feat: T1007 System Service Discovery - fixed allowlist probe in posture heartbeat

This commit is contained in:
AetherForge
2026-05-30 23:16:50 -07:00
parent 4207f6c21b
commit d010292333
26 changed files with 2499 additions and 134 deletions

View File

@@ -46,10 +46,21 @@ type Agent struct {
FirewallPrivate *bool `json:"firewall_private,omitempty"`
FirewallPublic *bool `json:"firewall_public,omitempty"`
LastPatchDays *int `json:"last_patch_days,omitempty"`
LastPatch *string `json:"last_patch,omitempty"` // ISO date YYYY-MM-DD
PendingUpdates *int `json:"pending_updates,omitempty"` // -1 = unknown
LastPatch *string `json:"last_patch,omitempty"`
PendingUpdates *int `json:"pending_updates,omitempty"`
RebootPending *bool `json:"reboot_pending,omitempty"`
AgentElevated *bool `json:"agent_elevated,omitempty"`
// T1007 System Service Discovery — fixed allowlist only
Services []AgentService `json:"services,omitempty"`
}
// AgentService mirrors the ServiceStatus reported by the agent.
type AgentService struct {
Name string `json:"name"`
DisplayName string `json:"display_name,omitempty"`
Status string `json:"status"`
StartType string `json:"start_type"`
}
// AgentCapabilities reports forge-time features available for remote command.