to use, click Run.
    This opens the Select Action dialog box.
  7. If needed, select the sensor on which the BlueApp is enabled to display more options.
  8. Specify the asset that you want to use as a target for the action. You can enter the name or IP address of the asset in the field to display matching items that you can select. Or you can click Browse Assets to open the Select Asset dialog box and browse the asset list to make your selection.
  9. Click Run. USM Anywhere generates an event for each executed function. See Viewing Forensics and Response Events and Alarms for more information about accessing these events.
USM Anywhere will generate an event for each executed function included in this action’s forensic profile.