guardicore / monkey

Infection Monkey - An open-source adversary emulation platform
https://www.guardicore.com/infectionmonkey/
GNU General Public License v3.0
6.64k stars 778 forks source link

Security report runtime reports time elapsed from the first run since last reset #2955

Open cakekoa opened 1 year ago

cakekoa commented 1 year ago

Describe the bug

The Security report will calculate the run time of the simulation as beginning the time the first run was started, to the time the last run was completed. This includes any breaks between the runs. The Island is likely using the timestamps of the first and last agent events received to calculate the runtime.

Example:

This may be a completely valid way to calculate the runtime, considering manual agent runs. However, it might be nice to reset the data each time the Run Monkey > From Island button is pressed.

To Reproduce

Steps to reproduce the behavior:

  1. Run the monkey. Probably easiest to configure the monkey with no IPs to scan
  2. Wait 5 minutes
  3. Run the monkey again (do not reset data)
  4. Look at the Security report, and observe that the time is over 5 minutes

Expected behavior

The report shows only the time of the last run, instead of all the runs after the last time the data was reset.

Screenshots

Here we see a long runtime reported:

Screen Shot 2023-02-08 at 4 26 49 PM

However, we're also told that three agents were run, and when they were started:

Screen Shot 2023-02-08 at 4 26 16 PM

mssalvatore commented 1 year ago

I think this is basically expected behavior at this point. The bounds of a simulation aren't well defined.

VakarisZ commented 1 year ago

Expected behavior: The report shows only the time of the last run, instead of all the runs after the last time the data was reset.

So report will contain tunnels, exploitations etc. But when the user tries to compare his security logs based on the date provided in our security report he will not see those events? IMO the best thing we can do is rephrase "After X, all Agents finished propagation attempts." to "Last agent activity was observed at X" or something similar. The main thing is that we want to explicitly say "this report contains network activity that happened between X and Y time" Mike is right and I don't think there's an easy solution to create boundaries. We shouldn't forbid user from manually starting the agent somewhere while other agents are still running. The simulation is done when the user decides it's done.