Intel
Intel are the issues Red Kite detects on your attack surface, for instance an exposed database server, an exposed remote desktop service or a legacy remote access protocol. Each intel comes with a severity, a description of the risk and recommendations to fix it.
The intel shipped with Red Kite cover the basic hygiene that should be in place on any attack surface. Addressing them is one of the quickest ways to reduce your exposure to the internet.
Definitions and records
An intel is made of two parts:
- An intel definition describes the issue: its name, description, recommendations, severity, the type of resource it applies to
and a detection query. The detection query is a regular filter, for instance
-is:blocked port.service:ssh. - An intel record is created for every resource that matches the detection query. It tracks the issue on that resource: its status, its severity, when it was first and last seen, and a timeline of what happened.
Red Kite evaluates all the enabled intel definitions every hour. Each time a resource still matches, the record's last seen date is updated.
Since the default detection queries exclude blocked resources, blocking the resources that are not yours also removes them from the intel results. Sorting out your resources first makes the intel much more relevant. See Data enrichment.
Statuses
Statuses are grouped in two groups: open (is:open) and closed (is:closed).
| Status | Group | Meaning |
|---|---|---|
| Open | Open | The issue was detected and has not been reviewed yet. |
| Validated | Open | The issue was reviewed and confirmed. It needs to be fixed. |
| Ready to retest | Open | A fix was applied and the issue needs to be tested again. |
| Regression | Open | The issue was marked as resolved, but Red Kite detected it again. Set automatically by Red Kite. |
| Resolved | Closed | The issue was fixed. |
| False positive | Closed | The detection was wrong. |
| Risk accepted | Closed | The issue is real, but the risk was accepted, for instance because the exposure is required by the business. |
When a resolved record is detected again, Red Kite automatically moves it to Regression and records the change in the
timeline. Keep an eye on status:regression: it means a fix did not hold.
Default intel
Red Kite comes with intel definitions for the most common exposed services, such as SSH, RDP, Telnet, FTP, SMB, databases, LDAP, NetBIOS, RPC/NFS, VNC, legacy UNIX remote access, Cisco Smart Install, Java RMI, MSRPC, WinRM, Kerberos, TACACS, DHCP, SOCKS proxies, SVN and Docker APIs.
The default intel definitions are managed by Red Kite and are read-only. You can see them, along with their affected resources, in Management > Intel definitions.
Each intel record keeps a timeline of everything that happened to it.
To learn how to work with intel, see Managing intel and Configuring intel.