Logs, to Eagle SIEM
Forwards the Windows Security, System and Application logs, Sysmon, PowerShell and Defender, and the Linux journal, directly to Eagle SIEM. The certificate is pinned and plain HTTP is refused.
Read-only agents. No command channel.
Small agents for servers and workstations, each with one job and a fixed list of questions. They report. They are never told what to do.
One job each
An agent for the task, not for everything
Agents are not shared between products. Each product is responsible for its own, so one product's release or failure is never another's.
Vulnerabilities, to Eagle ScanV
For the machines a scan cannot reach: a laptop off the network, a server in a cloud. It reports the inventory and the configuration of its own host, and the findings are as confirmed as a credentialed scan.
Health, to Eagle MonV
Answers the same fixed questions as the agentless collectors: processor, memory, disks, services and the errors in the log.
What an agent can never do
It answers. It does not obey.
Software that runs on every machine is the first thing an attacker looks for. These agents are built so that there is nothing to take over.
- No command channel. An agent never runs anything its server sends. A compromised server gets an inventory, never a shell.
- Fixed questions. What an agent may read is a published list. It reads, and it never writes to the host.
- The least it can run as. A service account without administrator rights on Windows, and on Linux an account with no shell inside a sandbox that cannot gain privileges.
- A key for each host. No shared secret. Every host has a key of its own, and the scanning and monitoring agents change theirs every ninety days.
- Enrolled on purpose. A host joins with an enrolment token, or waits in a queue until an administrator accepts it.
- Windows and Linux. Installers for Windows and packages for Debian, built for the server they will report to.
In the suite
Where the agents report
Eagle SIEM
Logs from servers and workstations, and a daily assessment of each host's configuration against more than three hundred rules.
Eagle SIEMEagle ScanV
The vulnerability inventory and configuration audit of hosts that are off the network.
Eagle ScanVEagle MonV
The health of hosts that cannot be reached over SSH or WinRM.
Eagle MonV
Eagle SecOps Suite
One part of one system
Eagle Agents is part of the Eagle SecOps Suite: governance, detection, monitoring, vulnerability scanning and secure DNS, built by one team to work as one.
See the agents running
An hour with the people who built it, on a real system, with your questions. No slideware.