{
  "port": 5051,
  "protocol": "both",
  "service": "Apache Mesos agent (registered as ita-agent)",
  "oneLiner": "The Mesos agent port in modern clusters; registered to Symantec's Intruder Alert agent.",
  "whatItIs": "IANA registers 5051 as ita-agent, the agent side of Symantec's Intruder Alert host intrusion detection product, which is long discontinued. What you find on 5051 today is normally an Apache Mesos agent, whose default `--port` is 5051 while the master uses 5050. The agent exposes HTTP endpoints describing the tasks and executors running on that host.",
  "exposure": {
    "verdict": "never",
    "note": "A Mesos agent endpoint reveals what is running on the node and is part of the cluster control path; keep it on the internal network alongside the master."
  },
  "checkCommand": "curl -s http://TARGET:5051/state | head -c 400",
  "links": [
    {
      "title": "Apache Mesos — Master and Agent Options (--port defaults)",
      "url": "https://mesos.apache.org/documentation/latest/configuration/master-and-agent/",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 5051 (ita-agent)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5051",
      "kind": "iana"
    }
  ]
}