Secure scalable bi-directional command and control across networks
The disclosure provides an approach for inter-network command and control. Embodiments include receiving, by a proxy component of a service, from an agent of the service, a request to retrieve one or more action definitions. The agent may be located in a private networking environment, and the proxy component may be located in a networking environment external to the private networking environment. Embodiments include retrieving, by the proxy component, based on the request, the one or more action definitions from a queue associated with the service using a credential of the proxy component. Embodiments include providing, by the proxy component, the one or more action definitions to the agent. Embodiments include performing, by the agent, one or more actions within the private networking environment based on the one or more action definitions.
1 . A method of inter-network command and control, comprising:
receiving, by a proxy component of a remediation service, from an agent, a request to retrieve one or more action definitions, wherein:
the agent is located in a private networking environment having located therein one or more agents, the one or more agents comprising the agent;
each of the one or more action definitions corresponds to one of a plurality of actions to be performed within the private networking environment by the one or more agents to remediate one or more issues detected within the private networking environment; and
the proxy component is located in a networking environment external to the private networking environment;
receiving, by the proxy component and from the agent, a token to the remediation service for authenticating the agent;
retrieving, by the proxy component, based on the request, the one or more action definitions from a queue associated with the remediation service using a credential of the proxy component;
providing, by the proxy component, the one or more action definitions to the agent wherein the one or more action definitions cause the agent to perform one or more of the plurality of actions within the private networking environment based on the one or more action definitions.
2 . The method of claim 1 , wherein the request is received by the proxy component via an application programming interface (API) gateway associated with the remediation service.
3 . The method of claim 1 , wherein the one or more agents are part of an agent group, and wherein the agent group comprises a plurality of agents that run in the private networking environment.
4 . The method of claim 1 , further comprising authenticating the agent via the token.
5 . The method of claim 1 , wherein the private networking environment is configured to allow the agent to access one or more resources in the private networking environment and to deny direct access to the remediation service to the one or more resources.
6 . The method of claim 1 , wherein the one or more action definitions comprise one or more checksums corresponding to code of the agent for performing the one or more actions is consistent with the one or more checksums.
7 . The method of claim 6 , further comprising generating, by the remediation service, the one or more checksums based on one or more sections of code sent by the agent to the service.
8 . The method of claim 6 , wherein the one or more action definitions cause the agent to perform the one or more actions only if the code of the agent for performing the one or more actions is consistent with the one or more checksums.
9 . A system for inter-network command and control, the system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing instructions executable by the one or more processors to perform operations comprising:
receiving, by a proxy component of a remediation service, from an agent, a request to retrieve one or more action definitions, wherein:
the agent is located in a private networking environment having located therein one or more agents, the one or more agents comprising the agent;
each of the one or more action definitions corresponds to one of a plurality of actions to be performed within the private networking environment by the one or more agents to remediate one or more issues detected within the private networking environment; and
the proxy component is located in a networking environment external to the private networking environment;
receiving, by the proxy component and from the agent, a token to the remediation service for authenticating the agent;
retrieving, by the proxy component, based on the request, the one or more action definitions from a queue associated with the remediation service using a credential of the proxy component;
providing, by the proxy component, the one or more action definitions to the agent
wherein the one or more action definitions cause the agent to perform one or more of the plurality of actions within the private networking environment based on the one or more action definitions.
10 . The system of claim 9 , wherein the request is received by the proxy component via an application programming interface (API) gateway associated with the remediation service.
11 . The system of claim 9 , wherein the one or more agents are part of an agent group, and wherein the agent group comprises a plurality of agents that run in the private networking environment.
12 . The system of claim 9 , wherein operations further comprise authenticating the agent via the token.
13 . The system of claim 9 , wherein the private networking environment is configured to allow the agent to access one or more resources in the private networking environment and to deny direct access to the remediation service to the one or more resources.
14 . The system of claim 9 , wherein the one or more action definitions comprise one or more checksums corresponding to code of the agent for performing the one or more actions is consistent with the one or more checksums.
15 . The system of claim 14 , wherein the operations further comprise, generating, by the service, the one or more checksums based on one or more sections of code sent by the agent to the service.
16 . One or more non-transitory computer-readable media storing instructions executable by the one or more processors to perform operations comprising:
receiving, by a proxy component of a remediation service, from an agent, a request to retrieve one or more action definitions, wherein:
the agent is located in a private networking environment having located therein one or more agents, the one or more agents comprising the agent;
each of the one or more action definitions corresponds to one of a plurality of actions to be performed within the private networking environment by the one or more agents to remediate one or more issues detected within the private networking environment; and
the proxy component is located in a networking environment external to the private networking environment;
receiving, by the proxy component and from the agent, a token to the remediation service for authenticating the agent;
retrieving, by the proxy component, based on the request, the one or more action definitions from a queue associated with the remediation service using a credential of the proxy component;
providing, by the proxy component, the one or more action definitions to the agent wherein the one or more action definitions cause the agent to perform one or more of the plurality of actions within the private networking environment based on the one or more action definitions.
17 . The one or more non-transitory computer-readable media of claim 16 , wherein the request is received by the proxy component via an application programming interface (API) gateway associated with the remediation service.
18 . The one or more non-transitory computer-readable media of claim 16 , wherein the one or more action definitions comprise one or more checksums corresponding to code of the agent for performing the one or more actions is consistent with the one or more checksums.
19 . The one or more non-transitory computer-readable media of claim 18 , further comprising generating, by the remediation service, the one or more checksums based on one or more sections of code sent by the agent to the service.
20 . The one or more non-transitory computer-readable media of claim 19 , wherein the one or more action definitions cause the agent to perform the one or more actions only if the code of the agent for performing the one or more actions is consistent with the one or more checksums.