Skip to content

Frequently Asked Questions and Answers

General

What dependencies does the agent have?

You can see a list of our dependencies by executing the agent with the --legal flag.

sigsci-agent --legal

What cyptography is used in the agent?

All communication with our cloud engine uses TLS 1.2 or higher. In practice (because we control both the agent and the cloud engine) most of the time we communicate using TLS 1.3 if the underlying OS supports it. This includes Windows Server 2022 or later and Linux systems using OpenSSL 1.1.1 or later). Older systems will fall back to TLS 1.2.

When we upload data to the cloud engine, we further sign and encrypt the data using Hash-Based Message Authentication Codes (HMAC), with the customer's secretaccesskey.

Agents v4.70.0 and prior do not support FIPS 140-2 or 140-3 certified cryptographic modules. We use the algorithms built into the Golang standard library without any experimental build flags enabled. The source code to the Go crypto implementation is available here. Beginning with v4.71.0, the Agent supports FIPS 140-3 cryptographic modules by starting it with the runtime flag GODEBUG=fips140=only or GODEBUG=fips140=on. The support is native to Golang 1.24. More information can be found here.

The Agent uses sha256 for generating secure hashes.

Is it possible to prevent the agent from uploading data to the cloud engine?

It is technically possible to prevent the agent from uploading any data, however the more realistic answer is that without the cloud engine in the loop the agent is extremely hindered in functionality to the point of essentially just being a static set of rules. We do not recommend that customers configure the agent this way. Customers wishing to evaluate the full data payload uploaded by the agent can use the debug-log-uploads config option to cause the agent to log the uploaded payloads as a JSON object. However, this debug configuration is not recommended to be enabled in production environments for performance reasons.

Do you support running the agent on macOS?

No, we do not support running the agent on macOS.

How long does it take for an agent to be marked offline?

If an agent has not reported to the console for five minutes, the console will mark the agent offline. This is not configurable by users.

What does it mean when the agent mode is set to "off" in the dashboard?

The agent will still accept RPC connections from modules. It will add an X-SigSci-Agent: disabled request header to indicate the agent is disabled. There is no inspection. The module is detected.

How do I determine what deployment model an agent uses?

Here's a quick recap of how deployment type shows up looking at the Agent or Agent Config reports:

  • Edge will show up as EdgeSecurity in the Servername and Hostname columns in the Agent Config report. The agent version will be reported with the +fake suffix ex: 4.xx.y+fake.

  • CloudWAF is identified as Module Type = sigsci-agent-revproxy && Module Version = 1.5.1 or 4.36.1. Module Version of 4.36.1 but also not being identified as outdated in the Agent list in the UI are older CWAF instances.

  • Everything else are on-prem/Core deployments

Kubernetes Deployments

How do I scale the agent when running in a Kubernetes (k8s) environment?

As documented here the agent keeps some state information for each request and evaluates the response. This means that the same agent that evaluated a request must also evaluate the response to a request. This presents scaling challenges when running in a kubernetes environment. This can be a challenge when using an ext_proc filter for Envoy which does not guarantee that the same agent will see both the request and the response.

The recommended configuration is to run the agent as a side-car, either on their ingress or application pods which allows the filters to be constrained within the Pod to ensure things map to the correct agent.

We have a plan for improving agent scalability in this environment, tracked in AGENT-919. If you have a prospect or customer that would benefit from this, please add them to this ticket or contact Paul Thompson (@Paul on Slack).