CyberSift Tutela FAQs

1. Login to the Tutela admin portal and note your API key, or create a new one

   
2. Edit the "Agent Targets" and enter the targets the agent should scan:

   

   Targets should be inserted each on a seperate line, and format may be:
   • A single IP Address
   • An IP subnet (example: 192.168.1.0/24)
   • A domain name (example: scanme.nmap.org)
3. Run following on a server where docker is installed:

   docker run dvassallocs/tutela --api_key <INSERT_YOUR_API_KEY_HERE>

Output from network scans are used to populate a database of assets. Each asset is fingerprinted and where possible the asset is tagged with:

1. type of device (e.g. windows, linux, server, etc...)
2. Public / Private IP
3. Newly Detected Asset

Each asset is given a "state" (see next FAQ for more details) and the dashboard allows you to easily query assets in different states for easy reporting and compliance checks

A network asset can take on one of three states:

When an asset is initially detected, it is put in the "unseen" state. This indicates to analysts that the asset hasn't been reviewed yet. Once an asset is detected, an analyst can put the asset state to "under investigation" while appropriate checks are carried our to see if said asset is to be allowed on the network. Tutela allows the analyst to store "notes" pertaining to the asset to add better context to the asset. Once investigations are completed, the asset can be moved to "authorized" to indicate concluded investigations.

The agent is packaged as a single linux container, hence it only requires a valid docker environment. If you run a windows host docker server, you will need to have either WSL2 or Hyper-V enabled. If this is not possible for some reason, please see the procedure outlined in "How do I install the native windows network scanner?"

You can do this by executing the following on a server where docker is installed:

docker pull dvassallocs/tutela

The docker method outlined above is the easier and more convenient option, however there are some cases when you'd like to install the network scanner on a windows server which doesn't support running linux docker containers. In this case an alternative native windows agent is provided which has a slightly more involved (though still easy) installation process:

1. Install python 3 for windows from the official download page
2. Add the python path to the system environment variables
3. Test that the above worked by opening a NEW admin powershell prompt and running the command python.
   This should successfully open a python prompt
4. Download and install the NMAP scanner for windows from their official site
5. Download the windows native scanner
6. Extract the zip file to a convenient location (e.g. C:\Users\administrator), and open an admin powershell prompt in this directory
7. If necessary, modify the powershell execution policy to allow for script execution (e.g. "Set-ExecutionPolicy Unrestricted")
8. Execute the PS script windows_installer.ps1
   This should complete without any errors
9. Test successfull installation by opening a new shell and completing the following two commands succesfully:
   • nmap
   • C:\your-path-here\tutela-windows-network-scanner\agent.exe

There are two options to accomplish this:

• Use the "setup wizard"
• Manually via the Agents section

There are two options to accomplish this:

• Via the web portal (recommended)
• Via the agent command line interface

Targets will then be automatically pushed to the agent on the next scan.

Adding targets via the CLI involves using the following command line arguments when running the agent (see this FAQ):-targets string
    targets seperated by spaces enclosed within quotes (e.g. "8.8.8.8 4.2.2.2")
-targets_file string
    targets file

Excluding targets via the web portal is done by simply prepending the target with a negative sign: "-", for example:
-192.168.1.2

In the example above, 192.168.0.0/24 subnet will be scanned, except for 192.168.1.1. Targets will then be automatically excluded in the next scan.

Yes! Since you are not limited in the number of agents and corresponding API keys you can generate, it is possible and encouraged that you:

1. Generate an agent to be used for internal scanning with "Targets" set to internal addresses such as "192.168.0.0/24"
2. Generate an agent to be used for external scanning with "Targets" set to external addresses such as "scanme.nmap.org"

Recommended Use :

docker run -v "$(pwd)/results:/app/results" dvassallocs/tutela --api_key INSERT_API_KEY_HERE

docker run dvassallocs/tutela --help
              
CyberSift Tutela Agent
======================

Usage of ./csVasAgentLinux:
-api_key string
      Use an api key instead of public IP (contact support)
-mass_scan
      Enable Mass Scanning (WARNING: this will increase the scanning time considerably and SHOULD NOT be carried out over the internet)
-max_connections int
      maximum simultaneous connections to open during scanning (default 500) (default 500)
-port_timeout int
      maximum port timeout to use during scanning (default 50ms). Bigger values are more accurate but scans take longer (default 50)
-scan
      run scan (default true)
-scan_name string
      scan name (default "cs-vas")
-targets string
      targets seperated by spaces enclosed within quotes (e.g. "8.8.8.8 4.2.2.2")
-targets_file string
      targets file  
              

The vulnerability assessment tool will display all appropriate CVEs. However, a common problem is the sheer number of CVEs which are published on a daily baisis. In order to help you cut through the noise and prioritize those vulnerabilities that really matter, we also check exploit databses for vulnerabilites which have exploit code vailable to them as this significantly increases the chances of said vulnerability being successfully attacked. This is a known way of properly prioritizing which CVEs should be addressed first:

• When it comes to vulnerability triage, ditch CVSS and prioritize exploitability

The easiest way of doing this is to add a cron job which calls the Tutela Agent container perdiocally. For example:

0 1 20 * * docker run dvassallocs/tutela --api_key INSERT_YOUR_API_KEY

The above cronjob will launch a scan on the 20th day of every month

In some cases after a network vulnerability scan you would see entries similar to the following, with "CVE" set to "CS-VER-UNKNOWN":

TL;DR: this means the scanner was unable to determine the version of software running, and such alerts can in general be safely resolved or ignored

The reason the above appear is to alert you to the fact that the agent is unable to determine the version of software running on the given port. In the above screenshot example, the product was determined to be "NGINX", however the version could not be determined. Rather than spamming you with inaccurate vulnerability entries, the scanner generates a "meta-alert" named "CS-VER-UNKONWN" (a.k.a CyberSift-VERsion-UNKNOWN). The alert is not necessarily a bad indicator, in fact during many pentesting engagements customers are encouraged to disabled headers and other data which can leak information such as version numbers that may aid an attacker.

By default, a unique name is generated by the agent whenever a scan is uploaded. You can influence the name that is generated by using:

-scan_name insert-scan-name-here

as an additional argument whenever you call the agent.

The above argument is valid for both infrastructure and web application scans

Sentinel Mode places any given agent into a special mode which allows it to scan all private IP subnets continuously. This allows you to continously monitor all your internal network without any pre-configured schedule or any pre-configured tagets. This mode is meant to aid in network discovery and in scenarios where you would like to periodically and randomly crawl your entire network to make sure nothing changes without you being alerted. At the moment, the WebUI only supports configuring agents in either Sentinel or 'normal' mode. However you can run agents in both Sentinel and normal mode on the same server using the CLI. No configuration is needed on the agent to run in 'Sentinel Mode', at the cost of flexibility in assigning targets and schedules to your scans.

Host based scanning is similar to network-based scanning, however instead of a docker-based agent which probes your network, this approach uses an agent which is installed directly on a PC or server. This give you even greater visibility into your infrastructure as a host based agent is able to enumerate software which is installed on a given PC/Server and detect any CVEs for that software. The host based scanning feature allows you to:

• Keep track of what software is installed in your environment
• Keep track of which users are given administrative access to each host the agent is installed on
• Enumerate known CVEs which affect the software installed on a host
• Check for missing security best practices against the NIST Risk Management Framework SP 800 standard(Currently Linux Redhat/Centos only, more OS coming soon)

The Windows MSI can be downloaded from:

https://csinstallscripts.blob.core.windows.net/cs-vas/tutela.msi

Running the agent is very straightforward. Simply run the below command from an elevated privilege command prompt:

C:\Program Files (x86)\Tutela Windows Agent\winAgent.exe --api_key INSERT_YOUR_API_KEY

Scheduling the agent to run periodically can be easily accomplished using a windows scheduled task setup manually (for an example see below) or setup via an appropriate Group Policy Object

SCHTASKS /CREATE /RU "NT AUTHORITY\SYSTEM" /RL HIGHEST /NP /SC WEEKLY /D SUN /TN "Tutela\weekly" /TR "'C:\Program Files (x86)\Tutela Windows Agent\winAgent.exe' --api_key KEYHERE" /ST 03:00"

The linux agent is supplied as single binary and can be downloaded from:

https://csinstallscripts.blob.core.windows.net/cs-vas/TutelaLinuxAgent

Running the agent is very straightforward. Simply run the below command from a root terminal:

./TutelaLinuxAgent -api_key INSERT_YOUR_API_KEY

The agent does not need to be "installed", simply executed, and can be run on a schedule using CRON. An example provisioning bash script which downloads, and schedules the scan is provided below:

#!/bin/bash

export HTTP_PROXY=http://change-or-remove.proxy.com
export HTTPS_PROXY=http://change-or-remove.proxy.com

cd /usr/local/bin
wget https://csinstallscripts.blob.core.windows.net/cs-vas/TutelaLinuxAgent
chmod +x TutelaLinuxAgent

echo '''#!/bin/bash 
/usr/local/bin/TutelaLinuxAgent -api_key INSERT_YOUR_API_KEY''' > /etc/cron.monthly/tutela.sh
chmod +x /etc/cron.monthly/tutela.sh

Library based scanning is a module included in the host agent. It allows you to scan development "artifacts" for known vulnerabilities (like the infamous Log4jShell) The following is a non-exhaustive list of support "artifacts":

• Java: JAR, WAR
• NodeJS: yarn.lock
• Python: Pipfile.lock, requirements.txt

At the moment, only Linux servers are supported. The library vulnerability scan is included in the linux host agent, so make sure the agent is installed on a linux server, by running the following command:

curl -o TutelaLinuxAgent https://csinstallscripts.blob.core.windows.net/cs-vas/TutelaLinuxAgent && chmod +x TutelaLinuxAgent

Running the agent is straightforward, you simply need to specify your API key and the directory wherein the artifact resides, for example:

./TutelaLinuxAgent -api_key YOUR_API_KEY -artifact_directory /home/tutelaTest

By default, results are reported back to the Tutela online dashboard, however you have the option to save the results locally in JSON format by using the following:

./TutelaLinuxAgent -api_key YOUR_API_KEY -artifact_directory /home/tutelaTest -artifcat_local_output results.json

Scheduling the agent to run periodically can be easily accomplished using a cron job with the above command

Docker is a virtualization system based on the concept of "containers". Each container is in effect a self contained operating system, running underneath the supervision of the host server running docker. As such, each container can include it's own vulnerabilities depending on which image is used. For example, a container based on an Ubuntu image would need to be checked for Ubuntu-specific vulnerabilities. Each container would also need to be scanned for library vulnerabilities (see "Supply Chain scanning" above).

At the moment, only Linux servers are supported. The docker image vulnerability scan is included in the linux host agent, so make sure the agent is installed on a linux server, by running the following command:

curl -o TutelaLinuxAgent https://csinstallscripts.blob.core.windows.net/cs-vas/TutelaLinuxAgent && chmod +x TutelaLinuxAgent

Before running the scan, you need to "export" or "save" the docker container which is to be scanned. Doing this is straightforward. On the docker host server:

docker save --output XYZ.tar container_name:tag

Running the agent is straightforward, you simply need to specify your API key and the TAR file from the step above, for example:

./TutelaLinuxAgent -api_key YOUR_API_KEY -artifact_directory YOUR_TAR_FILE.tar

By default, results are reported back to the Tutela online dashboard, however you have the option to save the results locally in JSON format by using the following:

./TutelaLinuxAgent -api_key YOUR_API_KEY -artifact_directory YOUR_TAR_FILE.tar -artifcat_local_output results.json

Scheduling the agent to run periodically can be easily accomplished using a cron job with the above command

Web Application scanning allows you to test for common web application vulnerabilities such as the OWASP Top 10. The web application scanner is shipped as a seperate docker agent which can very easily be setup to scan multiple websites, and configured to scan periodically. The results are then uploaded to the Tutela dashboard to give you a single view of all vulnerabilities detected across your infrastructure.

• Improve your security by adding missing best-practice HTTP headers to your setup
• Avoid common HTML / Javascript vulnerabilites such as Injection, Broken Authentication and XSS
• Map alerts to MITRE CWEs

You can do this by executing the following on a server where docker is installed:

docker pull dvassallocs/tutela-web-scanner

You can do this by executing the following on a server where docker is installed:

docker run dvassallocs/tutela-web-scanner --targets 'https://scanme.nmap.org/, https://public-firing-range.appspot.com/' -api <INSERT_YOUR_API_KEY>

docker run dvassallocs/tutela-web-scanner --targets 'https://scanme.nmap.org/, https://public-firing-range.appspot.com/' -api <INSERT_YOUR_API_KEY> -active true

docker run --mount type=bind,source='/demo/demo/TutelaTestPlans',target=/zap/testPlans dvassallocs/tutela-web-scanner --targets 'https://scanme.nmap.org/, https://public-firing-range.appspot.com/' -api <INSERT_YOUR_API_KEY> -active true

Cloud Provider Integration is used to enumerate resources which are provisioned in your Cloud Provider, giving you greater visibility into your infrastructure. The cloud provider integration currently supports the following providers:

• Azure Compute
• Amazon Web Services EC2

AWS Integration involves creating an App ID and secret for a dedicated Tutela user via Amazon IAM.

1. Sign into the AWS console and navigate to the IAM service:

   

2. Add a new user, with an appropriate username and select the "Acces key - Programmatic Access" option:

   

3. (Recommended) Place the newly-created user into a dedicated newly-created group:

   

4. (Recommended) Name the group, and assign the "AmazonEC2ReadOnlyAccess" policy ONLY:

   

5. Make a note of the Access key ID (a.k.a Identifier) and the Secret access key (a.k.a Secret):

   

6. Sign into the Tutela console and navigate to Settings > Agent Management > Add Cloud Provider :

   

7. Insert the appropriate details recorded in step 5 above, ensuring that the "Amazon Web Services" option is selected:

   

Please note! Cloud Provider assets may take up to 24 hours to be shown in the Tutela dashboard

Azure Integration involves creating a Service Principal for a dedicated Tutela App:

1. Sign into the Azure console and open a cloud shell:

   

2. Enter the following command:

   az ad sp create-for-rbac --name TUTELA

   

3. Make a note of the output, specifically the Identifier, Secret, and Tenant ID:

   

4. Next is noting your subscription ID. Search for "Subscriptions" in the Azure portal:

   

5. Note the appropriate Subscription ID assigned to your account:

   

6. Sign into the Tutela dashboard, and navigate to Settings > Agent management > Add Cloud Provider. Insert the required information gathered from the previous steps into the dialog box, taking special care to select the "Azure Compute" option:

   

External Domain Management is a Tutela feature which allows you to keep an eye on registered subdomains for a given main domain. Apart from listing any detected subdomains, Tutela also lists any resolved IP addresses for each subdomain detected. This allows you as a security administrator to:

1. Enumerate any subdomains you may not have been aware of. This is a problem especially for larger teams which may unknowingly increase your attack surface without your knowledge
2. Enumerate any leaked internal subdomains which should not be public
3. Be aware of any unreasonable domain IP changes. This may be simply a valid and authorized DNS change, but it may also be a warning sign for a  subdomain takeover.

In three simple steps:

Data Leak & Phishing Detection is a Tutela feature which allows security administrators to:

• Detect lookalike domains which could be leveraged to launch phishing campaigns
• Detect possible cloned sites which are usually used to phish users into disclosing company credentials
• Detect sensitivie information which may have been disclosed due to possible data leaks both intentional and unintentional on the visible and dark web

This is done in three steps:

This happens when you select a rather large report to be generated. PDF generation happens client-side within your browser, so large reports will cause your browser to become unresponsive until it manages to render all the PDF pages. Usually given enough time (even upto 10 minutes) the browser will display the PDF report - however in these situaitons we recommend you change your report type to the default "spreadsheet" since this is generated on our servers and will be significantly faster