uberAgent 7.0 Preview: Hypervisor & Virtual Machine Detection
While we’re finalizing version 7.0 of our user experience monitoring & endpoint security analytics products uberAgent UXM and uberAgent ESA, let’s take a look at another cool new feature: hypervisor and virtual machine detection.
Many products try to detect whether they’re running in a VM or on physical hardware with the
CPUID instruction built into Intel and AMD CPUs (more info). uberAgent did the same in earlier versions. As it turned out, that is not enough, though.
The most common issue with a VM detection approach that is solely based on the
CPUID instruction is that Hyper-V parent partitions are detected as VMs, too.
Technically, that is correct. If you look at the Hyper-V architecture diagram in the documentation, you see that the parent, or root, partition actually is a VM, too. That, however, is not what people expect to see from a VM detection tool.
Most IT pros want only the child partitions to be identified as VMs. The parent partition should be determined as physical. That is exactly what we implemented with uberAgent 7.0.
As you can see in the screenshot below, uberAgent correctly identifies the Hyper-V host
HOST01 as a physical machine (the field
Hardware: is VM? has a value of
0), whereas the virtual machines
VM02 are detected as such.
uberAgent 7.0 not only detects VMs as people expect it to, but it also identifies a VM’s hypervisor type. Take another look at the screenshot above. In the column
Hardware: Hypervisor you can see that the hypervisor type is correctly identified as Hyper-V (
Microsoft Hv), both for the host and the guests (i.e., the parent and the child partitions).
Of course, uberAgent 7.0 detects other hypervisor types, too: VMware, KVM, QUEMU, VirtualBox, Xen, and others are all correctly identified.
uberAgent’s Splunk dashboards offer sophisticated filtering capabilities. With uberAgent 7.0, these have been extended to also include the hypervisor type. This means that you can now restrict the data visualized on many dashboards to endpoints running as VMs on Hyper-V, or VMware, for example.
uberAgent is an innovative Windows and macOS user experience monitoring (UXM) and endpoint security analytics (ESA) product.
uberAgent UXM highlights include detailed information about boot and logon duration, application unresponsiveness detection, network reliability drill-downs, process startup duration, application usage metering, browser performance, web app metrics, and Citrix insights. All these varied aspects of system performance and reliability are smartly brought together in the Experience Score dashboard.
uberAgent ESA excels with a sophisticated activity monitoring engine, the uAQL query language, detection of risky activity, DNS query monitoring, hash calculation, registry monitoring, and Authenticode signature verification. uberAgent ESA comes with Sysmon and Sigma rule converters, a graphical rule editor, and uses a simple yet powerful query language instead of XML.
About vast limits
vast limits GmbH is the company behind uberAgent, the innovative user experience monitoring and endpoint security analytics product. vast limits’ customer list includes organizations from industries like finance, healthcare, professional services, and education, ranging from medium-sized businesses to global enterprises. vast limits’ network of qualified solution partners ensures best-in-class service and support anywhere in the world.