guardicore / guardicore/monkey
Add more images for node types
- Dominant language
- Python
- Stars
- 7.1k
- Forks
- 830
- PR merge metrics
- No merged PRs in 30d
Description
If the OS of the machine is unknown and the propagated Agent can't communicate back to the Island, the node image in the map is misleading. Without the OS, it simply shows an "N/A" image and shows nothing about the propagated Agent on the machine.
Example:
10.2.0.13 is Linux machine which was exploited by the SSH exploiter. Its OS was marked as `None` in the machine repository since the OS information couldn't be gathered when it was scanned. An Agent binary was downloaded to the machine (checked in the logs), however, it could not communicate back to the Island. The map node isn't accurate according to this information. It doesn't show that the Agent was downloaded to it and may/may not have run on it. There's no way for the user to know that an Agent propagated to that machine unless they check the relevant Agent's logs or go to the machine and check it.

There should be a node image for machines with unknown OS where an Agent was downloaded.
Contributor guide
Assessment
This issue has not been assessed yet.