Welcome to the series. This is installment one of fourteen, and it starts where most asset programs start: devices that should be running a security agent and aren’t.
CAASM was built to answer “what do we have?” — pull every tool’s asset list into one place and look at them together. That answer turned out to be the easy half. Axonius calls the harder half asset intelligence: reconciling those lists instead of stacking them, so you get one trustworthy record per device rather than five partial ones.
Missing agents are where the gap shows up first. Your policy says every device runs the agent. Your inventory agrees. The environment disagrees, and nobody finds out until something goes wrong.
This is where cybersecurity observability comes in handy. It’s how to make sure all those policies aren’t just collecting “digital dust” in an IT policy document that nobody reads.
Book your Free 30-day CAASM Trial
Gain Complete Visibility of Your Cybersecurity Assets with the SJULTRA CAASM free trial.
Calling agent 19... where are you, Agent 19?
Let’s say you’ve got a simple policy that madates: All Windows devices must have the Carbon Black agent installed.
Sounds straightforward, right? But here’s the kicker – how do you make sure it’s happening for real? Can you account for all your agents in the field?
- Your CMDB is about as reliable as a chocolate teapot (UK) or chocolate fireguard (US) 😂. Thanks to your complex IT landscape, including those pesky ephemeral devices like cloud servers — not all devices are even registered in it (but how do you know?).
- Your Carbon Black agent manager is living in blissful ignorance. If it’s not installed on a server, that server might as well be invisible.
Now, I don’t know about you, but that sounds like a recipe for some serious security gaps to me… 😭
Enter SJULTRA's Cybersecurity Observability Service
This is where I get a bit excited, because I’ve been dealing with this challenge for over 20 years across many organizations, so it’s a relief to find a consistent and reliable solution to it.
At SJULTRA, with our customers we use this cool tool in our CAASM Services to gather intel from multiple data sources.
It’s like having a super-spy network for your IT environment. CAASM takes all this data from various collectors, adapters, systems, and devices, and turns it into actionable signals.
It’s like finding the security needle in the IT haystack!
Let's get querying
Once we’ve got CAASM set up (which, by the way, SJULTRA offers a free 30-day trial for), the fun begins. We can start building queries to find those elusive devices that are dodging our security measures.
Want to find all Windows devices without the Carbon Black agent? No problem! Here’s how we do it:
- In plain English, in the security policy standard procedures, we’re asking: “Show me all Windows devices that don’t have a Carbon Black ID”
- In the CAASM query wizard it looks like this:
3. In CAASM Query Languge (SQL):
I know, I know, it looks like a cat walked across the keyboard. But trust me, this little line of code is cybersecurity gold.
Result:
Taking It Up a Notch
Feeling fancy? 😜 We can extend our query to get even more specific.
How about finding all Windows devices running Google Chrome without the Carbon Black agent? Here’s what that looks like:
In AQL:
Result:
Ok, we found devices with no agents: now what?
Great, so now we’ve got this list of non-compliant devices. What do we do with it?
This is where the “enforcement” part of our cybersecurity observability comes in. We’ve got four tricks up our sleeves:
- Send out notifications (because who doesn’t love another email, right?)
- Create incident tickets in your favorite ITSM tool (Jira, ServiceNow, you name it)
- Tell another agent to isolate or un-isolate a device (for those “uh-oh” moments)
- Deploy and run files, or even initiate a device scan (if the stars align and the device is reachable)
Summary
And there you have it, folks! That’s how we turn the chaos of cybersecurity policy enforcement into a manageable, observable process. It’s not always pretty, but it gets the job done.
Remember this is just 1 out of 14 standard use cases we help our customers with as part of our CAASM Concierge service. You can get that free!
Remember, cybersecurity is a team sport. We’re all in this together, trying to keep our digital worlds safe one device at a time. Some write the policies, others codify them to make them work. So, keep querying, keep enforcing, and most importantly, keep that sense of humor. You’re gonna need it in this field!
Stay safe out there, and may your false positives be few and your patches always successful!
CAASM documentation and Videos
Read the CAASM documentation on Finding Devices Missing Endpoint Agents.
