All about Agents

• CyberCNS provides a Single Downloadable Agent which can be used as a Probe (the so-called Regular or Network Agent) OR a Lightweight Agent OR a Scan Agent. You can choose the correct agent configuration based on your requirement. This document provides a way to decide which configuration is best suitable.

• Navigate to Overview and click on Probes/Agents to download the Agent.

• CyberCNS has three different types of installations that can be used depending on the requirement. These are Probe, LightWeight Lightweight, and Scan.

• Choose the OS Type as Windows/ Mac/ Linux, or ARM and download the required Probes / Agents (Probe/Lightweight/Scan) and copy it into the remote machine, and run the command.

• A Probe or Network Agent is typically installed on any one machine in the network and it will scan all assets in that defined network.

• A Lightweight agent Agent, on the other hand, is installed on an end - user’s system and will only scan that particular asset (useful in work-from-home scenarios when the user is not on the corporate/office network).

• The agent will behave as a Probe or Lightweight agent depending on the command line arguments passed while during installation. These commands are to be used for installation and are readily provided in the CyberCNS console while downloading an agent.

• CyberCNS agent uses silent installation so it is easy to push through any RMM.

• Probe & Lightweight agents pull the same information except, lightweight does not provide Network Scan Findings. For lightweight agent, if NMAP is available, it will also be able to get information about Network Vulnerabilities

List of Supported Operating Systems for Agent Installation

Introduction

• This document provides an overview of the various installation switches for an Agent and how they are used during the process of installation and post-installation. There are two ways:

Note: There are two executables 

🔸 cybercnsagentCybercnsagent.exe that is used during installation. 

...

Installation Parameters

• 🔸 Cybercnsagent.exe

Post-installation

• The cybercnsagentv2.exe is located in Installation Path: C:\Program Files(x86)\CyberCNSAgentV2. It has the following parameters.

To download the agent

• On the global menu(⚙) Navigate to the Overview tab and click on Probe/Agent to install the Agent.

🔸 For a successful download please follow the below steps depending on your agent selection.

...

1. Open Powershell as an administrator.

2. Use a copied command from the console to install. This contains information about your domain, company, etc.

...

1. .

...

• Click on select Exe or Msi format for the window operating system

• Please refer to MSI Agent installation using GPO documentation for MSI agent installation using GPO.

...

• In case of command prompt as administrator is used please use the below-highlighted part of the command only.

• Navigate to the folder where the agent is downloaded. You may want to create a new folder and copy the CyberCNS agent into it as it gets installed into the same folder.

...

...

• The Probe is a Windows Service that is installed on the windows Windows machine in the network you would be running scans on. The Windows Service runs under the local system permission but requires the following prerequisites

  • 4 core CPU on the machine

  • Minimum of 4 GB RAM for the first 1000 Assets and 1GB for every additional 500 assets.

  • Reach-ability Reachability to all the subnets needs to scanbe scanned.

  • Ports 443 outbound opened to the installation domain <yourcompany>.mycybercns.com

  • Admin SMB shares permission to login into the remote system and fetches required data.

• The Probe is useful for an office environment where you have controlled IP Addressing.

• It deploys the following techniques to get to the devices

  • Windows - It attempts to use the Admin SMB share to send a small executable called the Dissolvable agent that it then runs on the remote machine to fetch the details. It probes the shares using standard SMB tools and does an NFS discovery to check any NFS shares.

  • Active Directory - It uses SMB to query the users, and groups from the Credentials provided during the AD setup in the Master credentials.

  • Linux - It uses SSH credentials to log in to the box and figure out using Linux commands what is running on the machines.

  • Network Devices - It uses SNMP to discover the Sysobjectid and look up the version of the device and then query the vulnerabilities for the version. It also connects to OEM APIs to get the vulnerability details.

• You can discover multiple subnets(CIDR/IP Range/Static IP) using a single Probe.

• The probe will require AD Credentials in the case of the AD environment for scanning purposes.

• In the case of a Non-AD Environment, if any central system is able to communicate with the other systems in the network it solves the purpose.

...

🔸 Linux, VM, Darwin- The user must have ssh access to execute the scripts and copying copy the files to the temp directory to execute and remove the copied files.

Installation Steps For Windows

1. Open Powershell as an administrator.

To Install as a Probe (example command-line script below).

• If the OS Type is selected as Windows, then to install the Probe Agent follow the below step:-

...

1. Navigate to the Company under which the agent is to be installed and open the Probes/Agents section to get the installation command. ( Below image can be referred)

2. Select the install option as to either Probe, Lightweight or Scan install.

3. Click on Download once the option is chosen, and then run the command for the selected company as shown below. OR Copy the complete command to the clipboard using the copy option in the command box.

4. Open Powershell as an administrator, and run the script.

5. A probe or lightweight agent will be installed in the chosen asset.

• If Probe/ Lightweight is chosen then it installs the CyberCNS service into the agent system, whereas the Scan agent will only scan that system without installing a CyberCNS service. Using the installed service we can use a feature of the scheduler.

...

To Install as a Lightweight Agent

• The below image is to download the Probe Agent by selecting the option as Lightweight agent for the selected company.

...

• use a feature of the scheduler to help schedule further scans.

• Select Exe/ Msi format of the installer for the Windows operating system.

...

To Install a Lightweight Agent

• Click on select Exe/Msi/web installer format to install lightweight agent on the windows system.

• Either download a Lightweight agent for the selected company as per below image or use the command shown in the grey box to copy and run it under Powershell as an administrator for windows.

...

• Click on Select Web Installer format for the Windows operating system.

  Image Added

• The agent will be downloaded in the download folder ( or the set folder for download) of the system used for download.

...

• Navigate to the download folder, Right-click on the downloaded file, and click on Run as administrator.

...

• WebInstaller installation window will appear as below showing the status of agent installation.
  

  Image Added

To run a scan

• Once the download is completed, select the option to Scan and run the command.

• A scan agent will help to do a one-time scan.

...

Uninstallation Steps for Windows(Probe & LightWeightAgent)

• To uninstall cybercnsagentv2 using a command prompt

>run Runn cmd as admin

>cd C:\Program Files (x86)\CyberCNSAgentV2

...

🔸 To uninstall cybercnsagentv2 using windows Windows GUI

• Navigate to the cybercnsgentv2 folder

...

• If you have an RMM deployed on the network and you are not interested in scanning network devices like in the case of a small office with a printer and broadband router then you can use the Lightweight Agent.

• The Lightweight agent can run as an executable run from the RMM or can be installed as a service.

• It collects information from the local system and pushes data to the CyberCNS portal. It does not cross the machine boundary. One weakness of this is that one does not Lightweight Agent is unable to get an outsider view of the system.

  • Ports 443 Outbound is required.

...

1. Download Mac/Apple agent from the company & open the terminal.

2. At the terminal run >> Sudo Su

3. Navigate to the downloaded path and give executable permission for the installation script by using the commands below. using the commands . below

   Code Block
   chmod +x cybrcnsagentcybercnsagent_darwin

To Install as a Probe

...

🔸 Select the option to install either as Probe or Lightweight, click on Download once the option is chosen, and then run the command for the selected company as shown below.

...

• The below image depicts the procedure to download the Lightweight Agent by selecting the option as Lightweight agent Agent for the selected company.

...

• Once the download is completed, select the option to Scan and run the command.

• Scan The scan agent will help to do a one-time scan.

...

1. Download the Linux agent from the company & open terminal

2. At the terminal run >> Sudo Su

3. Navigate to the downloaded path and give executable permission for the installation script by using the commands below commands.

chmod +x cybrcnsagentcybercnsagent_linux

To Install as a Probe

...

🔸 Select the option to install either as Probe or Lightweight, click on Download once the option is chosen, and then run the command for the selected company as shown below.

...

• Once the download is completed, select the option to Scan and run the command.

• Scan The scan agent will help to do a one-time scan.

...

1. Download the ARM agent from the company & open terminal

2. At the terminal run >> Sudo Su

3. Navigate to the downloaded path and give executable permission for the installation script by using the commands below commands.

chmod +x cybrcnsagentcybercnsagent_arm

To Install as a Probe

...

🔸 Select the option to install either as Probe or Lightweight, click on Download once the option is chosen, and then run the command for the selected company as shown below.

...

• Once the download is completed, select the option to Scan and run the command.

• Scan The scan agent will help to do a one-time scan.

...

• Select the agent and click on Global action Action andclick on Agent Migration.

...

...

Debug Mode Command:-

In Linux

-->open > Open terminal with privileged user

...

Please use the option with the proxy format for an authenticated proxy:

-p username:password@IPaddress or Hostname:port

e.g. -p user:pass@proxy.example.me:3128

For unauthenticated Proxy

-p IPaddress IP address or Hostname:port

e.g. -p proxy.example.me:3128

Tags support for LightWeight Agent

...