HomeMITRECVE JournalCarbonpediaDocsReleases
Agent

RedCarbon Agent

The RedCarbon Agent is a Linux daemon designed to enable on-premise integrations or those located behind firewalls that do not expose services directly to the Internet.

The Agent establishes a secure outbound connection to the RedCarbon platform, acting as a reverse proxy within the customer's infrastructure. It securely routes HTTP requests to local integrations (e.g., SIEM, EDR) that are not exposed to the public internet, eliminating the need to open inbound ports on the corporate firewall.

Minimum Requirements

The RedCarbon Agent is provided as a self-contained binary, ensuring high efficiency and ease of deployment. To ensure optimal performance and stability, we recommend the following minimum specifications for the host machine:

  • CPU: 2 Cores.
  • RAM: 4 GB.
  • Disk Space: 100 GB (HDD or SSD).
  • OS: Linux (specifically Debian or Ubuntu distributions).
  • Connectivity: Outbound Internet access to api.*.redcarbon.ai (where * is the tenant subdomain).

1. Token Generation

Before installing the Agent, you must generate an identification token from the RedCarbon platform. Tokens are unique per customer and must be generated by an Org Admin.

Generating a New Token

  1. Log in to the platform and navigate to the Organization Admin section.
  2. Select the Customers tab.
  3. Locate the target Customer and click on the gear icon (Settings).
  4. In the Customer page, find the Agents table and click the Add Agent button.
  5. In the sidebar that appears, provide a Name and Description for the agent.
  6. Once the agent is created, you must generate its key:
    • Locate the new agent in the table and click the Edit Key button.
    • Choose to generate a new key (or rotate the existing one).
    • Specify the key duration: 1, 2, or 5 years.
  7. Important: The key will be displayed only once. Copy and store it securely. If lost, you must remove the old key and generate a new one.

Monitoring Agent Status

The Agents table provides real-time information about your deployed instances:

  • State: Pending (created but not registered), Online (active), or Offline (disconnected).
  • Hostname: Shows the host info (host + IP) where the agent was last executed.

2. Installation Guide

Follow these steps to download and install the RedCarbon Agent on your Linux machine.

Download and Setup

  1. Download the latest binary release from the official releases page. The binary is self-contained and requires no external dependencies.
  2. Unpack the archive and navigate to the file folder.

Profile Configuration

The Agent uses profiles to allow a single daemon instance to manage multiple customers simultaneously. Each profile is tied to a specific customer token. To add a new profile, use the profile.sh script:

./profile.sh add -t <agent_token> <profile_name>

Installation as a Service (Daemon)

To ensure the Agent is always active and restarts automatically, install it as a system service (systemd) using the svc.sh script. It is recommended to specify a non-root user who has read permissions on the binary folder:

sudo ./svc.sh install <user>

3. Usage and Updates

Enabling Agent Proxy for Integrations

To route an integration's traffic through the Agent:

  1. Navigate to the Integrations section in the RedCarbon platform.
  2. Select or create the integration you wish to configure.
  3. In the integration settings, enable the Agent Proxy toggle.
  4. Select the desired agent from the dropdown menu and save.

Software Updates

  • Auto-Update: The Agent automatically checks for updates every 24 hours and applies them without manual intervention.
  • Manual Update: If needed, stop the service (sudo ./svc.sh stop), replace the binary, and start it again (sudo ./svc.sh start). Existing configuration and profiles will be maintained.