agent

Documentation

Index

• type Agent
  • func New(config Config) (agent Agent, err error)
  • func (a *Agent) Authenticated() bool
  • func (a *Agent) Comms() Comms
  • func (a *Agent) Failed() int
  • func (a *Agent) Host() Host
  • func (a *Agent) ID() uuid.UUID
  • func (a *Agent) KillDate() int64
  • func (a *Agent) MaxRetry() int
  • func (a *Agent) Process() Process
  • func (a *Agent) SetAuthenticated(authenticated bool)
  • func (a *Agent) SetComms(comms Comms)
  • func (a *Agent) SetFailedCheckIn(failed int)
  • func (a *Agent) SetInitialCheckIn(checkin time.Time)
  • func (a *Agent) SetKillDate(epochDate int64)
  • func (a *Agent) SetMaxRetry(retries int)
  • func (a *Agent) SetSkew(skew int64)
  • func (a *Agent) SetStatusCheckIn(checkin time.Time)
  • func (a *Agent) SetWaitTime(wait time.Duration)
  • func (a *Agent) Skew() int64
  • func (a *Agent) Wait() time.Duration
• type Build
• type Comms
• type Config
• type Host
• type Process
• type Repository

Types

type Agent

type Agent struct {
	// contains filtered or unexported fields
}

Agent is an aggregate structure that represents a Merlin Agent

func New

func New(config Config) (agent Agent, err error)

New creates a new Agent struct from the provided Config structure and returns the Agent object

func (*Agent) Authenticated

func (a *Agent) Authenticated() bool

Authenticated returns if the Agent is authenticated to the Merlin server or not

func (*Agent) Comms

func (a *Agent) Comms() Comms

Comms returns the embedded Comms structure which contains information about the Agent's communication profile but is not the actual client used for network communications

func (*Agent) Failed

func (a *Agent) Failed() int

Failed returns the number of times the Agent has failed to successfully check in

func (*Agent) Host

func (a *Agent) Host() Host

Host returns the embedded Host structure that contains information about the Host where the Agent is running such as the hostname and operating system

func (*Agent) ID

func (a *Agent) ID() uuid.UUID

ID returns the Agent's unique identifier

func (*Agent) KillDate

func (a *Agent) KillDate() int64

KillDate returns the date, as an epoch timestamp, that the Agent will quit running

func (*Agent) MaxRetry

func (a *Agent) MaxRetry() int

MaxRetry returns the configured value for how many times the Agent will try to connect in before it quits running

func (*Agent) Process

func (a *Agent) Process() Process

Process returns the embedded Process structure that contains information about the process this Merlin Agent is running in such as the process id, username, or integrity level

func (*Agent) SetAuthenticated

func (a *Agent) SetAuthenticated(authenticated bool)

SetAuthenticated updates the Agent's authentication status The updated Agent object must be stored or updated in the repository separately for the change to be permanent

func (*Agent) SetComms

func (a *Agent) SetComms(comms Comms)

SetComms updates the Agent's embedded Comms structure with the one provided The updated Agent object must be stored or updated in the repository separately for the change to be permanent

func (*Agent) SetFailedCheckIn

func (a *Agent) SetFailedCheckIn(failed int)

SetFailedCheckIn updates the number of times the Agent has actually failed to check in The updated Agent object must be stored or updated in the repository separately for the change to be permanent

func (*Agent) SetInitialCheckIn

func (a *Agent) SetInitialCheckIn(checkin time.Time)

SetInitialCheckIn updates the time stamp that the Agent first successfully connected to the Merlin server The updated Agent object must be stored or updated in the repository separately for the change to be permanent

func (*Agent) SetKillDate

func (a *Agent) SetKillDate(epochDate int64)

SetKillDate updates the date, as an epoch timestamp, that the Agent will quit running The updated Agent object must be stored or updated in the repository separately for the change to be permanent

func (*Agent) SetMaxRetry

func (a *Agent) SetMaxRetry(retries int)

SetMaxRetry updates the number of times the Agent can fail to check in before it quits running The updated Agent object must be stored or updated in the repository separately for the change to be permanent

func (*Agent) SetSkew

func (a *Agent) SetSkew(skew int64)

SetSkew updates the amount of jitter or skew added to the Agent's sleep or wait time The updated Agent object must be stored or updated in the repository separately for the change to be permanent

func (*Agent) SetStatusCheckIn

func (a *Agent) SetStatusCheckIn(checkin time.Time)

SetStatusCheckIn updates the last time the Agent successfully communicated with the Merlin server The updated Agent object must be stored or updated in the repository separately for the change to be permanent

func (*Agent) SetWaitTime

func (a *Agent) SetWaitTime(wait time.Duration)

SetWaitTime updates the amount of time the Agent will wait or sleep before it attempts to check in again The updated Agent object must be stored or updated in the repository separately for the change to be permanent

func (*Agent) Skew

func (a *Agent) Skew() int64

Skew returns the amount of jitter or skew the Agent is adding to the amount of time it sleeps between check ins

func (*Agent) Wait

func (a *Agent) Wait() time.Duration

Wait returns the amount of time the Agent will wait or sleep between check ins

type Build

type Build struct {
	Build   string // The agent's build hash
	Version string // The agent's version number
}

Build is a structure that holds information about an Agent's compiled build hash and the Agent's version number

type Comms

type Comms struct {
	Failed  int           // The number of times the agent has failed to check in
	JA3     string        // The ja3 signature applied to the agent's TLS client
	Kill    int64         // The epoch date and time that the agent will kill itself and quit running
	Padding int           // The maximum amount of padding that will be appended to the Base message
	Proto   string        // The protocol the agent is using to communicate with the server
	Retry   int           // The maximum amount of times an agent will retry to check in before exiting
	Skew    int64         // The amount of skew, or jitter, used to calculate the check in time
	Wait    time.Duration // The amount of time the agent waits before trying to check in
}

Comms is a structure that holds information about an Agent's communication profile

type Config

type Config struct {
	Sleep    string // Sleep is the amount of time the Agent will wait between sending messages to the server
	Skew     string // Skew is the variance or jitter, used to vary the sleep time so that it isn't constant
	KillDate string // KillDate is the date as a Unix timestamp, that agent will quit running
	MaxRetry string // MaxRetry is the maximum amount of time an agent will fail to check in before it quits running
}

Config is a structure that is used to pass in all necessary information to instantiate a new Agent

type Host

type Host struct {
	Architecture string   // The operating system architecture the agent is running on (e.g., x86 or x64)
	Name         string   // The host name the agent is running on
	Platform     string   // The platform, or operating system, the agent is running on
	IPs          []string // A list of interface IP addresses on the host where the agent is running
}

Host is a structure that holds information about the Host operating system an Agent is running on

type Process

type Process struct {
	ID        int    // The process ID that the agent is running in
	Integrity int    // The integrity level of the process the agent is running in
	Name      string // The process name that the agent is running in
	UserGUID  string // The GUID of the user that the agent is running as
	UserName  string // The username that the agent is running as
	Domain    string // The domain the user running the process belong to
}

Process is a structure that holds information about the Process the Agent is running in/as

type Repository

type Repository interface {
	// Add stores the Merlin Agent structure to the repository
	Add(agent Agent)
	// Get returns the stored Agent structure
	Get() Agent
	// SetAuthenticated updates the Agent's authentication status and stores the updated Agent in the repository
	SetAuthenticated(authenticated bool)
	// SetComms updates the Agent's embedded Comms structure with the one provided and stores the updated Agent in the repository
	SetComms(comms Comms)
	// SetFailedCheckIn updates the number of times the Agent has actually failed to check in and stores the updated Agent
	// in the repository
	SetFailedCheckIn(failed int)
	// SetInitialCheckIn updates the time stamp that the Agent first successfully connected to the Merlin server and stores
	// the updated Agent in the repository
	SetInitialCheckIn(checkin time.Time)
	// SetKillDate sets the date, as an epoch timestamp, of when the Agent will quit running and stores the updated Agent
	// in the repository
	SetKillDate(epochDate int64)
	// SetMaxRetry updates the number of times the Agent can fail to check in before it quits running and stores the updated
	// Agent in the repository
	SetMaxRetry(retries int)
	// SetSkew updates the amount of jitter or skew added to the Agent's sleep or wait time and stores the updated Agent in
	// the repository
	SetSkew(skew int64)
	// SetSleep updates the amount of time the Agent will wait or sleep before it attempts to check in again and stores the
	// updated Agent in the repository
	SetSleep(sleep time.Duration)
	// SetStatusCheckIn updates the last time the Agent successfully communicated with the Merlin server and stores the
	// updated Agent in the repository
	SetStatusCheckIn(checkin time.Time)
}