Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
JupiterOne Endpoint Compliance Agent Power Up - AskJ1 Community
<main> <article class="userContent"> <p>JupiterOne is not an endpoint security solution. Rather, it is a graph platform designed for security operations and compliance. So, why are we even talking about an endpoint agent?</p> <p>The JupiterOne internal security operations team is a highly distributed and self-managed. We needed a lightweight approach to ensure that users have correctly configured their own endpoint devices (such as laptops) and prompt them to remediate if a non-compliant configuration is detected.</p> <p>Read <a rel="nofollow" href="https://jupiterone.com/blog/solving-for-endpoint-compliance-in-a-cloud-first-landscape">this blog</a> for more on our journey in solving endpoint compliance in a cloud-first landscape.</p> <p>We are offering this endpoint agent as a "Power Up" to all JupiterOne customers.</p> <h2 data-id="the-agent">The Agent</h2> <p>The endpoint agent has two components:</p> <ol><li><p><strong>Stethoscope-app</strong> - an open-source solution by Netflix. This is a community project and it is <em>not officially supported</em> by the JupiterOne team. See the <a rel="nofollow" href="https://github.com/Netflix-Skunkworks/stethoscope-app">Github project</a> for more details.</p></li> <li><p><strong>J1 integration agent</strong> - a native agent binary to connect Stethoscope-app with JupiterOne as the management backend for policy and configuration status reporting.</p></li> </ol><h2 data-id="installation">Installation</h2> <p>Installing and activating the JupiterOne endpoint compliance agent follows a self-service approach.</p> <ol><li>A JupiterOne administrator needs to send an activation email to users:</li> </ol><ul><li><p>From the JupiterOne web UI, go to <strong>Settings</strong> (the gear icon near the top-right), and then <strong>Power Ups</strong> for the Settings menu.</p></li> <li><p>Select <strong>JupiterOne Endpoint Compliance Agent</strong> from the Power Ups menu.</p></li> <li><p>Select one of three options to <strong>Send Activations</strong> to:</p> <ul><li>All users</li> <li>User devices without Endpoint Agent</li> <li><p>Specify emails individually</p> <p>Note the first two options requires you to have an identity provider (IdP) integration configured in JupiterOne so that the platform knows about the users of your organization. Example IdP integrations include Okta, OneLogin, Google G Suite, JumpCloud.</p></li> </ul></li> </ul><ol start="2"><li>Users should then follow the simple instructions in the activation email to download, install and activate the endpoint agent.</li> </ol><h2 data-id="policies">Policies</h2> <p>For details on how to customize your endpoint compliance policy, see the [relevant documentation](<a href="https://github.com/Netflix-Skunkworks/stethoscope-app/blob/master/docs/POLICIES.md#supported-practices" rel="nofollow">https://github.com/Netflix-Skunkworks/stethoscope-app/blob/master/docs/POLICIES.md#supported-practices</a>" target="_blank").</p> <h2 data-id="advanced-use-cases">Advanced Use Cases</h2> <p>For organizations using an automated package deployment tool such as SaltStack or Jamf, we are often asked if the JupiterOne power up agent can be included in the auto-rollout from the deployment tool. This is technically doable (see below for more details below), but not officially supported at the moment.</p> <p>Technically the Stethoscope agent installation and JupiterOne integration process has three moving parts:</p> <ol><li><p><a rel="nofollow" href="https://github.com/Netflix-Skunkworks/stethoscope-app/">Stethoscope-app</a>: You would likely need to build this yourself from the code in this repo. It supports an optional “publish”/distribution URL for distributing updates. The Stethoscope-app build that we ship with our installer is configured to pull updates from our S3 bucket location. Since you intend to roll-out updates via your deployment tool, you would likely not use this mechanism. Once built without a publishing configuration, and installed at a certain version of Stethoscope, that version would remain until you replace it.</p></li> <li><p>Our native agent binary for JupiterOne integration: This is bundled into the installer (<code class="code codeInline" spellcheck="false" tabindex="0">.pkg</code> for macOS, <code class="code codeInline" spellcheck="false" tabindex="0">.msi</code> for Windows, or a <code class="code codeInline" spellcheck="false" tabindex="0">.sh</code> script for Linux), which can be downloaded from the download link within an JupiterOne endpoint activation email (see above). We could provide this to you for distribution with your own Stethoscope builds, or you could run the packaged installer and pull the binary agent from that. It is a data-driven GraphQL client that doesn’t change often.</p></li> <li><p>A one-time activation step that is performed using the agent binary in a CLI mode. This is automatically done via the installer wizard, but can certainly be done in the deployment using a command of the form:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0"># macOS example: /opt/j1endpointagent/bin/j1-endpoint-agent-darwin activate --email {YOUR-EMAIL} --account {YOUR-J1-ACCOUNT} --code {YOUR-ACTIVATION-CODE} </pre> <p>Ordinarily, these account codes are generated at email-send time, using the send email feature of the administrative Endpoint Compliance Power Up UI. Contact JupiterOne Support to pre-generate a CSV of activation codes for a list of your email addresses. This activation step registers each particular endpoint device with JupiterOne, sending along the device-specific UUID along with the activation information provided at the command line, and generates an API token used to retrieve the Stethoscope policy and upload scan results to J1.</p></li> </ol><h2 data-id="uninstallation">Uninstallation</h2> <p>Uninstalling the JupiterOne endpoint compliance agent may be performed by:</p> <ol><li><code class="code codeInline" spellcheck="false" tabindex="0">/opt/j1endpointagent/bin/j1-endpoint-agent-darwin service --action stop</code></li> <li><code class="code codeInline" spellcheck="false" tabindex="0">/opt/j1endpointagent/bin/j1-endpoint-agent-darwin service --action uninstall</code></li> <li>Remove the <code class="code codeInline" spellcheck="false" tabindex="0">/Applications/Stethoscope.app</code> folder.</li> </ol> </article> </main>
.png)