Below is a link to our YouTube Channel Series @ConnectSecureEducation which covers the ‘Probes/Agent’ module within CyberCNS. After the video link is our documentation. Let us know if you have any feedback, you can email to education@connectsecure.com
...
Table of Contents for Probes / Agents
| Table of Contents | ||||
|---|---|---|---|---|
|
This section will cover the Probes / Agents at the Company level.
...
Overview
The Probes/Agent screen gives you an overview of currently installed CyberCNS agents, both Probe and/or Lightweight Agents. Additional settings for the agents can be configured here as well as initiating any of our scan types.
...
You can perform actions against a single agent using the three-dot action menu
...
Single Agent Actions
Discovery Settings - parameters for Probe agent type used for scanning for IP-based assets
Uninstall - issues remote uninstall of CyberCNS agent/services (needs to be online to uninstall)
Delete - permanently deletes the agent from the CyberCNS portal
Fetch Event Logs - download a range of Microsoft Windows Event Logs (Jobs > Agent Event Logs)
Agent Update Info - displays logging detail for agent version updates (requires asset to be online)
...
Additionally, you can perform actions against multiple agents using the checkbox on first column of the agents and then the GLOBAL ACTIONS button will light up.
...
Global Actions
Uninstall - issues remote uninstall of CyberCNS agent/services (needs to be online to uninstall)
Delete - permanently deletes the agent from the CyberCNS portal
Lightweight Agent Scan - initiates a Lightweight agent scan
Agent Migration -move an agent from company to another without uninstalling or reinstalling
...
Discovery Settings
| Info |
|---|
Discovery Settings are only available on the Probe agent type |
The probe agent discovery settings can be configured to scan the network(s). By doing so, IP-based devices can be discovered and subsequently added to the Active Assets. Please find the available configuration options listed below.
...
Discovery Setting Options
We have 4 discovery type options to choose from when scanning the network(s). These include the following: CIDR, IP Range, Static IP, and Domain Name.
To get started with a discovery scan, first click on the +Add button
...
IP Ranges
When you first open the window it will automatically select the discovery type of CIDR, detect the local IP, subnet, and fill this in for you. This can be edited any time based on the network and scan requirements. The following discovery types are available for scanning.
...
Copy to Probe - this allows you to copy the IP Range information from probe to probe within the same company; duplicates will be ignored.
Edit - allows you to edit the parameters of an existing IP Range entry
Delete - deletes the IP Range parameters permanently
...
SNMP Credentials
| Tip |
|---|
SNMP v1/v2 and v3 are all supported by CyberCNS using read-only credentials |
...
Edit - allows you to edit the parameters of an existing IP Range entry
Delete - deletes the IP Range parameters permanently
...
Active Directory Credentials
Use the +Add button to store credentials to be used with Active Directory scanning computers part of the AD network(s). You can add a single set of credentials or multipole sets; both are supported but not required.
Complete each of the required fields and then choose save.
...
Active Directory Credentials | Exclude IP
| Info |
|---|
This tab allows you to configure the IP Addresses that can be excluded from scanning which is a part of the Active Directory discovery settings. |
...
See ‘Discovery Settings’ for more information about using the discovery types; CIDR, IP Range, Static IP, Domain Name.
Master Credentials
Define a common set of ‘local’ credentials to do an authenticated asset scan against company level assets.
...
Once you have credentials saved you will be able to Edit or DELETE using the three-dot actin menu on the saved credential entry.
...
Azure AD Asset Scanning
Azure AD users can not access a local network share directly. If they have a local Active Directory and it is connected to the Azure AD using Azure Connect, then users will sync with Azure AD and the local AD post which they can access ADMIN$.
Granting Permissions for Local Network Share in Azure AD
Install and configure an Azure AD Connect account.
Join your VM in Azure to the Domain Controller.
Set a user from the domain controller.
Performance Management
| Info |
|---|
This tab allows you to allocate the required number of processes to be executed at a time, when a scan is triggered. This is based on the system configuration where the agent is installed. |
...
Uninstalling Probes / Lightweight Agents
| Note |
|---|
Agent must be online to use the remote uninstall command |
...
→ sc.exe delete cybercnsagentmonitor
Deleting Single Probes / Lightweight Agents
| Info |
|---|
Online or Offline agents can be deleted. Once deleted, all the data pertaining to that Probe/Agent will be deleted from the CyberCNS portal. |
...
Deleting Multiple Probes / Lightweight Agents
Use the checkboxes to select the Probes/Agents you want to mark for deletion, using Global Actions.
...
Lightweight Agent Scanning
| Info |
|---|
The agents must be online in order for scanning to be initiated |
...
| Panel | ||||||||
|---|---|---|---|---|---|---|---|---|
| ||||||||
We recommend using the ‘Global Scheduler’ to schedule your Lightweight Agent Scan so its happening automatically and keeping your assets up to date with the latest data. |
Agent Migration
We can migrate a CyberCNS agent from company to another using the Agent Migration option found under the Global Action menu. You will have to use the checkbox to select an agent and then the Global Actions button will appear.
...
Using the drop down (1), select the company and then choose Migrate (2) to move the agent.
...
Deprecated Agents
| Info |
|---|
Agent deprecation helps keep your active/online agents clean. Any agent unreachable by CyberCNS in the ‘Agent Deprecation Days’ field will automatically move from your Active Assets to the Deprecated Assets Agents section automatically. |
To set your Agent Deprecation Days navigate to Settings as per the screenshot below.
...