Fine-grained access to system commands run via an installed agent application
The present disclosure provides techniques for fine-grained access to system commands run via an installed agent application. A processing device receives, from an agent application, a user identifier and an indication of an agent application command with respect to a target endpoint, wherein the agent application command is included in a plurality of agent application commands assigned to a first user type that is different from a second user type corresponding to the user identifier. The processing device maps the agent application command to a permission level assigned to the agent application command. The processing device determines, based on the mapping, that the permission level is assigned to the user identifier. The processing device enables, based on the determination, the agent application to execute the agent application command with respect to the target endpoint.
1 . A method, comprising:
receiving, from an agent application, a user identifier and an indication of an agent application command with respect to a target endpoint, wherein the agent application command is included in a plurality of agent application commands assigned to a first user type that is different from a second user type corresponding to the user identifier;
determining that the second user type lacks permission to execute the plurality of agent application commands assigned to the first user type;
mapping, by a processing device, the agent application command to a permission level assigned to the agent application command based on the determination that the second user type lacks the permission;
determining, based on the mapping, that the permission level is assigned to the user identifier; and
enabling, based on the determination that the second user type lacks the permission to execute the plurality of agent application commands and based the determination that the permission level is assigned to the user identifier, the agent application to execute the agent application command with respect to the target endpoint.
2 . The method of claim 1 , wherein the agent application comprises a cybersecurity agent application, and wherein the agent application command comprises a cybersecurity-associated command.
3 . The method of claim 1 , wherein the enabling the agent application to execute the agent application command with respect to the target endpoint comprises:
transmitting, to a sensor application on the target endpoint, the indication of the agent application command;
receiving, from the target endpoint, an indication of an execution of the agent application command; and
transmitting, to the agent application, the indication of the execution of the agent application command.
4 . The method of claim 1 , wherein the agent application command is assigned to a string comprising the indication of the agent application command and the permission level, and wherein the mapping the agent application command to the permission level is based on the string.
5 . The method of claim 1 , further comprising:
assigning the permission level to the agent application command prior to the receiving the user identifier and the indication of the agent application command from the agent application, wherein the determination that the permission level is assigned to the user identifier is based on the assignment.
6 . The method of claim 1 , further comprising:
receiving a request to assign the user identifier to the permission level assigned to the agent application command;
transmitting, to an administrator device, the request;
receiving, from the administrator device, an acceptance of the request; and
assigning the user identifier to the permission level assigned to the agent application command, wherein the determination that the permission level is assigned to the user identifier is based on the assignment.
7 . The method of claim 1 , wherein the agent application command comprises a read-only command.
8 . The method of claim 1 , wherein the agent application command comprises at least one of:
a file extraction command;
a state modifying command; or
a preconfigured script running command.
9 . The method of claim 1 , wherein the agent application command comprises at least one of:
a custom script running command;
an upload command;
a download command; or
an executable running command.
10 . The method of claim 1 , wherein the enabling the agent application to execute the agent application command with respect to the target endpoint comprises:
transmitting, to a sensor application on the target endpoint, an indication that the agent application has permission to execute the agent application command.
11 . A system, comprising:
a processing device; and
a memory to store instructions that, when executed by the processing device, cause the processing device to:
receive, from an agent application, a user identifier and an indication of an agent application command with respect to a target endpoint, wherein the agent application command is included in a plurality of agent application commands assigned to a first user type that is different from a second user type corresponding to the user identifier;
determine that the second user type lacks permission to execute the plurality of agent application commands assigned to the first user type;
map the agent application command to a permission level assigned to the agent application command based on the determination that the second user type lacks the permission;
determine, based on the mapping, that the permission level is assigned to the user identifier; and
enable, based on the determination that the second user type lacks the permission to execute the plurality of agent application commands and based the determination that the permission level is assigned to the user identifier, the agent application to execute the agent application command with respect to the target endpoint.
12 . The system of claim 11 , wherein the agent application command comprises a read-only command.
13 . The system of claim 11 , wherein the agent application comprises a cybersecurity agent application, and wherein the agent application command comprises a cybersecurity-associated command.
14 . The system of claim 11 , wherein the instructions, when executed by the processing device, further cause the processing device to:
assign the permission level to the agent application command prior to the reception of the user identifier and the indication of the agent application command from the agent application, wherein the determination that the permission level is assigned to the user identifier is based on the assignment.
15 . The system of claim 11 , wherein the agent application command comprises at least one of:
a file extraction command;
a state modifying command; or
a preconfigured script running command.
16 . The system of claim 11 , wherein the agent application command comprises at least one of:
a custom script running command;
an upload command;
a download command; or
an executable running command.
17 . A non-transitory computer readable medium, having instructions stored thereon which, when executed by a processing device, cause the processing device to:
receive, from an agent application, a user identifier and an indication of an agent application command with respect to a target endpoint, wherein the agent application command is included in a plurality of agent application commands assigned to a first user type that is different from a second user type corresponding to the user identifier;
determining that the second user type lacks permission to execute the plurality of agent application commands assigned to the first user type;
map, by the processing device, the agent application command to a permission level assigned to the agent application command based on the determination that the second user type lacks the permission;
determine, based on the mapping, that the permission level is assigned to the user identifier; and
enable, based on the determination that the second user type lacks the permission to execute the plurality of agent application commands and based the determination that the permission level is assigned to the user identifier, the agent application to execute the agent application command with respect to the target endpoint.
18 . The non-transitory computer readable medium of claim 17 , wherein the agent application command comprises at least one of:
a file extraction command;
a state modifying command; or
a preconfigured script running command.
19 . The non-transitory computer readable medium of claim 17 , wherein the agent application comprises a cybersecurity agent application, and wherein the agent application command comprises a cybersecurity-associated command.
20 . The non-transitory computer readable medium of claim 17 , wherein
the instructions, when executed by the processing device, cause the processing device further to:
assign the permission level to the agent application command prior to the reception of the user identifier and the indication of the agent application command from the agent application, wherein the determination that the permission level is assigned to the user identifier is based on the assignment.