guardicore / guardicore/monkey
Update machine OS if it's exploited with OS-specific exploiter
- Dominant language
- Python
- Stars
- 7.1k
- Forks
- 830
- PR merge metrics
- No merged PRs in 30d
Description
When an Agent scans a machine, it sends an event to the Island which may or may not include that machine's OS. The Island upserts that machine in the machine repository.
If the OS is unknown at this point, the only time that it is updated again is when an Agent runs on that machine and sends an `OSDiscoveryEvent` to the Island. If the OS is `None`, the map in the UI doesn't show an accurate image for that node.
If the machine was exploited with an exploiter that only works for a specific OS, update the machine with the OS. This helps with cases where the machine was exploited and an Agent binary was downloaded to it, but no communication back to the Island happened (see #2901).
Example:
10.2.0.13 is Linux machine which was exploited by the SSH exploiter. An Agent binary was also downloaded to the machine (checked in the logs), however, it could not communicate back to the Island. The map node isn't accurate according to this information, since the OS information of the machine was never updated, it was always `None`.

Contributor guide
Assessment
This issue has not been assessed yet.