Use the Cortex® XDR™ Agent for Linux
Learn how to effectively use the Cortex® XDR™ agent for Linux by the different options described in this topic.
After you install Cortex XDR agent for Linux, the agent operates transparently in the background as a system process. Typically, it is not necessary to interact with the agent; however, to perform common actions, such as initiating a manual check in with Cortex XDR, you can use the command-line utility (also available for Mac and Windows) named Cytool. Cytool is available in the
/opt/traps/bin/cytooldirectory and must be run as root or with root permissions.
To use the Cortex XDR agent for Linux:
- Display the Cytool help.From the Linux server, run thecytoolcommand without any arguments or with-hor--helpoptions.root@ubuntu:~$/opt/traps/bin/cytoolUsage: cytool<options> cytool - Support tool Options: -h --help Display help information. enum List processes protected by Cortex XDR. startup query List startup status for Cortex XDR endpoint agent(s) and daemon(s). startup <enable | disable> <process_name | all> Enable/Disable agent(s) and daemon(s) after reboot. runtime query List runtime status for agent(s), daemon(s) and kernel extensions. runtime <start | stop> <process_name | all> Start/Stop agent(s), daemon(s) and kernel extensions immediately. persist list Display list of persistent databases. persist export <db_name | db_path> Export database(s) to the file(s) in JSON format. persist import <db_name | db_path> <file_name> Import data into the database from the given JSON file. persist print <db_name | db_path> [csv] Print database to the command prompt. log <log_level> <process_name | all> Set log level for the desired process. log collect Generate support file archive. dump <enable | disable | restore> Enable/Disable dump generation or restore policy settings. checkin Initiate Check In Now (send heartbeat to ESM).Follow the usage guidelines to run additional Cytool commands.
- List processes protected by the agent.Enter thecytool enumcommand.root@ubuntu:~$cytool enum----------------------------------- Cortex XDR list of protected processes: ----------------------------------- PID CMD UID 1098 /usr/sbin/cron -f 0 1131 /usr/sbin/rsyslogd -n 104To view processes for all users including those initiated by the operating system, specify the/aoption.If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes, and only then you will see them on this list.
- Start or stop Cortex XDR agent daemons.The agent comprises the pmd, dypd, analyzerd and lted processes. pmd is the main process and it automatically starts/stops dypd, analyzerd and lted. To start or stop all daemons, enter either thecytool runtime [start | stop] allcommand or thecytool startup [enable | disable] allcommand. The behavior of both commands changes both the current running state and the startup registration status of the daemons when the server boots.For example:root@ubuntu16:~#/opt/traps/bin/cytool runtime stop allName PID User Status Command pmd N/A N/A STOPPED N/A analyzerd N/A N/A STOPPED N/A dypd N/A N/A STOPPED N/A lted N/A N/A STOPPED N/A root@ubuntu16:~#/opt/traps/bin/cytool runtime start allName PID User Status Command pmd 20798 root Running /opt/traps/bin/pmd analyzerd 21027 cortexu+ Running /opt/traps/analyzerd/analyzerd 109 111 113 dypd 20999 root Running /opt/traps/bin/dypd -a -- 99 lted 20982 cortexu+ Running /opt/traps/ltee/lted -type 2 -config ltee_decryptor.json
- View the Cortex XDR agent security policy.The agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases in the/opt/traps/persist/directory. To troubleshoot policy issues and security events, you can use Cytool to import, export, and view information stored in the local database.To view a list of all local databases, use thecytool persist listcommand.root@ubuntu:~$/opt/traps/bin/cytool persist listPersistent database list: post_detection.db Database of post-detection candidates agent_actions.db Database of one time actions cloud_frontend.db Database of Cloud frontend settings hashes_lru.dbLeastrecently used verdicts database cloud_reports.db Database of Cloud reports hashes.db Database of the verdicts received from WildFire esm_frontend.db Database of ESM frontend settings policy.db Policy database fvhash.db Database of blacklisted fvhashes trusted_signers.db Database of trusted signers hash_paths.db Database of file paths hash_override.db Database of hashes override (Admin exeptions) esm_reports.db Database of ESM reports security_events.db Database of security events (preventions) file_upload.db Database of files being uploaded to ESM hashes_retransmit.db Database of hashes to be retransmitted agent_settings.db Database of agent settingsTo view the records of a database, use thecytool persistprint [command where you specify either the name of database (see the<database_name>|<database_path>]cytoolpersist listcommand) or the path to the database. Or, to export the records of a database to a JSON file, use thecytoolpersist export [command. For example:<database_name>|<database_path>]root@ubuntu:~$/opt/traps/bin/cytool persist print security_events.dbDatabase security_events: persistence::DB: /opt/traps/persist/security_events.db: Open persistence::DB: /opt/traps/persist/security_events.db: Open: IO error: lock /opt/traps/persist/security_events.db/LOCK: Resource temporarily unavailable 3c34dcc1-bc37-ffef-ed55-f5512df05884, Prevention ID: 3c34dcc1-bc37-ffef-ed55-f5512df05884 Time: 2018-05-02T10:31:51Z Timezone offset (min): 240 Module ID (CyveraComponent): 277 Module status (CyStatus): 0xC0400015 Blocked: false Source process ID: 14818 Source process terminated: true Source process command line: /root/Desktop/Linux_testers/ROP/lighttpd system 0 Source process file index: 0 Target process ID: 0 Target process terminated: false Target process command line: Target process file index: 0 User ID: 0 User name: Cortex XDR version: 18.104.22.168 OS name: Linux OS version: Red Hat Enterprise Linux Server release 6.9 (Santiago) Machine name: Saar_redhat64x64 Dump path: /opt/traps/forensics/3c34dcc1-bc37-ffef-ed55-f5512df05884/ Content version: 17-3805 IP Address: 10.200.0.55 Verdict (WildFire/Hash Control): 0 1 Files: Name: lighttpd Path: /root/Desktop/Linux_testers/ROP Size: 0 Hash: 8630c9e57ca58fb7966c80525c36f572416e0a8db617b8a43c946d4fa966a71c Version: Publisher: Quarantine ID: Signers: '' ------------------------------------------------ ---------- END Security Event Files ---------- root@ubuntu:~$/opt/traps/bin/cytool persist export security_events.dbpersistence::DB: /opt/traps/persist/security_events.db: Open -rw-r--r-- 1 ubuntu root 25824 Jan 2 18:10 /home/ubuntu/traps/cytool/security_events.db_18.10.04.427_02.01.2018.jsonTo add records to the database, use thecytoolpersist import [command where<database_name>|<database_path>]<input_filename>is a JSON file.<input_filename>
- Collect logs.Use thecytool log set_levelcommand to change the log level of an agent component where:<log_level>[<process_name>|all]
Then use thecytoollog collectcommand to collect all logs in a TGZ file.root@ubuntu:~$/opt/traps/bin/cytool log 1 trapsdroot@ubuntu:~$/opt/traps/bin/cytool log collect-rw-r--r-- 1 root root 1651939 Dec 30 20:33 /tmp/Traps_log_2017-12-30_20-33-22/Traps_log_2017-12-30_20-33-22.tgz
- is an integer value corresponding to the log level:<log_level>
- is the Cortex XDR agent component:<process_name>trapsd,authorized,pmd, ordypd.
- Manually initiate a check in with the server.Use thecytool checkincommand to initiate the manual check-in. To verify the status of the check-in on Cortex XDR, view theLAST SEENdate from the additional details view of an endpoint on theEndpointspage.
- Configure proxy communication.If defined, the agent uses the proxy settings defined in the system environment in/etc/environment. If proxy settings are not defined, you can add the proxy server to the system environment by specifying the following setting in theenvironmentfile:https_proxy=”https://<proxyserver>:<port>"where:
- is the IP address of the proxy server<proxyserver>
- is the port number used for proxy communication.<port>
- View the version of the Cortex XDR agent.To view the version of the agent on the Linux server, open or read theversion.txtfile in the/opt/traps/directory. For example:root@ubuntu:~$cat /opt/traps/version.txttraps_linux-22.214.171.1240 ce1707dadbbb67effb7bf08cd4edee60d9508377
Recommended For You
Recommended videos not found.