Breadcrumb - Agent Enrolment – Thinkst Canary

Overview

The Agent Enrolment Breadcrumb creates an agent onboarding document that points to a Canary running the Agent-to-agent (A2A) or Agent Provocateur web skins.

Agents, above all, want to complete their task. Autonomous threats discovering an onboarding document pointing to an agentic help service will be guided towards your Canaries.

Placement Ideas

Good locations for Agent Enrolment Breadcrumbs include:

On endpoints: Place the enrolment crumb on any of your endpoints that can reach your Canary. For example:
- [Windows] C:\ProgramData\SecurityAgent\agent-onboarding.txt.
- [Linux] /etc/security-agent/agent-onboarding.txt.
- [Mac] /Users/<username>/.security-agent/agent-onboarding.txt (hidden folder).
As a SKILL.md file: Place the enrolment crumb in a fake code repository: C:\agent-ops-deploy\SKILL.md.
File management systems: Place enrolment crumb amongst other onboarding documentation on a file share. If you have another Canary in the same segment, upload the breadcrumb to the Canary's Windows file share.

Follow the steps below to create an Agent Enrolment Breadcrumb:

Step 1: Log in to your Console

Step 2: Confirm A2A or Agent Provocateur personality is enabled on the Canary

Click the Canary you want to use for the Agent Enrolment Breadcrumb and confirm that the Agent-to-agent or Agent Provocateur personality is enabled.

Step 3: Open the Breadcrumbs tile on your Flock

Once you have confirmed that either the A2A or Agent Provocateur web skin is enabled, open the Breadcrumbs tile to create and download the Agent Enrolment breadcrumb.

Step 4: Select the Breadcrumb

Select Agent Enrolment from the list of available Breadcrumbs.

Note

If the Breadcrumb you want to create is greyed out, none of the Canaries in the selected Flock are configured with an Agent detection personality. Configure the Canary to use either the Agent-to-Agent or Agent Provocateur personality.

Step 5: Select the Canary

Select the Canary from the drop-down list. In this example, we have selected the JHB-Ops Canary.
Select Create to create the Breadcrumb.

Note

If a Canary is not available in the drop-down list, it does not have the service required for this Breadcrumb enabled. Configure the Canary to use either the Agent-to-Agent or Agent Provocateur personality and try again.

Step 6: Download the Breadcrumb

Select Download Breadcrumb to download the Breadcrumb .txt file.

The download section contains the following:

crumb – Displays the onboarding text snippet.
Download Breadcrumb – Downloads a .txt file containing this agent onboarding guide.

Step 7: Deploy the Breadcrumb

Using one of our deployment examples above, or your own, simply drop the text file on a host that can reach your Canary running one of the Agent detection personalities. You're done! Any autonomous agents doing security testing on your network that find this breadcrumb will be directed to your Canary.

Alerts

Alert Type: Agentic-attack detection tripped

For the Agent Provocateur service, the alert contains answers from the agent to questions from our service, including it's identity, goal, what it's interacted with previously, and additional alert information.

For the Agent-to-agent service, the alert contains the data included in all of the RPC calls, including identity, context and more.

You’ve made it!

Search