How do I set up endpoint detection and response for network monitoring in an air-gapped defense environment?

Setting up EDR for network monitoring in an air-gapped defense environment is mostly an architecture and operations problem: you need strong endpoint telemetry, centralized collection, secure offline update paths, and a way to review alerts without depending on external connectivity.

Here’s a practical, defense-oriented approach.

1) Define the air-gapped EDR architecture

In an isolated environment, EDR usually has these layers:

• Endpoints / sensors on workstations, servers, jump hosts, and critical enclaves
• Local log collectors / aggregation servers inside the enclave
• A central management server or SIEM inside the air gap
• Offline update repository for signatures, rules, and agent packages
• Analyst workstation / SOC console inside the same enclave or a tightly controlled admin zone

For network monitoring specifically, add:

• Network sensors such as TAP/SPAN-connected collectors, NDR sensors, or flow collectors
• Correlation between endpoint telemetry and network telemetry

2) Choose EDR tools that support offline operation

Look for products or open-source stacks that can:

• Run fully without cloud dependency
• Accept offline license activation
• Support manual or staged updates
• Export logs to local SIEM
• Use local policy management
• Integrate with packet capture, netflow, DNS, proxy, and firewall logs

Common capabilities to prioritize:

• Process creation, parent/child trees
• Network connection telemetry
• File write/modify events
• Registry changes, service creation, autoruns
• Script block logging or command-line auditing
• Detection rule support
• Containment actions that work locally

If you’re building with open-source components, a common pattern is:

• Endpoint agent: Sysmon-like telemetry plus an EDR agent or audit framework
• Collection: Wazuh/OSSEC, Fleet/Osquery, Zeek, Suricata, or similar
• Correlation: SIEM such as Splunk, Elastic, or a local security data lake

3) Design the network monitoring layer

EDR alone won’t give you full network visibility. In a defense enclave, pair endpoint telemetry with:

• Zeek for network metadata and protocol analysis
• Suricata/Snort for IDS signatures
• NetFlow/IPFIX from switches/routers
• DNS logging
• Firewall/proxy logs
• Packet capture at choke points if storage allows

Best practice:

• Place sensors at egress points, inter-enclave boundaries, and critical server segments
• Ensure time synchronization via internal NTP
• Use asset identity mapping so an endpoint event can be tied to a host, VLAN, subnet, and function

4) Build a secure offline update process

Because there is no internet:

• Maintain an update staging system outside the air gap
• Vet updates on a test enclave
• Transfer via approved removable media or a one-way transfer mechanism, if permitted
• Digitally sign and verify all packages
• Keep version control and a rollback plan

Update items:

• EDR agent packages
• Detection rules
• IOC feeds
• Allowlists
• Certificates and trust bundles
• Sensor signatures and protocol parsers

Operationally, treat update media as highly sensitive:

• Malware scan before import
• Cryptographic hash verification
• Two-person integrity for critical changes, if required by policy

5) Set up endpoint telemetry collection

At minimum, collect:

• Process start/stop with full command line
• Network connections per process
• Parent/child process lineage
• DLL/module loads if supported
• Scheduled tasks, services, drivers
• Persistence artifacts
• Account logons and privilege use
• File changes in key paths
• PowerShell, bash, or script interpreter logging
• USB/removable media usage

For Windows-heavy environments, common telemetry sources include:

• Sysmon
• Windows Event Forwarding
• PowerShell logging
• Defender/AV events if available locally
• EDR agent logs

For Linux:

• auditd
• syslog/journald
• osquery
• EDR agent telemetry

For macOS or specialized appliances:

• Vendor-specific logging and endpoint agent support

6) Correlate endpoint and network events

This is the core of “network monitoring” with EDR in an air gap.

Useful correlations:

• A process launching followed by a new outbound connection
• DNS queries from a host immediately before C2-like traffic
• Repeated connections to unusual internal ports
• Lateral movement indicators: SMB, RDP, WinRM, SSH, WMI, PsExec patterns
• Endpoint file drop plus network beaconing
• Authentication failures followed by service creation and internal scanning

Create rules such as:

• Rare process + outbound connection to nonstandard port
• New service creation + remote admin protocol usage
• Script interpreter + external-looking DNS pattern
• Multiple hosts contacting the same internal destination in a short window

7) Establish baselines before tuning alerts

In air-gapped defense networks, normal traffic can be highly specialized. Build baselines for:

• Approved protocols
• Normal east-west traffic
• Scheduled update windows
• Known admin tools
• Mission-specific applications
• Typical host-to-host communication

Then tune:

• Whitelist expected management activity
• Reduce alert noise from scans and monitoring tools
• Flag deviations by host role, not just globally

8) Secure the management plane

The EDR management server is a high-value target.

Hardening steps:

• Place it on a restricted admin network
• Use MFA if possible
• Restrict console access by role
• Separate analyst, administrator, and update roles
• Enable strong audit logging
• Back up configs and detections offline
• Limit who can push response actions such as isolate host or kill process

If the solution supports it:

• Use read-only review accounts for most analysts
• Require approval for endpoint isolation or quarantine actions

9) Prepare for containment in an air gap

Containment should not rely on cloud services.

Make sure you can:

• Isolate a host from the internal network
• Kill suspicious processes
• Quarantine files locally
• Disable persistence mechanisms
• Collect triage packages
• Preserve forensic evidence before cleanup

Have a playbook for:

• Suspected malware
• Insider threat
• Compromised admin account
• Lateral movement
• Rogue device connection
• Sensor compromise

10) Implement logging retention and storage planning

Air-gapped environments often underestimate storage needs.

Plan for:

• High-volume endpoint telemetry
• Network metadata
• Full packet capture, if used selectively
• Long retention for investigations and compliance

Use tiered storage:

• Hot storage for recent alerts
• Warm storage for searchable history
• Cold archive for long-term retention

Make sure backups are:

• Offline or immutable
• Encrypted
• Periodically tested for restore

11) Test detections safely

Use controlled validation:

• Benign test tools and scripts
• Atomic-style tests adapted to your environment
• Red-team or purple-team exercises under approved conditions

Validate:

• Sensor coverage
• Alert fidelity
• Event timestamps
• Correlation quality
• Response workflows

12) Operate with strict change control

In defense networks, detection rules and agents should be treated like mission-critical software:

• Maintain change requests
• Version all policies
• Test in a staging enclave first
• Document exceptions and allowlists
• Review rule drift regularly

---

A simple reference deployment

A common air-gapped setup might look like this:

• Endpoints: EDR agents + Sysmon/audit logging
• Network: Zeek + Suricata at core choke points
• Collection: Local log forwarder or message bus
• SIEM: On-prem Elastic/Splunk/Sentinel-like internal deployment
• Admin zone: Management console, update repository, analysts
• Offline update workflow: Staging lab -> signed package -> transfer media -> production enclave
• IR workflow: Alert -> correlate endpoint + network -> triage -> isolate -> collect evidence -> remediate

---

Key pitfalls to avoid

• Depending on cloud-managed EDR features that won’t work offline
• Ignoring network sensors and relying only on endpoint events
• Poor time synchronization
• No baseline, leading to alert fatigue
• Uncontrolled updates from removable media
• Over-privileged analysts
• No tested containment workflow

If you want, I can also provide:

1. a vendor-neutral architecture diagram,
2. a Windows-only or Linux-only deployment checklist, or
3. a sample telemetry and alert rule set for an air-gapped enclave.