Agent Configurations

Table of Contents

Agent Configuration is specific to your POD and is based on the hosting regions. To obtain your POD, please tap the INFO button on the Overview > Dashboard screen as shown below.

Open

Open

Agent Types

ConnectSecure has two agent types: Lightweight (LWA) and Probe.

Find these at the Overview > Agents screen under the two tabs with the count labeled:

Open

By default, any ConnectSecure agent is installed as a Lightweight Agent.

Afterward, you can convert the Lightweight Agent to a Probe Agent by mapping the company-based Discovery settings. Mapping the discovery settings to an agent triggers it to convert to a probe.

Convert LWA to Probe

• The LWA is running an authenticated scan since it’s been installed with administrator privileges

• The LWA installation uses a continuous scanning method on the locally installed asset.

• The LWA does not scan outside the boundaries of the local asset to which it is installed.

  • IE: No network scanning; no asset discovery; this requires the Probe Agent.

• The LWA scans automatically based on the parameters in the scan time interval settings.

  • Navigate to the Company/Global > Settings > Company Settings > Scan Time interval.

• If an RMM tool is deployed on the network, you can push the LWA to multiple systems using our prebuilt PowerShell/Terminal scripts, which are provided with the company agent download by OS. https://cybercns.atlassian.net/wiki/x/xgDXfQ

• The probe is running an authenticated scan against itself since it’s been installed with administrator privileges

• The probe is generally best used in environment(s) with controlled IP-addressing.

• The probe is compatible with Windows, MacOS, Linux, and ARM-based operating systems.

  • A complete list of supported operating systems is in the table near the end of this document.

• Probe Agent uses the following methods to gather data from the scan(s).

  • Windows: It attempts to use the Admin SMB share to send a small executable called the dissolvable agent, which then runs on the remote machine to fetch the details.

  • Active Directory: If Active Directory Credentials are provided to the Probe Agent under Discovery Settings, SMB communication fetches information from remote assets.

  • Darwin/Linux: Requires the latest installation of NMAP; uses SSH credentials and Linux commands to determine what is running.

• Network Devices: This uses SNMP to discover the sysObjectID, look up the device's version, and query the vulnerabilities for that version. It also connects to OEM APIs to get the vulnerability details.

• You can discover multiple subnets using a single Probe Agent by setting up the address type(s) found in the company discovery settings. Below are some examples of the address types you can use.

  • CIDR > Example: 192.168.1.0/24

  • IP Range > Example: 192.168.1.0-192.168.1.100

  • Static IP > Example: 192.168.1.1

  • Domain > Example: xyz.com

• The Probe Agent requires AD credentials to scan Active Directory environments; however, using a Lightweight Agent installed directly on the Domain Controller is the preferred method.

• Probe Agent can access workgroup machines using standard or local credentials mapped from the Discovery settings to the Probe (nondomain).

• Probe agent can be used to deploy security patches to remote machines; previously, this would require a lightweight agent, but that is no longer the case.

Recommended Minimum Hardware Requirements

Agent Data Collection Process

Upon installation, the ConnectSecure Vulnerability Scan Agent securely transmits system data to the ConnectSecure Portal using the methods mentioned below.

How the Probe Collects Device Data

Our probe collects device information using multiple methods, depending on the protocols and access available on the target device. Below is a breakdown of the key data typically gathered and the techniques used to retrieve it.

1. SNMP (Simple Network Management Protocol)
   When SNMP is enabled and properly configured, the probe can collect the following data—based on the device’s :
   • OS Name (if available)
   • OS Build (if available)
   • Device Type (if available)
   • Hostname (if available)
   • System OID (Object Identifier)
   These details are retrieved directly from SNMP responses using the device’s.

2. Nmap Scanning
   Nmap is used for active scanning and service enumeration. It provides:
   • MAC Address (if available)
   • Hostname (if resolvable)
   • Open ports and associated services
   • Detection of devices using default SNMP community strings
   • Basic vulnerability checks (via built-in Nmap scripts and brute-force modules)

3. Fingerprinting
   If SNMP is inaccessible, the probe uses fingerprinting to infer data based on network responses. This may include:
   • Hostname
   • MAC Address (if available)
   • OS Guess
   • Manufacturer (if MAC address is available)
   • OS Name and OS Build (if determinable)

4. MAC Address and Manufacturer Identification
   To determine MAC address and manufacturer, the probe uses:
   • Nmap scanning to retrieve the MAC address
   • Fingerprinting to infer the manufacturer
   • Cross-referencing MAC addresses against known vendor databases for confirmation

Port Requirements for Asset Discovery and Vulnerability Detection

When a Probe Agent is deployed, it initiates a port scan across any configured discovery ranges or IP addresses. If relevant ports are detected, the agent proceeds to identify the asset and assess potential vulnerabilities.

Agent Proxy Support

Please use the options below with your Agent install method to support proxy. The -p switch is to be added to the end of your agent installer. See below for example:

-p username:password@IPaddress or Hostname:port

 e.g. -p user:pass@proxy.example.me:3128

For unauthenticated Proxy

-p IP address or Hostname:port

 e.g. -p proxy.example.me:3128

./cybercnsagent.exe -c ██ -e ███████████ -i -p <USERNAME>:<PASSWORD>@<IPADDRESS>:<PORT>;

Supported Operating Systems