How Automox Worklets Enable Automation on Linux Servers

Read the Product Talk transcript

Hello and welcome to our second-ever episode of Automox Product Talk I'm Peter Pflaster, one of the hosts for the Product Talk podcast. I'm in the product department here at Automox and bringing on for the second podcast as well, Steph, our cohost, Steph, why don't you give us a super quick background?

Hi guys, Steph Rizzuto, I'm a product manager here at Automox.

Awesome, so this month at Automox is Linux Server Month. Really for this month, we're going to focus on Linux servers in the podcast and some areas that we see customers automating on Linux servers with Automox. So lots of exciting stuff to talk about. Let's talk a little bit about the last year with Linux Steph What kind of stuff?

have we brought to the table for our customers?

Yeah, over the last year, we've added support for a lot of Linux distros. And yeah, we support most of the popular ones. Recently, we added Oracle Linux 9, RHEL 9, Rocky 8, Rocky 9, Alma 9. So we're really excited to bring that support into Automox.

In addition to adding support for the distros, we've also added severity data for a few of the distros that we're really excited about. So we have Ubuntu, Red Hat, and Debian. And it's something that, you know, we've gotten a lot of requests for and why it's so crucial and exciting for Linux admins is now you can

use the patch by severity policy to prioritize. So really taking care of your critical stuff. We're really excited about it and we've gotten really good feedback too from our Linux customer base.

That's awesome. Yeah, I know a lot of customers that we have that come on to Automox that use Linux are actually either automating this stuff with a variety of Bash scripts, sometimes just hosted locally on their machine, which I mean that that's one way to do it. I think, you know, a lot of what we're trying to build for is, is a cloud cloud-based management, right? So you have a central place to control not only Linux but also Mac and Windows and a piece of that control, you know, past just patching is general automation, right? And in Automox, kind of our units of automation are called Worklets. And a Worklet is really just a way to deploy a script down to an endpoint or a bunch of endpoints at scale, right? So for Linux and then Mac as well, all those scripts are deployed down with Bash. And then for Windows, we obviously use PowerShell, which is pretty much the standard there. And the way that this works, right, is the Automox system is always scanning devices to check on their status and see how they're lining up. So we actually have an evaluation script block in Worklets that will kind of evaluate a variety of conditions. For example, let's say you wanna have a certain firewall rule configured in Linux. You could evaluate that with Bash. We check it every time we scan. And if it's out of compliance, that Worklet based on the schedule could go and run a remediation script.

which is the second piece of a Worklet that essentially then goes and corrects the configuration and adds that report back to the Automox activity logs. You can actually see what happened. And I think the cool thing, right, there's a lot of Linux admins out there that have been managing Linux for their whole careers, and they're just scripting gurus, right? But the thing that we've been working really hard on is expanding

kind of our pre-made automations, our plug-and-play automations. And we call that the Worklet catalog. And the Worklet catalog is actually built and maintained entirely by a team here at Automox. And this is a team of experts, right? Former administrators, both in the Windows, and Microsoft realm, but then also in Linux and Mac. And they're constantly writing Worklets. So our users can go and basically just plug and play automations for Windows, Mac, and Linux.

in those Bash and PowerShell-based languages. I think we're up over 350 now, so we have 350 different automations across the board in the catalog. If you wanna check those out and you're not a customer, you can actually just go to our website and look up the Worklet catalog. If you are a customer, it's available directly in the console, which is really cool. Anything you wanna add to that, Steph?

Yeah, something that we've actually added this past year that is pretty significant for people who maybe aren't experts in scripting is we've plugged in what we call Ask Otto. So it's our AI assistant to help you write these Worklets. And we've gotten some really good feedback from people who said the quality, of the code is good. It gets it right. A lot of the time, you know,

We had one customer say, I still have to go "Automox it" and make it work for the specific environment. But overall, it does a really good job of helping and it saved them a lot of time. So it's something we're pretty excited about. And we have people using it who really like it.

Yeah, I think the cool thing that gets me excited about those sorts of AI applications of existing tools is not only for those newer users or maybe the less familiar with scripting languages, but also for like the power users, the expert users. I've talked to a lot of those customers that use Automox and have used Ask Otto and their feedback was it was saving them, you know, 20 to 30 minutes of initial research time because...

It gave them a really good starting point where they could see all the different commands or objects for PowerShell specifically that they would need to use in a script and tweak it if they needed to from there. So a lot of cool time-saving opportunities. If you can't find something in the catalog, obviously I always consider the catalog the gold standard because that's written by our team of experts. But Ask Otto is a really great tool as well.

Yeah, I guess, Steph, if you wouldn't mind kind of detailing just a few of the basic use cases we see customers leveraging Worklets for most often on Linux.

Um, yeah, so like firewall configs at scale, checking the EDR when SentinelOne is running and restarting if not. Those are some typical ones that we see a lot.

Awesome. Yeah, I think a lot of the Worklet use cases, I almost consider some of them more of the boring stuff, which I think is good because you should be automating as much of the boring stuff as well. Just to free up your own time, but also make your life a little bit better day-to-day-wise. But I think some of the really cool stuff that our team here at Automox has helped our users address both on the Windows side, and also on the Linux server side.

is vulnerability remediation. We have a pretty quick response if we see big vulnerabilities coming out that our customers are trying to remediate and really not getting a ton of guidance on. Some really great examples, one of the Worklets that we created was to help remove 3CX, detect and remove it from their entire device's state. And probably my favorite one was probably

I want to say about a year after I started at Automox, the Log4Shell incident occurred, right? And that was basically a vulnerability in Log4Java that I think was like a 9.8 or 10 out of 10 CVSS score. Extremely severe, and really hard to find and fix. And there wasn't a patch available for a really long time, but you could fix it by changing the configuration in Linux itself. So we actually had a few members of our team write a Worklet that would basically go and find a deep scan for this log4j and then correct the configuration to temporarily remediate until the patch became available. I know we had a ton of customers using that at scale across their entire Linux infrastructure when that vulnerability happened.

Peter, I think it's also something we should mention a new cool thing that we've added in the Worklet process is the FixNow for multiple devices. So you can run those Worklets to see the immediate output and it helps you like troubleshoot anything that's come up. That's another enhancement I feel like we've made that makes these easier to use and more efficient for a lot of people.

Yeah, that's huge. I think what I experienced in some of our conversations with customers after releasing FixNow was other platforms that they were using, they were launching an automation and it was kind of just going out there and they didn't really know when it would finish or if it worked. The really cool thing about FixNow is I can go and select my devices and then get instant feedback within the tool you know, what's in process and what's finished and what's the outcome of the work with, right? So that's a great point, right? Worklets are now kind of a two-pronged approach, right? You can use them to automate on a recurring basis for that kind of routine stuff like software installs, firewall configuration, and keeping that within your compliance setup. But then also this kind of one-time stuff that you might just have to go and jump in on, you know, a device or...

even a couple thousand devices at scale.

Yeah, it's cool. Not only are we investing in the catalog itself, as you said, we have a team dedicated to writing these Worklets, but then we're adding, I don't know, like tools, if you will, to the Worklets themselves to make them more accessible, more efficient for you to use. So it's exciting to see us continue to build out that functionality.

Awesome. Yeah, I think if I could have any takeaway from this podcast, it would be, you know, if you are an Automox customer listening to us and you aren't using Worklets, I definitely encourage you to go check them out. There's at least one thing in the catalog, I guarantee you, that you could grab from and plug and play and probably save yourself a couple of hours a month at a minimum.

And most of our customers are saving a lot more time than that with Worklets. And if you're not a customer, go to the Worklet catalog, and check it out. If you know something like Log4Shell is interesting. We've got blogs posted on that stuff with all the Bash code public for the entire IT community. If you're still dealing with that vulnerability, definitely encourage you to check those out on our website as well. Again, that's all.

The Log4Shale stuff is all publicly available to the community.

Awesome. So that concludes this episode of the March 2024 edition of Product Talk. Really excited to have you all listening to us and happy Linux servers month. Bye, guys.