Security whitepaper
How Asteria protects you — and what it needs to do that.
A concise architecture note for security teams evaluating agent install on Windows servers. For narrative scenarios see Threats; for capability lists see Features.
1. Product model
Local agent on Windows opens decoy services and applies response actions you approve. Asteria cloud stores events, drives the dashboard, and delivers commands over authenticated channels. Production workloads stay on your real services; bait lives on controlled listeners.
2. Threats we target
| Risk / scenario | What Asteria does |
|---|---|
| Internet-facing RDP / SSH credential stuffing | Decoy RDP/SSH capture attempts; optional auto-block of source IPs; cloud timeline + alerts |
| SQL / FTP service probing | Decoy MSSQL, MySQL, FTP listeners log probes without exposing real databases |
| Ransomware staging (canaries, shadow copy abuse) | Canary files and heuristics escalate to urgent threat alerts before encryption spreads |
| Post-compromise lateral movement toward “interesting” services | Attractive decoys + remote session/process actions from the dashboard (Premium) |
| Operator needs fast response without VPN to every host | Cloud panel: block IPs, review credentials, control sessions from the browser |
3. Agent permissions (typical)
- Network listeners on decoy ports you enable (not your production bind by default — configure carefully)
- Windows Firewall rules with Asteria prefixes (
AR-BLOCK/AR-INTEL) for blocks you or auto-policy request - Process / session actions when you trigger remote control from the dashboard (Premium)
- Outbound HTTPS to Asteria cloud for register, heartbeat, event upload, and command pull
Run the agent only on hosts you are authorized to manage. Align decoy ports with change-control and perimeter allow-lists.
4. Data sent to the cloud
- Agent identity (token), hostname labels, version, online status
- Attack events: source IP, service/trap type, attempted usernames/passwords on decoys, timestamps
- Threat alert summaries and block-rule state
- Outcomes of operator-initiated remote actions
We do not need your production database contents or full disk images. See Privacy Policy for retention and rights.
5. Authentication
- Agents authenticate with per-install tokens
- Operators use membership email accounts (multi-server) or per-server dashboard passwords
- Password reset uses the notification email on file
6. Installer integrity
Windows builds are published via GitHub Releases for the Asteria client. Prefer downloading from asteria.run/download, verify the SHA-256 when shown, and treat SmartScreen warnings seriously until builds are code-signed. We recommend pinning checksums in your internal software catalog.
7. What Asteria is not
Not a full EDR/XDR replacement, not a SIEM, not a guarantee against breach. It is a deception + response layer that raises the cost of probing your Windows estate and shortens time-to-block.
8. Questions for procurement
Email [email protected] or [email protected] with your questionnaire — architecture diagram, data residency, subprocessors, and plan limits.