Get Immediate Answers from Anywhere
Since the first antivirus software was introduced
to businesses in the early ‘90s, IT ops and security
teams have greeted software agents with mutual…
disdain. Too hard to manage. No endpoint visibility.
Systems slowdown. Not exactly four-star feedback.
Regardless, these same teams now consider real-time
access to endpoints as the top priority in securing
their organizations—a conflict constantly forcing
them to weigh the value of endpoint data to each use
case against the pains of agents. We’re here to tip the
scales.
Keeping common complaints in mind, we developed the
Rapid7 Insight Agent, a solution intended to serve
customers’ needs where other data collection methods
fall short. Keep reading to learn how and why we offer
this agent, as well as the conscious decisions we made
to avoid the pains people historically associate with
information security agents.
One agent, multiple solutions. Imagine that.
Think of the universal Rapid7 Insight Agent as a law
enforcement field agent, performing the jobs sent to it
from HQ. Each time an agent provides a status update
to HQ (the Rapid7 Insight Platform), any Rapid7 applications you’ve licensed (e.g. Nexpose, InsightIDR) will
respond with any data collection tasks they need for
analysis. The agent runs as a service on each asset –
that privileged users cannot simply disable – and
spawns new services when it needs to read the registry, Windows Event Logs, or anywhere else necessary
to do its job. And since simply transmitting all data on
an asset would be a massive waste of multiple resources, only the data relevant to each job is gathered and
transmitted, with only the deltas since the last collection job typically being necessary.
Thanks to this design – a central hub providing orders
to remote agents – your IT department needs only
distribute the software package once to each asset to
complement your other collection tools for Nexpose
and InsightIDR. Any admin of either solution can
download the package, containing the universal
installers (MSI file for Windows, ZIP for Linux and Mac)
and the certificate unique to your organization. This
ensures that you can distribute the Rapid7 Insight
Agent to any number of laptops, desktops, and servers
PLANE WIFI
Figure 1:
Rapid7 Insight Platform:
Automatically collect operational
data across your environment and
use advanced analytics to transform
that data into insight.
Collector
VPN
CAFE WIFI
HOME WIFI
VPN
090816
| Rapid7.com
Insight Agent Technology Brief
Technology Brief
Rapid7 Insight Agent
using group policy or similar tools at a pace comfy to you.
No matter when an agent first comes online, it will only
transmit data to the one customer instance to which the
certificate corresponds.
SEE THE NUMBERS
Immediate answers for your team—from any
network in the world.
Scanning and monitoring assets without an agent has
served organizations well for over a decade, but as the
number of laptops outside our sphere of control continually
grows, ignoring your remote workforce isn’t all that different than handing your employees a laptop and keeping your
fingers crossed until they come back to the office. It’s much
safer to identify an exposure or compromise of these
systems before it’s directly connected to your organization’s
most valuable data.
So if employees are working from outside the office the
same way they do at their desks, shouldn’t your technology
monitor their assets the same way, too? The Rapid7 Insight
Platform is built on Amazon Web Services (AWS), which
means there’s no need to deploy, configure, and troubleshoot a reverse proxy to reach parity in visibility between
assets on the network and those connected to a plane’s
WiFi. When an Insight Agent is connected to your network,
directly or via VPN, it transmits all of its data through the
nearest collector or scan engine (treating it as a proxy); if it
determines these trusted proxies are unreachable, it
transmits its data directly to the Rapid7 Insight Platform for
processing. This ensures real-time monitoring of all assets
without causing undesirable spikes in inbound traffic or new
headaches for the security and IT teams. Want to know
more about our Rapid7 Insight Platform? Reach out or head
to rapid7.com to get our detailed white paper.
How lightweight is “lightweight”? Very.
The software agents of the past decade gained notoriety for
occupying large amounts of hard drive space, consuming
excessive CPU, and requiring frequent reboots to operate
effectively. Not exactly features we wanted to replicate. By
making our agent a “dumb” drone that simply follows
orders, we were able to keep its footprint under 50 MB on
disk, use less than 25 MB of RAM at rest, and transmit less
than 1 MB daily from each endpoint. These trade-offs were
not a viable option before the introduction of NoSQL databases, map/reduce, and other recent buzzword
developments in “Big Data” processing. But now, by shifting
the heavy workload of analyzing piles of data to our Insight
Platform, we have realized the benefits of direct access to
each endpoint without inflicting regular disruptions upon
your end users.
The entire goal of this lean approach is to make all of your
environment equally accessible to the security team without
impacting employee productivity. Software agents may have
a bad rep, but it was due more to their drawbacks than lack
| Rapid7.com
Footprint under
on disk
Uses less than
Transmits less than
of RAM at rest
daily from each endpoint
of benefits delivered. Your end users shouldn’t be constantly reminded that a service is running on their system to
notify you when a new, questionable application is installed.
And your IT department has enough patching to regularly
manage—they shouldn’t be burdened with yet another (we
think they’d agree).
Updating software agents—the continuous
deployment way.
“Less ongoing maintenance” sound good to you? Us too.
Inspired by Google’s Chrome browser – where updates
never interfere with users’ activities for a shutdown of all
related processes or system reboot – we designed our
Insight Agent to automatically download, and install,
regular updates for itself. Just like the rest of our solutions,
our agents are updated regularly (some multiple times per
day), without requiring a reboot. While it’s impossible to
promise that your IT department will never have to re-deploy our installer package, it’s certainly our aim.
We totally understand the emotional response software
agents cause in the hearts and minds of our customers, so
it was only after an extensive examination of alternatives
that we added them to our data collection tools. We’re
constantly looking for ways to improve data collection
across all of our solutions and our agents are no exception.
We have written this brief, our Trust website, and various
papers about Rapid7’s Insight Platform in hopes that this
transparency will lead to both an appreciated transparency
with our customers and recommendations to improve the
overall experience based on the decisions we’ve exposed
herein.
Learn more about the products powered by
the Rapid7 Insight Agent:
www.rapid7.com/products/nexpose/
www.rapid7.com/products/insightidr/
Insight Agent Technology Brief