New Relic's infrastructure agent runs on your hosts and provides comprehensive data, especially when running with administrator privileges. What follows is an overview of our infrastructure agent's security and some recommendations.
Secure agent communication
Every piece of information exchanged between your hosts and the infrastructure agent is delivered securely. All communication from the agent occurs over HTTPS, using Transport Layer Security (TLS). To ensure secure communication, the infrastructure agent was designed with the following protective measures:
- All communication is established directly from the agent to the service.
- The agent does not require any incoming ports to be opened.
- The agent is read-only and cannot make changes to your system.
The infrastructure agent does not support high-security mode.
For more information about New Relic's security measures, see our security and privacy documentation, or visit the New Relic security website.
Running modes
New Relic is committed to the security of your data. All data derived while running the infrastructure agent is protected, and used only to deliver information related to your infrastructure back to you.
Linux
You can run the infrastructure Linux agent in three different modes:
For more details on the different running modes, see the comparison in the Infrastructure installation documentation.
Windows
In Windows systems, the agent must be executed with Administrator permissions.
Sources of data collection
The infrastructure agent gathers metrics, events, and inventory data from a variety of OS sources. While some of these sources can be read from a non-privileged account, others require elevated privileges.
For current agent versions, New Relic requires that it run as the root user (on Linux) or with full Administrator access (Windows). Here are additional details about how the infrastructure agent accesses default directories and what packages and commands it uses.
Proxies
New Relic includes optional settings so that you can configure the agent to communicate through a proxy. To define proxy settings, see the configuration documentation for infrastructure monitoring.
External agent connections
The agent periodically sends JSON-formatted data describing compute metrics, events, and your inventory configuration to the infrastructure endpoint at New Relic. These communications are associated with the agent using the generated for your account. Once New Relic receives data from any external agent, it will display the new metrics, events, or configuration data in the infrastructure monitoring UI.
External agent commands
The agent handles two different sources of commands, newrelic-infra-ctl and command-API:
- CLI commands submitted with
newrelic-infra-ctlare sent into the agent with Linux or Docker signaling or with Windows named-pipes. - Using New Relic's platform
command-APIendpoint, the agent polls for platform-provided commands every 60 seconds. The connection is always open from the agent into the New Relic platform command-API endpoint, never the opposite way. Thecommand-APIendpoint is used only to force enable or disable of dynamic entities' registration. It also applies to the Docker integration that comes with the infrastructure agent version 1.9.0 or higher.
Deliverables
The infrastructure agent and all on-host integrations that run on top of it are provided using standard operating system repositories and packages. New Relic cryptographically signs all packages, and verification steps are provided by default in the installation scripts.
All code is checked for dependency vulnerabilities through standard security tools (Snyk, Dependabot, Trivy).
New Relic official downloads site is hosted on AWS via S3, and fronted with Fastly, our trusted CDN provider.