EA for Rapid 7?

jwojda
Valued Contributor II

Does anybody have a way to look for Rapid 7 and it's version? it doesn't seem to put anything in the /Applications folder.

1 ACCEPTED SOLUTION

mm2270
Legendary Contributor II

I would probably do this

grep "Agent Info" /opt/rapid7/ir_agent/components/insight_agent/common/agent.log | tail -n1 | tr ' ' '
' | awk '/Version:/{getline; print}'

That should print out just 1.4.84 based on your example above. But you'll need to test it to see of course.

View solution in original post

7 REPLIES 7

jwojda
Valued Contributor II

this is how the rapid7 doc says to check the version number... what would be the easiest way to grab just the portion after "Version:"

Check the version number

sudo grep "Agent Info" /opt/rapid7/ir_agent/components/insight_agent/common/agent.log | tail -n1

The output should appear in the following form:

2018-03-20 18:03:02,434 [INFO] agent.agent_beacon: Agent Info -- ID: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Version: 1.4.84 (1519676870)

mm2270
Legendary Contributor II

I would probably do this

grep "Agent Info" /opt/rapid7/ir_agent/components/insight_agent/common/agent.log | tail -n1 | tr ' ' '
' | awk '/Version:/{getline; print}'

That should print out just 1.4.84 based on your example above. But you'll need to test it to see of course.

View solution in original post

jwojda
Valued Contributor II

awesome thank you @mm2270! Worked perfectly!

bmee
Contributor

I tried using this in EA and it doesn't seems to work but it works if i ran as a policy or root user in terminal. any idea what i'm doing wrong?

dmahase
New Contributor II

@bmee

#!/bin/sh
echo "<result>`grep "Agent Info" /opt/rapid7/ir_agent/components/insight_agent/common/agent.log | tail -n1 | tr ' ' '
' | awk '/Version:/{getline; print}'`</result>"

jkb
New Contributor III

I have a few EAs for Rapid 7 I've put together, including my take on the client version. Hopefully they are helpful.

Rapid7 Insight IRD ClientID

#!/bin/sh

# Report the version of the Rapid7 Agent if installed
# ClientIDs can be found in https://insight.rapid7.com/platform#/datacollection

if [ -e /opt/rapid7/ir_agent/ir_agent ]; then
    clientID=$(grep -Eio '"Client-ID":.*?[^\]"' /opt/rapid7/ir_agent/components/bootstrap/common/bootstrap.cfg | awk -F'[/:]' '{print $2}' | sed -e 's/[{"]/''/g')
else
    clientID="Agent Not Installed"
fi
# Report the result to the JSS.
echo "<result>$clientID</result>"

Rapid7 Insight IRD Bootstrap Component Version

#!/bin/bash

# Report the version of the Rapid7 Bootstrap Component if installed

# From Rapid7 Support:
# The agent has a bootstrap component that is running 1.2.x and this is the command and control for the agent, 
# it stops and starts the agent as well as updates it. The agent itself is the 2.7.x version, which is updated 
# more regularly for things like bug fixes and content patches and general improvements. 
# The bootstrap gets updated too but not as often.


if [ -e /opt/rapid7/ir_agent/ir_agent ]; then
    versionCheck=$(/opt/rapid7/ir_agent/ir_agent -version | awk '/SemanticVersion/ {print $2}' | sed s/"//g)
else
    versionCheck="Bootstrap Component Not Installed"
fi
# Report the result to the JSS.
echo "<result>$versionCheck</result>"

Rapid7 Insight IRD Agent Version

#!/bin/bash

# Report the version of the Rapid7 Agent if installed

# From Rapid7 Support:
# The agent has a bootstrap component that is running 1.2.x and this is the command and control for the agent, 
# it stops and starts the agent as well as updates it. The agent itself is the 2.7.x version, which is updated 
# more regularly for things like bug fixes and content patches and general improvements. 
# The bootstrap gets updated too but not as often.

if [ -e /opt/rapid7/ir_agent/ir_agent ]; then
    versionCheck=$(/opt/rapid7/ir_agent/components/insight_agent/insight_agent --version | awk '/Semantic/ {print $3}')
else
    versionCheck="Agent Not Installed"
fi
# Report the result to the JSS.
echo "<result>$versionCheck</result>"

Rapid7 Asset Info Last Collection Time

#!/bin/sh

# Report the value of the Rapid7 Agent's "asset_info_last_collection_time", which seems like a good proxy for client-to-server heartbeat

if [ -e /opt/rapid7/ir_agent/ir_agent ]; then
    lastCollected=$(date -r $(cat /opt/rapid7/ir_agent/components/insight_agent/common/config/agent.jobs.tem_realtime.json | awk '/asset_info_last_collection_time/ {print$2}' | sed s/,//g))
else
    lastCollected="Agent Not Installed"
fi
# Report the result to the JSS.
echo "<result>$lastCollected</result>"

Rapid7 Remote Execution Last Collection Time

#!/bin/sh

# Report the value of the Rapid7 Agent's "remote_execution_last_collection_time", which seems like a good proxy for when the client last checked for agent or metadata updates from Rapid7

if [ -e /opt/rapid7/ir_agent/ir_agent ]; then
    lastExecuted=$(date -r $(cat /opt/rapid7/ir_agent/components/insight_agent/common/config/agent.jobs.tem_realtime.json | awk '/remote_execution_last_collection_time/ {print$2}' | sed s/,//g))
else
    lastExecuted="Agent Not Installed"
fi
# Report the result to the JSS.
echo "<result>$lastExecuted</result>"

jkb

saikat_tripathi
New Contributor II

@dmahase Your solution worked for me. Thank you.