This section covers: adding a source to your monitoring scope in Spyderbat console, generating installation scripts/commands, and running the agent installer on the target machine.
Published: August 23, 2021
The Spyderbat Nano Agent is an extremely lightweight collector to access unprecedented insight from Linux systems and their causal activity and relationships. The Spyderbat Nano Agent leverages proven technology, Enhanced Berkeley Packet Filters or âeBPFâ. The Spyderbat Nano Agent collects targeted, non-human readable data using eBPF from modern 64-bit Linux distributions for both x86 and ARM based architectures.
Select âSourcesâ from the left-navigation menu. The wizard will launch automatically if you donât have any agents installed yet. Doing so will take you to a brief wizard to guide you through the installation in a few simple steps. Click on the blue button to get started.
You will see two choices regarding the target system you want to install the Nano Agent on.
If you are installing on a virtual Linux system in AWS, select âEC2 instanceâ â where youâll want to give the AWS instance an IAM (read only) role to grab metadata like Cloud Tags etc.
If you are installing on any instance of Linux (virtual or physical) select âStandaloneâ.
Ensure you are installing on a Linux system supported by Spyderbat. You can view a complete list of supported versions .
After you have made your selection, hit ânext stepâ.
Note the system youâre installing Spyderbat's Nano Agent should have outbound access on port 443 to https://orc.spyderbat.com
In the next step, youâll see a command you can copy and paste into a terminal on the target system. If you do not have Curl installed on your system, select the wget tab to copy this command instead.
Note - You will need Sudo permissions to install the Spyderbat Nano Agent
The UI provides you with feedback by displaying check marks of the install progress. Once the Spyderbat Nano Agent is installed, registers with Spyderbat, and it transmitting data, you will see that the agent was installed successfully both in your terminal and in the Spyderbat UI.
Once you see every checkmark displayed, click on âNext Stepâ to be directed to the Sources page. You should now see the system you just installed the Nano Agent onto.
You should see that the source is healthy, the last active time should indicate recent activity and the sparkline will start to indicate a summary of system activity over time. You can rename the Source if necessary.
You are now ready to jump into an Investigation! Click on âView Spydertraceâ link for the source will take you by default into the last hour of activity for that system in the âinvestigateâ view.
Congratulations â you installed the Spyderbat Nano Agent!
Happy tracing!
