agent

Documentation

Index

• type Agent
  • func NewAgent(id uuid.UUID, alive bool, authenticated bool, build Build, host Host, ...) *Agent
  • func (a *Agent) Alive() bool
  • func (a *Agent) Authenticated() bool
  • func (a *Agent) Build() Build
  • func (a *Agent) Comms() Comms
  • func (a *Agent) Groups() []string
  • func (a *Agent) Host() Host
  • func (a *Agent) ID() uuid.UUID
  • func (a *Agent) Initial() string
  • func (a *Agent) Links() []string
  • func (a *Agent) Listener() string
  • func (a *Agent) Note() string
  • func (a *Agent) Padding() int32
  • func (a *Agent) Process() Process
  • func (a *Agent) Status() string
  • func (a *Agent) StatusCheckin() string
• type Build
• type Comms
• type Host
• type Process

Types

type Agent

type Agent struct {
	// contains filtered or unexported fields
}

func NewAgent

func NewAgent(id uuid.UUID, alive bool, authenticated bool, build Build, host Host, process Process, comms Comms, initial string, checkin string, linkedAgents []string, listener string, note string, status string, groups []string) *Agent

func (*Agent) Alive

func (a *Agent) Alive() bool

Alive returns true if the Agent is actively in use and false if the agent has been killed or removed

func (*Agent) Authenticated

func (a *Agent) Authenticated() bool

Authenticated checks to see if the agent has successfully completed authentication

func (*Agent) Build

func (a *Agent) Build() Build

Build returns the Agent's embedded Build entity structure Contains the agent's build and version number

func (*Agent) Comms

func (a *Agent) Comms() Comms

Comms returns the Agent's embedded Comms entity structure Contains things like kill date, message padding size, transport protocol, skew, and sleep time

func (*Agent) Groups

func (a *Agent) Groups() []string

Groups returns a list of groups the Agent is a member of

func (*Agent) Host

func (a *Agent) Host() Host

Host returns the Agent's embedded Host entity structure Contains information about the host the Agent is running on such as hostname, operating system, architecture, and IP addresses

func (*Agent) ID

func (a *Agent) ID() uuid.UUID

ID return's the Agent's unique ID

func (*Agent) Initial

func (a *Agent) Initial() string

Initial returns the timestamp from when the Agent was first seen

func (*Agent) Links

func (a *Agent) Links() []string

Links return a list of linked Agent IDs where this agent is the parent, and the list of Agents is the children

func (*Agent) Listener

func (a *Agent) Listener() string

Listener returns the unique identifier of the Listener that the agent belongs to The associated listener determines Agent traffic encryption/encoding and delivery mechanism

func (*Agent) Note

func (a *Agent) Note() string

Note returns the value of the Agent's note field

func (*Agent) Padding

func (a *Agent) Padding() int32

Padding returns the Agent's communication profile message padding size

func (*Agent) Process

func (a *Agent) Process() Process

Process returns the Agent's embedded Process entity structure Contains information about the process the Agent is running in/as such as process ID, name, username, domain, and integrity level

func (*Agent) Status

func (a *Agent) Status() string

Status returns the Agent's status

func (*Agent) StatusCheckin

func (a *Agent) StatusCheckin() string

StatusCheckin returns a time stamp of when the agent last checked in

type Build

type Build struct {
	Build   string // The agent's build hash
	Version string // The agent's version number
}

Build is a structure that holds information about an Agent's compiled build hash and the Agent's version number

type Comms

type Comms struct {
	Failed  int32  // The number of times the agent has failed to check in
	JA3     string // The ja3 signature applied to the agent's TLS client
	Kill    int64  // The epoch date and time that the agent will kill itself and quit running
	Padding int32  // The maximum amount of padding that will be appended to the Base message
	Proto   string // The protocol the agent is using to communicate with the server
	Retry   int32  // The maximum amount of times an agent will retry to check in before exiting
	Skew    int64  // The amount of skew, or jitter, used to calculate the check in time
	Wait    string // The amount of time the agent waits before trying to check in
}

Comms is a structure that holds information about an Agent's communication profile

type Host

type Host struct {
	Architecture string   // The operating system architecture the agent is running on (e.g., x86 or x64)
	Name         string   // The host name the agent is running on
	Platform     string   // The platform, or operating system, the agent is running on
	IPs          []string // A list of interface IP addresses on the host where the agent is running
}

Host is a structure that holds information about the Host operating system an Agent is running on

type Process

type Process struct {
	ID        int32  // The process ID that the agent is running in
	Integrity int32  // The integrity level of the process the agent is running in
	Name      string // The process name that the agent is running in
	UserGUID  string // The GUID of the user that the agent is running as
	UserName  string // The username that the agent is running as
	Domain    string // The domain the user running the process belongs to
}

Process is a structure that holds information about the Process the Agent is running in/as