Technical Tip: What happens if an enrolled virtual machine is cloned

When an agent enrolls to the FortiDLP Reveal platform using an enrollment bundle, it is given a unique ID (agent UUID) and corresponding certificates to securely authenticate communication between the agent and the infrastructure. These credentials are stored on the machine's hard disk and thus will necessarily be duplicated entirely by a clone of the virtual machine.

If a virtual machine is cloned whilst it is enrolled when it boots up, the agent will connect to the infrastructure, and because it has valid certificates will be able to immediately start committing events to the activity feed for the existing agent.

If the hostname of the cloned machine is not changed, it can be very difficult to tell that there are two machines reporting events into the FortiDLP infrastructure at the same time.

The only evidence will be the node IP address changing periodically. The hostname and IP address are reported every 15 minutes as part of a heartbeat message that is independent of the other activity feed events. As such, if the hostname is modified on one of the machines then within every 15 minutes, the hostname shown for the node will change on the map view.

To ensure that individual activity feeds are kept clean and separate from each other, Next recommends that virtual machines are only cloned with the agent not installed, or otherwise not currently enrolled.

If an enrolled machine is cloned, we recommend immediately changing the hostname of the cloned machine and re-enrolling the agent. This can be achieved with the following commands.

agent[.exe] unenroll

agent[.exe] enroll <bundle_filepath/enroll_code>