Agent Client Collector for Visibility Content reference

Review this information for details on OS query scripts, data collected, and definition of terms.

OS module scripts for Agent Client Collector for Visibility Content (ACC-VC)

These platform-specific plugins invoke platform-specific module scripts. Each script outputs to a standard JSON payload regardless of the platform.

Note:

running_processes.rb and tcp_connections.rb are interdependent. For an efficient Discovery, keep both tcp_connections.rb and running_processes.rb together. Both the files are needed to get the complete data. If one is not there, it will not populate the other data.

To fetch information about all the running_processes on the macOS, you must provide sudo access to osquery. If this configuration is not made, then running_processes.rb will only fetch what is triggered by _servicenow user. For tcp_connections.rb, you must add ‘sudo lsof’ command in the sudoers file. If this is not done, tcp_connections.rb will only fetch what is triggered by _servicenow user.

Data collected

ACC-VC uses the same classification criteria as IP-based Discovery for classifying as computer or server. The subset of collected data includes the following categories:

• Basic inventory – Starting with ACC-F version 2.10.1, this will not be used.
• Data collection - Collects the necessary data for classification and identification of a host CI. This includes host name, serial numbers, and OS information.
• Installed Software – cmdb_sam_sw_install (if SAM enabled) and cmdb_software_instance (if SAM not enabled)
• File Systems – cmdb_ci_file_system
• Storage Devices – cmdb_ci_disk and cmdb_ci_storage_device
• Serial Numbers – cmdb_serial_number
• Network Adapters – cmdb_ci_network_adapter and cmdb_ci_ip_address
• TCP Connections – cmdb_tcp
• Running Processes – cmdb_running_process (ACC-VC also classifies the running processes and creates application CIs in cmdb_ci_appl, where possible)
• Local User – cmdb_os_user (Populates the local users for all the Operating Systems that ACC-VC supports by adding a new module called local_user​)
• Enhanced inventory – Collects enhanced data (such CPU info, start_date, object_id) which is not necessary for identifying a unique host.

Agent Client Collector terms

• Agent Client Collector (ACC)

  The software component installed on target hosts that communicates with the MID Server. Sometimes referred to as Agent. This component is a ServiceNow derivative of Sensu-Go.

• Agent Client Collector Framework (ACC-F)

  A ServiceNow base scoped application that leverages ACC and provides core capabilities (including Check Types, Check Definitions, Policies, and so on) enabling other ACC scoped applications, including ACC-M and ACC-VC.

• Agent Client Collector Monitoring Monitoring (ACC-M)

  A ServiceNow scoped application enabling monitoring use cases.

• Agent Client Collector for Visibility Content (ACC-VC)

  A ServiceNow scoped application that implements push-based Discovery leveraging ACC and ACC-F.

• Horizontal IP-based Discovery

  Traditional Discovery available to customers prior to ACC-VC. It discovers data via Probes and Patterns through the MID Server, requiring the Discovery Plugin.

• Modules

  A subset of discovered data that is populated as part of Discovery. Examples of Modules include: Data Collection, Installed Processes, Serial Numbers, File Systems, Storage Devices, Network Adapters, Running Processes, and TCP Connections.

• Push-based Discovery

  Discover data via ACC, ACC-F, ACC-VC, and the MID Server with a direct push of data from the target host. Discovery does not require specific IP range configuration on a Discovery Schedule or providing Discovery Credentials for target host.

• Sensu-Go agent

  The Free and Open Source project which ACC is derived from.

• Virtual Machine Instance

  A virtual target host running inside of a hypervisor, either on-premise or within a cloud service provider like AWS, GCP, or Microsoft Azure.

• Virtual Machine Image

  A snapshot of a live virtual machine instance persisted to a file system or cloud storage.

• Agent Client Collector for Visibility Content default checks and policies
  Agent Client Collector for Visibility Content (ACC-VC) provides various checks and policies as well as a business rule.

• Agent Client Collector MID-less installation command parameters
  Description of the command line parameters used during MID-less Agent Client Collector installation.
• Data collected during Agent Client Collector for Visibility Content File-Based Discovery
  The following tables describe the data collected during Agent Client Collector for Visibility Content file-based Discovery.
• Software edition configuration fields
  Description of the software edition configuration fields in use when identifying the edition of Windows software.
• Agent Client Collector File-Based Discovery properties
  Configure File-Based Discovery behavior using system properties that control scanning paths, performance throttling, and file filtering options.
• Web usage data collection tables and fields
  Description of the tables and their fields used when gathering web usage data from your Windows and macOS machines.
• Archive file scanning filtering rules and limits
  Reference information for the filtering rules and performance safeguards that apply when Agent Client Collector for Visibility Content scans ZIP and JAR archive files during File-Based Discovery.
• License key discovery and access control tables
  Reference information for the tables, fields, access control, and scheduled job used by license key discovery in Agent Client Collector for Visibility Content.
• Running process-based discovery platform coverage and properties
  Platform coverage identifies which operating systems are supported and what privileges the agent needs for full coverage. The system property controls whether the feature is enabled or disabled.

Parent Topic:Agent Client Collector reference