Endpoint and Server Security: Part 3, Discovery Through Response

Endpoint and Server Security at GEN: Discovery Through Response

Strengthening the first and last line of defense in any organization starts with understanding how endpoints and servers behave on the network. This article walks through a realistic scenario inside GEN, a loan company building out its cybersecurity practice. Along the way we combine network scanning, vulnerability analysis, prioritization, and lightweight monitoring so you can replicate the same workflow in your own lab.

Learning Goals

By the end of this walkthrough you should be able to:

• Explain why active discovery complements endpoint detection and response (EDR/XDR) tooling.
• Use Nmap to confirm device presence and gather service information.
• Interpret vulnerability findings, map them to CVEs, and order remediation with CVSS.
• Stand up minimal monitoring that raises alerts when critical assets misbehave.
• Outline a short incident playbook that turns raw alerts into decisive action.

Setting the Stage

Inside GEN's cybersecurity department, we previously used Trend Micro Vision One to highlight several risky assets. That insight now becomes the foundation for broader visibility. For continuity we focus on the three devices that scored highest in Module 2:

Treat these entries as examples. Swap in your own lab addresses or the dataset from class if you are following along.

Discovering Devices on the Network

Before diving into vulnerabilities, confirm that the targets respond on the wire. A simple ping sweep does the job:

nmap -sn 192.168.1.0/24

The -sn flag tells Nmap to use host discovery without port scanning, and the /24 indicates the subnet range. Collecting the output in a quick reference table makes it easier to spot changes later:

Because all three hosts reply, we can proceed confidently with deeper inspection.

Inspecting services and hunting vulnerabilities

Service detection (-sV) extends the discovery phase by reporting the software stack exposed on each device. Pair it with Nmap's vulnerability scripts for richer context:

nmap -sV 192.168.1.45
nmap --script vuln 192.168.1.45

Repeat the commands for every device to build a clear picture. Below are representative highlights you might encounter:

Endpoint-001: 192.168.1.45

The scan answers with SMBv1 (Microsoft Windows 7 SMBv1). That protocol is still open to EternalBlue (MS17-010), a wormable exploit tied to several ransomware outbreaks. Trend Micro had already flagged CVE-2017-0144 at a CVSS of 8.1 back in module 2, and Nmap now reconfirms the same risk from the network side.

Server-WEB01: 192.168.1.100

This host runs Apache 2.4.29 on Ubuntu. The vulnerability scripts point at CVE-2021-34798, a mod_http2 denial-of-service flaw that crafted HTTP/2 requests can trigger. XDR telemetry named the same CVE in module 2, which confirms the public-facing front end needs attention.

Server-DB02: 192.168.1.103

PostgreSQL 9.5.3 answers here. Under specific conditions CVE-2016-2193 allows privilege escalation, which raises the risk of lateral movement inside the LAN. The database was already marked as outdated in module 2; now we know exactly how an attacker would capitalize on it.

Prioritizing with CVSS and Context

CVSS scores provide a structured baseline, but ordering remediation also requires business awareness. Combining both angles yields the following stack rank:

Aim to patch Endpoint-001 immediately, schedule downtime for Server-WEB01, and plan an upgrade path for Server-DB02. Documenting the reasoning alongside the scores helps leadership understand the remediation roadmap.

Adding lightweight monitoring

Vulnerability data is most valuable when paired with visibility into day-to-day health. PRTG Hosted Monitor offers an approachable starting point:

1. Create a GEN group with Servers and Endpoints subgroups.
2. Attach Ping and Uptime sensors to Server-WEB01. For Endpoint-001 add CPU Load and Disk Usage as well, so stress shows up before an outage does.
3. Set a ping latency threshold, say 200 ms, and route notifications to security@gen.local or your SOC queue.
4. Simulate packet loss or restart a service to confirm the alert actually fires. Capture a screenshot or log entry as evidence for change control.

No lab access? Describe the configuration steps and reference provided screenshots. The key lesson is that even basic telemetry shortens the time between an outage and the first human response.

From alert to action: a mini playbook

Monitoring without a plan can flood teams with noise. Build a concise sequence that operators can follow when an alert (such as high latency on Endpoint-001) appears:

These steps complement GEN's XDR platform by adding human decision points, operational accountability, and coverage for assets that might not run an EDR agent.

Key Takeaways

• Active scanning validates and enriches insights from XDR solutions, revealing how exposed services actually behave.
• CVSS provides a numerical anchor, but contextual business impact ensures resources flow to the most dangerous issues first.
• Lightweight monitoring plus a simple response playbook turns raw vulnerability data into a repeatable security discipline.

By rehearsing this workflow in a lab, you build muscle memory that transfers directly into production environments, whether you secure a small IT fleet or a sprawling enterprise like GEN. The article shows how GEN's security team combines discovery, prioritization, monitoring, and response playbooks to strengthen endpoint and server defenses.

Student: Krivoshchekov Artem
Organization: GEN Cybersecurity Dept
Module: Network & Vulnerability Analysis
Date: 30/09/2025