Malwarebytes Breach Remediation for HCL BigFix integration guide

IBM BigFix was acquired by HCL Technologies, Ltd. and is now named HCL BigFix. Some of the screenshots in this article may display the previous company logo.

Introduction

Malwarebytes Breach Remediation is a portable command-line product, designed to detect and remove malicious software from endpoints. Malwarebytes Breach Remediation requires no installation on the endpoints, simply distribute the files to the endpoints and execute the program.

For more information, please see the Malwarebytes Breach Remediation Windows Administrator Guide.

Features

Malwarebytes Breach Remediation for HCL BigFix provides the following features:

• BigFix Fixlet to download and execute scans on managed endpoints
• BigFix Analysis to return scan results to the BigFix Server
• Custom Web Reports to display the results

Prerequisites

In order to use Malwarebytes Breach Remediation for HCL BigFix, the following is required:

• HCL BigFix platform 9.x and later, including Web Reports
• Malwarebytes Nebula subscription to one of the following products:
  • Malwarebytes Incident Response
  • Malwarebytes Endpoint Protection
  • Malwarebytes Endpoint Detection and Response
• Your Malwarebytes Nebula product license key

Installation

Follow these steps to import the Malwarebytes Breach Remediation content into the BigFix platform.

Download the Malwarebytes Breach Remediation for HCL BigFix zip file

1. Download the Malwarebytes Breach Remediation for HCL BigFix file here.
2. Unzip the file malwarebytes_bigfix.zip. The files contained in the zip file are:
   • mwb_fixlets.bes - Contains both the task and analysis.
   • mwb_mbbr.beswrpt - Contains the custom web reports.

Create a custom BigFix site

It is a good practice and recommended to create a custom site to host the imported Malwarebytes content. Future content can be imported later into this same custom site.

1. Log in to BigFix.
2. Create a custom site. Go to Tools > Create Custom Site…
   
3. Name the custom site Malwarebytes.
   

Import the Fixlet

1. Double-click on the file mwb_fixlets.bes to import the Fixlet into BigFix.
2. Ensure both the task and analysis are created in the new custom site.
   
3. Both items are available from the BigFix Console.
   

Import custom Web Reports

1. Log into Web Reports and select Report List > Import report
   
2. Import the file mwb_mbbr.beswrpt as XML.
   
3. After performing threat scans, the Web Reports screen displays the results.
   

Enter your Malwarebytes Nebula license key in BigFix

To view your Malwarebytes Nebula license key:

1. Login to the Malwarebytes Nebula platform.
2. Go to Profile > License Information.
3. Copy your license key.
4. Open BigFix and navigate to your custom site, All Content > Sites > Malwarebytes.
5. Click Fixlets and Tasks.
6. On the Description tab, paste or enter your license key in the License Key field.

Copy the Malwarebytes Breach Remediation task to adjust options

Malwarebytes Breach Remediation provides many options and features. In order to fine-tune Malwarebytes Breach Remediation for HCL BigFix for your environment, we suggest the following:

1. Make a copy of the initial BigFix task.
2. Use the copy to fine-tune how the task works:
   
   • In the copied task, edit the BigFix action script.
   • Customize the command line options for Malwarebytes Breach Remediation.
3. Refer to the Malwarebytes Breach Remediation Windows Administrator Guide for details and more information.