What is the Agent Management Console (AMC)?

The AMC is a tool within the Snare Central Server that enables remote management of Snare Agents through the Snare Central Server interface.

The AMC enables administrators to set up automatic audits of the configuration of Agents within their fleet. The administrators specify a Master Configuration, which represents the required configuration of the fleet Agents. This Master Configuration is then compared to the actual configuration of each of the Agents within their network based on the filters in the AMC objective. Any discrepancies that are found are listed, and alerts sent out as required. Any Agents that were uncontactable during the process are also identified in the relevant tab. The results of these configuration audits provide information to the administrators that can be used to identify if the configurations of any Agents have been unexpectedly modified vs the approved master configuration. 

The AMC also provides the ability to push the specified Master Configuration out to each of the Agents under management to enable fleet-wide configuration changes from a centralized location. This also ensures that any unauthorized configuration changes on the Agents are reverted automatically and updated based on the approved master template. 

Snare Agents that are reporting directly to the Snare Central Server are automatically detected by the AMC. For other situations where there are Agents that are not reporting directly to the Snare Central Server, a list of custom Agents can be manually added into the AMC using the non-reporting agent options in the AMC configurationm where the AMC can scan the network on specific IP ranges looking for Snare agents.

What the Console CAN do

The Agent Management Console allows you to create as many Management Objectives as is required in your environment via the right click clone feature. These objectives allow you to:

• Manage any compatible Snare Agent, even if it is not directly reporting to the Snare Central Server.
  • Snare Agents reporting to the Snare Central Server (via ports 6161, 6162, 6163) will be automatically identified and treated as a reporting Agent.
  • Snare Agents not reporting to the Snare Central Server can be manually added within the Management Objective configuration, as a non-reporting Agent. After manually specifying these Agents, the management functionality available is exactly the same as a reporting Agent.
• Specify the specific type of Agent to be managed (to ensure configurations aren't corrupted by passing the wrong configuration).
• Pull the current configuration from any of the compatible Snare Agents within your environment.
  • Either by filtering Agents that report event logs to the Snare Central Server by hostname and/or version,
  • Or by specifying non-reporting Agents manually by IP (or IP range).
• Pull current configuration from a specific Master Agent to compare against the managed Agent configurations.
• Optionally push the master configuration out to each of the managed Agents that support push, to sync configurations to a single approved configuration.
• Set a specific schedule to run the configuration check/sync process.
• Send email alerts when Agents are uncontactable and/or have a different configuration.

What the Console CANNOT do

• The Agent Management Console currently only manages Agent Configurations for compatible Enterprise Agents.
• It does not provide the ability to install and/or upgrade the Agent software. Upgrades of the agents can be performed by the Snare Agent Manager (SAM) from version 1.2 onwards. 
• It will only work on Agents that have the Remote Management function enabled, without this, the Console cannot communicate with the Agent.
• All communication is initiated by the Server, so firewall rules must be in place to allow the Server to connect to each Agent.
• The Console cannot monitor/wait for an Agent to come online - if it is not online when the check/sync is triggered, it will be considered uncontactable.

Snare Agent Compatibility 

Agent	Version(s)	Config Pull	Config Push
Enterprise - Snare Agent for Windows	v4.1.x, v5.x
Enterprise - Snare Agent for Windows	v4.0.2.x
Enterprise - Snare Agent for Windows	v4.0.0.0, v4.0.1.x
Enterprise - Snare Epilog	v5.x.x
Enterprise - Snare for MSSQL	v5.x.x
Enterprise - Snare Agent for Linux	v5.x.x
Enterprise - Snare Agent for Solaris	v5.x.x
Enterprise - Mac OSX Agent	v5.x.x
Enterprise - Snare Agent for Linux	v1, v2.1, v3, v4
Enterprise - Snare Agent for Solaris	v3.x, v4.x
Enterprise - Mac OSX Agent	v1.x
Open Source - Snare Agent/Epilog	any

Notes:

• Compatibility table refers to Snare Central Server v7.x.x only.
• "Config Pull" means Agent Configuration can be retrieved from the Agent by the Server.
• "Config Push" means Agent Configuration can be updated by the Server on the Agent.