D3-EHB Endpoint Health Beacon: Using Agent Heartbeats to Spot Silenced Endpoints

An endpoint whose security agent goes quiet is either switched off or being hidden, and most organisations cannot tell which without a deliberate heartbeat check. MITRE D3FEND names this countermeasure Endpoint Health Beacon (D3-EHB), with the synonym Endpoint Health Telemetry, and defines it as "Monitoring the security status of an endpoint by sending periodic messages with health status, where absence of a response may indicate that the endpoint has been compromised." It belongs to the Detect tactic as a child of Operating System Monitoring (D3-OSM) and monitors the Network Node artefact. This card explains what a health beacon should carry, the ATT&CK techniques D3FEND infers a link to, where beacons already exist in common tooling, how to turn missing heartbeats into a reliable alert, and how attackers get around it. It is for SOC leads, endpoint engineers and detection engineers who already run EDR or log agents.

Key takeaways

• Silence is the signal. D3-EHB works by noticing what stops arriving: a missed heartbeat from a host that should be online is a lead worth triage.
• Content matters as much as timing. D3FEND's description says the heartbeat can carry software versions, configuration and endpoint identity; its reference patent adds security software status and key store integrity checks.
• Most estates already have beacons. EDR sensors, log shippers and management agents all check in. The work is correlating their states and alerting on the gaps, not deploying something new.
• Absence is ambiguous. D3FEND warns that a missing heartbeat may just mean the device is off or disconnected, so correlate with other sources before declaring compromise.
• A heartbeat can be faked. D3FEND notes an attacker may keep the heartbeat intact or learn its format and replay it, so beacons need integrity protection and cross-checks against other telemetry.

D3-EHB at a glance

How it works

D3FEND describes endpoints configured to periodically generate and transmit a secure heartbeat on a set schedule, carrying status information. A receiver tracks the expected schedule, and an interruption of the heartbeat can signal compromise. The Sophos patent D3FEND cites describes a health monitor on the endpoint that only issues a heartbeat while the endpoint is in a satisfactory state, based on checks such as:

• the status of individual software items running on the endpoint;
• whether antivirus and other security software is up to date and running correctly;
• the integrity of cryptographic key stores;
• other hardware or software components relevant to health.

The patent places the receiving monitor at a gateway, which means the beacon can also drive a network decision: an endpoint that stops reporting healthy can be treated differently by the network. That links D3-EHB to posture-based access control, covered in the Network Access Control (NAC) Guide and Device Trust and Posture Guide.

In practice there are two detection modes. Loss detection alerts when an expected heartbeat stops. Content detection alerts when the heartbeat arrives but reports a degraded state, such as a stopped protection component, an old signature set or a changed configuration. Content detection is usually faster and less ambiguous, because a host that is online but reporting "protection off" cannot be explained by a laptop lid being closed.

Where identity fits

A heartbeat is only as trustworthy as the identity that signs it. Agents authenticate to their management service with enrolment tokens, API keys or device certificates, which are machine credentials. Elastic's Fleet documentation, for example, notes that an offline agent's API keys remain valid. If an attacker copies an agent's credential, they can send convincing heartbeats from elsewhere while the real host is silenced, the exact bypass D3FEND describes. Store agent credentials in protected locations, rotate enrolment tokens, and alert when one agent identity checks in from two network locations. The NHI Dormancy Detection guide covers the reverse problem of credentials that stay valid after their host is gone.

ATT&CK techniques D3FEND relates to D3-EHB

D3FEND lists no hand-made ATT&CK mapping for D3-EHB. The rows below are inferred: D3-EHB monitors Network Node, and these techniques are modelled in D3FEND as acting on a network node. D3FEND labels such relations "inferred and experimental" (D3FEND 1.6.0, checked November 2026). D3FEND still lists the network device firewall technique under an ID that ATT&CK v20 has revoked; its v20 successor is T1686.002, shown below. Each ID was checked against ATT&CK v20.

The inferred list is thin and indirect. In NHI Mgmt Group's view (not a D3FEND mapping), the most practical use of D3-EHB is against Disable or Modify Tools (T1685), where attackers stop or blind the security agent itself; see the T1685 Disable or Modify Tools Defensive Guide. Cloud instance manipulation is covered in MITRE ATT&CK T1578 Modify Cloud Compute Infrastructure.

Where it is implemented

Examples are listed alphabetically and are illustrations of each class, not recommendations.

None of these thresholds is a security standard: each is the product's own definition. A seven-day inactivity window suits asset hygiene but is far too slow for intrusion detection, so build your own shorter rule on top of the raw check-in data. The EDR Guide and Endpoint Telemetry Guide cover sensor deployment and data collection, which this card does not repeat.

Implementation steps

1. Start from inventory. A missing heartbeat can only be noticed for hosts you expect to hear from. Reconcile the EDR, log agent and device management host lists with the asset inventory, and record each host's expected availability (always on, office hours, mobile). See the Asset Inventory and CMDB Security Guide.
2. Collect raw check-in data centrally. Export last-seen times and health states from every agent platform into the SIEM, rather than relying on each console.
3. Write content rules first. Alert immediately when a host reports a degraded protection state, a stopped component or an unexpected configuration change, and when a host's agent is uninstalled or unenrolled outside a change ticket.
4. Add loss rules by host class. For always-on servers and domain controllers, alert on a missed heartbeat within minutes (for example, three missed intervals; an example, not a standard). For laptops, alert only when other telemetry shows the device is still active.
5. Correlate disagreement. The strongest signal is one platform going silent while another still sees the host: EDR quiet but the host still authenticating to the domain, still producing firewall or DHCP logs, or still checking in to device management.
6. Protect the beacon. Use the agent's tamper protection, keep agent credentials out of reach of local administrators where the product allows, and alert on one agent identity reporting from two locations.
7. Pilot and roll back. Run the rules on one server tier for two to four weeks, tune maintenance windows and decommissioning through the change process, then extend. Rolling back is a rule change; the agents are unaffected.

How to verify it works

• Controlled silence test: on an approved test server, stop the agent through an authorised change and confirm the loss alert fires within the expected interval and names the host.
• Degraded state test: disable one protection component on a test host through policy and confirm the content alert fires while the heartbeat continues.
• Disagreement test: block the agent's outbound connection on a test host while it still authenticates to the domain, and confirm the correlation rule fires.
• Coverage reconciliation: monthly, compare inventory with hosts that reported a heartbeat in the last day; every unexplained gap is either a missing agent or a missed detection.

Limits, bypasses and failure patterns

• Attacker leaves the beacon alone: D3FEND notes that attacker presence may leave the heartbeat intact. Many intrusions never touch the agent, so D3-EHB complements, and never replaces, behavioural detection.
• Replayed or forged heartbeats: D3FEND warns that an attacker may learn the heartbeat format and keep sending it after compromise. Integrity-protected, authenticated heartbeats and cross-source correlation are the answer.
• Thresholds set for hygiene, not detection: relying on a console's multi-day inactive state turns a detection control into an asset report.
• Alert fatigue from mobile devices: laptops sleep and travel. Microsoft documents that macOS devices asleep for about 48 hours send only partial data until used again. Without host classes and correlation, loss alerts get ignored.
• Agent tampering through drivers: attackers who load a vulnerable driver can terminate or blind sensors; a sudden heartbeat loss across many hosts is a ransomware precursor. See the EDR Tampering and BYOVD Response Playbook.
• Silent decommissioning: hosts retired without updating inventory create a steady stream of loss alerts that trains analysts to dismiss them.

Framework mapping

Related countermeasures

• Operating System Monitoring (D3-OSM): the parent family; see D3-OSM Operating System Monitoring.
• Platform Uptime Monitoring (D3-PUM): watches availability of the platform itself rather than a security heartbeat from it.
• File Access Pattern Analysis: a behavioural detection that still works when the beacon is intact; see D3-FAPA File Access Pattern Analysis.
• The wider model: see the MITRE D3FEND Guide.

Practitioner checklist

• Reconcile EDR, log agent and device management host lists with the asset inventory monthly.
• Bring raw last-seen and health state data from every agent platform into the SIEM.
• Alert immediately on degraded protection states and unplanned agent removal.
• Set minute-level heartbeat loss rules for servers and domain controllers.
• Correlate agent silence with authentication, DHCP and firewall logs before escalating laptops.
• Turn on agent tamper protection and protect agent enrolment credentials.
• Feed maintenance windows and decommissioning into the rules through change records.
• Run a controlled silence test each quarter and record the result.

Standards and references

• MITRE D3FEND: Endpoint Health Beacon (D3-EHB)
• Google Patents: US20180191752A1 Intrusion detection using a heartbeat
• MITRE ATT&CK: T1685 Disable or Modify Tools
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls
• Elastic: Monitor Elastic Agents
• Wazuh: Checking connection with the Wazuh manager

Related NHI Mgmt Group resources: EDR Guide · Endpoint Telemetry Guide · Device Trust and Posture Guide · T1685 Disable or Modify Tools Defensive Guide · MITRE D3FEND Guide