Huntress reports that N-able N-central has four exploit chains ("Able2Shell") in the server application, and N-able has taken its hosted N-central environment offline while a hotfix is developed. These metrics do not detect the vulnerabilities. They give you a baseline of who can administer your N-central server, who can run scripts and commands on managed endpoints, which accounts can reach which customers, and what is scheduled, so that once your server is back online you can monitor administrator accounts, script rights, and new jobs for any anomalies. N-able may not change the build number when it applies a live hotfix, so the build metric does not prove a server is patched. Follow N-able and Huntress for current guidance.

Metric 1: N-able N-central: Server Build Version

Description: Returns the N-central server build number and deployment type (hosted or on-premises). Use it to confirm a server is on the expected build after a vendor security advisory or hotfix. Vendors may apply hotfixes without changing the version number, so use this alongside the vendor's guidance. Run on the parent inspector.

Query:

Alert: N-able N-central: Server Build Changed. The N-central server build number changed since the last inspection. Confirm the change matches a planned upgrade or vendor hotfix. If it was not planned, review administrator accounts and recent changes on the server. Trigger: change detection on this metric. Suggested priority: Medium.

Metric 2: N-able N-central: Users with Administrative Roles

Description: Lists the roles that grant user management or administrative tools access, along with the users assigned to each. Use it to review who holds administrator access to the N-central server and to spot unexpected administrator accounts. Run on the parent inspector.

Query:

Alert: N-able N-central: Administrator Role Membership Changed. A user was added to or removed from a role with user management or admin tools access. Verify the change was authorized. Unauthorized new administrator accounts are a common step in RMM compromises. Trigger: change detection on this metric. Suggested priority: High.

Metric 3: N-able N-central: Users with Script, Automation or Command Execution Rights

Description: Lists the roles that can run automation, scheduled tasks, or remote command prompts on managed endpoints, along with their assigned users. These permissions let a user push scripts and tools to every endpoint under management, so the list should be small and reviewed regularly. Run on the parent inspector.

Query:

Alert: N-able N-central: Script Execution Role Membership Changed. A user was added to or removed from a role that can run scripts, automation, or commands on managed endpoints. Verify the change was authorized and review recent activity from that account in N-central. Trigger: change detection on this metric. Suggested priority: High.

Metric 4: N-able N-central: Access Groups and Members

Description: Lists N-central access groups with their type and member usernames, including API and service accounts. Use it to review which accounts can reach which customers or devices, and to find accounts that should no longer exist. Run on the parent inspector.

Query:

Alert: N-able N-central: Access Group Added or Membership Changed. An access group was created, removed, or had its members changed. Confirm the change is expected, especially for API and service accounts, which can give broad access to customer data. Trigger: change detection on this metric. Suggested priority: Medium.

Metric 5: N-able N-central: Scheduled Job Names and Types

Description: Lists the jobs scheduled for an N-central customer, showing job name and type only. Use it to review what is scheduled to run and to spot jobs you don't recognize. For job health, use the existing failed jobs metrics. Run on the child inspector.

Query:

Alert: N-able N-central: New Scheduled Job Added. A new scheduled job appeared for this N-central customer. Confirm your team created it. Unexpected jobs can mean someone is scheduling tasks against managed endpoints. Trigger: change detection on this metric (added items). Suggested priority: Medium.

What to do: create a change detection alert on each metric using the alert names above. When your N-central server comes back online, review the current results of metrics 2, 3 and 4 for any account you don't recognize, check metric 5 for jobs you didn't create, and compare the build in metric 1 with N-able's guidance. A match does not mean a server was compromised, and a clean result does not prove it wasn't. Metric 5 only reflects the job types the N-central inspector collects.