Insight Agents Enumerate Software and Ports, NOT Services!
I’m left scratching my head why the Insight agents can collect installed software and ports/processes information, but do not collect services.
However, the port information is in fact collected from an Insight agent and available on the Security Console side. But it is not synced with the Insight platform and therefore query builder and goals and sla’s cannot be used to report on port data.
It would be valuable to have services and port information from Insight agents on the Analytics side to get value out of Goals and SLA’s and run queries.
IDEA Tickets Created:
- Sync asset port enumeration data to Insight platform for use with Query Builder and Goals & SLA’s. For example, having a Goal to ensure vulnerable LLMNR and NBNS ports are disabled on Win assets.
- Since the Insight agent is already enumerating software installed and ports, add the ability to enumerate services as well.