chore: import upstream snapshot with attribution

2026-07-13 12:33:44 +08:00
commit cc996c6028
968 changed files with 520087 additions and 0 deletions
@@ -0,0 +1,18 @@
+@redeye/parser-core
+
+# @redeye/parser-core
+
+## Table of contents
+
+### Interfaces
+
+- [ParserBeacon](interfaces/ParserBeacon.md)
+- [ParserCommand](interfaces/ParserCommand.md)
+- [ParserFile](interfaces/ParserFile.md)
+- [ParserHost](interfaces/ParserHost.md)
+- [ParserImage](interfaces/ParserImage.md)
+- [ParserLink](interfaces/ParserLink.md)
+- [ParserLogEntry](interfaces/ParserLogEntry.md)
+- [ParserOperator](interfaces/ParserOperator.md)
+- [ParserOutput](interfaces/ParserOutput.md)
+- [ParserServer](interfaces/ParserServer.md)
@@ -0,0 +1,246 @@
+[@redeye/parser-core](../index.md) / ParserBeacon
+
+# Interface: ParserBeacon
+
+## Table of contents
+
+### Properties
+
+- [endTime](ParserBeacon.md#endtime)
+- [files](ParserBeacon.md#files)
+- [host](ParserBeacon.md#host)
+- [images](ParserBeacon.md#images)
+- [ip](ParserBeacon.md#ip)
+- [name](ParserBeacon.md#name)
+- [port](ParserBeacon.md#port)
+- [process](ParserBeacon.md#process)
+- [processId](ParserBeacon.md#processid)
+- [server](ParserBeacon.md#server)
+- [startTime](ParserBeacon.md#starttime)
+- [type](ParserBeacon.md#type)
+
+## Properties
+
+### endTime
+
+• `Optional` **endTime**: `Date`
+
+The date time the beacon ran it's last command or was terminated
+
+**`Example`**
+
+```ts
+endTime = new Date('2021-01-01T00:00:00.000Z');
+```
+
+#### Defined in
+
+[parser-beacon.ts:66](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L66)
+
+---
+
+### files
+
+• `Optional` **files**: [`ParserFile`](ParserFile.md)[]
+
+A list of files that the beacon has uploaded or downloaded
+
+**`Example`**
+
+```ts
+files = [
+	{
+		filePath: 'local/path/to/file.txt',
+		fileName: 'admin-list.txt',
+		dateTime: new Date("2021-01-01T00:00:00.000Z"),
+		md5: '1234567890abcdef1234567890abcdef',
+		fileFlag: 'UPLOAD'
+		// or
+		fileFlag: 'DOWNLOAD'
+	}
+]
+```
+
+#### Defined in
+
+[parser-beacon.ts:94](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L94)
+
+---
+
+### host
+
+• **host**: `string`
+
+The name of the host that this beacon is running on
+This should match the name of a host in the hosts object
+
+**`Example`**
+
+```ts
+host = 'DESKTOP-12345';
+```
+
+#### Defined in
+
+[parser-beacon.ts:19](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L19)
+
+---
+
+### images
+
+• `Optional` **images**: [`ParserImage`](ParserImage.md)[]
+
+A list of images that the beacon has downloaded
+
+**`Example`**
+
+```ts
+images = [
+	{
+		fileType: 'png',
+		filePath: 'local/path/to/image.png',
+		fileName: 'host-desktop-screenshot.png',
+	},
+];
+```
+
+#### Defined in
+
+[parser-beacon.ts:78](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L78)
+
+---
+
+### ip
+
+• `Optional` **ip**: `string`
+
+The IP address of the host as reported by the beacon
+
+**`Example`**
+
+```ts
+ip = '192.168.23.3';
+```
+
+#### Defined in
+
+[parser-beacon.ts:25](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L25)
+
+---
+
+### name
+
+• **name**: `string`
+
+The name of the beacon
+
+#### Defined in
+
+[parser-beacon.ts:7](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L7)
+
+---
+
+### port
+
+• `Optional` **port**: `number`
+
+The port that the beacon is communicating over
+
+**`Example`**
+
+```ts
+// http
+port = 80;
+// https
+port = 443;
+```
+
+#### Defined in
+
+[parser-beacon.ts:42](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L42)
+
+---
+
+### process
+
+• `Optional` **process**: `string`
+
+The process name of the beacon
+
+**`Example`**
+
+```ts
+process = 'explorer.exe';
+```
+
+#### Defined in
+
+[parser-beacon.ts:48](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L48)
+
+---
+
+### processId
+
+• `Optional` **processId**: `number`
+
+The process identifier of the beacon
+
+**`Example`**
+
+```ts
+pid = 1234;
+```
+
+#### Defined in
+
+[parser-beacon.ts:54](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L54)
+
+---
+
+### server
+
+• **server**: `string`
+
+The name of the server that spawned this beacon
+This should match the name of a server in the servers object
+
+#### Defined in
+
+[parser-beacon.ts:12](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L12)
+
+---
+
+### startTime
+
+• `Optional` **startTime**: `Date`
+
+The date time the beacon was initialized or ran it's first command
+
+**`Example`**
+
+```ts
+startTime = new Date('2021-01-01T00:00:00.000Z');
+```
+
+#### Defined in
+
+[parser-beacon.ts:60](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L60)
+
+---
+
+### type
+
+• `Optional` **type**: `"http"` \| `"https"` \| `"smb"` \| `"dns"`
+
+The type of beacon
+
+**`Example`**
+
+```ts
+possible values: 'http' | 'https' | 'smb' | 'dns'
+type = 'http'
+```
+
+#### Defined in
+
+[parser-beacon.ts:33](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L33)
@@ -0,0 +1,160 @@
+[@redeye/parser-core](../index.md) / ParserCommand
+
+# Interface: ParserCommand
+
+## Table of contents
+
+### Properties
+
+- [attackIds](ParserCommand.md#attackids)
+- [beacon](ParserCommand.md#beacon)
+- [commandFailed](ParserCommand.md#commandfailed)
+- [input](ParserCommand.md#input)
+- [operator](ParserCommand.md#operator)
+- [output](ParserCommand.md#output)
+
+## Properties
+
+### attackIds
+
+• `Optional` **attackIds**: `string`[]
+
+A list of the MITRE ATT&CK techniques used by the command
+
+**`Default`**
+
+```ts
+[];
+```
+
+**`Example`**
+
+```ts
+attackIds = ['T1059', 'T1059.001'];
+```
+
+#### Defined in
+
+[parser-command.ts:68](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L68)
+
+---
+
+### beacon
+
+• **beacon**: `string`
+
+Name of the beacon that the command was run from
+Should match the name of a beacon in the beacons object
+
+**`Example`**
+
+```ts
+beacon = 'beacon1';
+```
+
+#### Defined in
+
+[parser-command.ts:17](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L17)
+
+---
+
+### commandFailed
+
+• `Optional` **commandFailed**: `boolean`
+
+Whether the command was successful
+
+**`Default`**
+
+```ts
+false;
+```
+
+**`Example`**
+
+```ts
+// The command output was not found in the logs or the command failed
+commandFailed = true;
+```
+
+#### Defined in
+
+[parser-command.ts:38](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L38)
+
+---
+
+### input
+
+• **input**: [`ParserLogEntry`](ParserLogEntry.md)
+
+The input that initialized the command
+
+**`Example`**
+
+```ts
+input = {
+	blob: 'ls',
+	filepath: '<directory-of-parser>/logs/2023-02-01/log-1.txt',
+	lineNumber: 123,
+	logType: 'INPUT',
+	dateTime: new Date('2021-01-01T00:00:00.000Z'),
+};
+```
+
+#### Defined in
+
+[parser-command.ts:30](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L30)
+
+---
+
+### operator
+
+• `Optional` **operator**: `string`
+
+Name of the operator that sent the command
+Should match the name of an operator in the operators object
+
+**`Example`**
+
+```ts
+operator = 'admin';
+```
+
+#### Defined in
+
+[parser-command.ts:10](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L10)
+
+---
+
+### output
+
+• `Optional` **output**: [`ParserLogEntry`](ParserLogEntry.md)
+
+The output of the command
+
+**`Example`**
+
+```ts
+// If the command was successful
+output = {
+	blob: '[System Process]\nsmss.exe\n...etc',
+	filepath: '<directory-of-parser>/logs/2023-02-01/log-1.txt',
+	lineNumber: 123,
+	logType: 'OUTPUT',
+	dateTime: new Date('2021-01-01T00:00:00.000Z'),
+};
+// If the command failed
+output = undefined;
+// or
+output = {
+	blob: 'Unknown command: pwd',
+	filepath: '<directory-of-parser>/logs/2023-02-01/log-1.txt',
+	lineNumber: 123,
+	logType: 'ERROR',
+	dateTime: new Date('2021-01-01T00:00:00.000Z'),
+};
+```
+
+#### Defined in
+
+[parser-command.ts:61](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L61)
@@ -0,0 +1,91 @@
+[@redeye/parser-core](../index.md) / ParserFile
+
+# Interface: ParserFile
+
+## Table of contents
+
+### Properties
+
+- [dateTime](ParserFile.md#datetime)
+- [fileFlag](ParserFile.md#fileflag)
+- [fileName](ParserFile.md#filename)
+- [filePath](ParserFile.md#filepath)
+- [md5](ParserFile.md#md5)
+
+## Properties
+
+### dateTime
+
+• **dateTime**: `Date`
+
+The date time the file was created or modified
+
+**`Example`**
+
+```ts
+dateTime = new Date('2021-01-01T00:00:00.000Z');
+```
+
+#### Defined in
+
+[parser-beacon.ts:137](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L137)
+
+---
+
+### fileFlag
+
+• **fileFlag**: `"DOWNLOAD"` \| `"UPLOAD"`
+
+Was this file uploaded to the host or downloaded from the host
+
+#### Defined in
+
+[parser-beacon.ts:146](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L146)
+
+---
+
+### fileName
+
+• `Optional` **fileName**: `string`
+
+The name of the file if the local file name is different from the name of the file
+
+**`Example`**
+
+```ts
+name = 'admin-list.txt';
+```
+
+#### Defined in
+
+[parser-beacon.ts:125](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L125)
+
+---
+
+### filePath
+
+• **filePath**: `string`
+
+Path to the file that RedEye can access
+
+**`Example`**
+
+```ts
+filePath = '<directory-of-parser>/files/file.txt';
+```
+
+#### Defined in
+
+[parser-beacon.ts:131](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L131)
+
+---
+
+### md5
+
+• `Optional` **md5**: `string`
+
+The MD5 hash of the file
+
+#### Defined in
+
+[parser-beacon.ts:141](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L141)
@@ -0,0 +1,114 @@
+[@redeye/parser-core](../index.md) / ParserHost
+
+# Interface: ParserHost
+
+## Table of contents
+
+### Properties
+
+- [ip](ParserHost.md#ip)
+- [name](ParserHost.md#name)
+- [os](ParserHost.md#os)
+- [osVersion](ParserHost.md#osversion)
+- [server](ParserHost.md#server)
+- [type](ParserHost.md#type)
+
+## Properties
+
+### ip
+
+• `Optional` **ip**: `string`
+
+The IP address of the host
+
+**`Example`**
+
+```ts
+ip = '192.168.23.0';
+```
+
+#### Defined in
+
+[parser-host.ts:28](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L28)
+
+---
+
+### name
+
+• **name**: `string`
+
+The name of the host
+
+#### Defined in
+
+[parser-host.ts:5](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L5)
+
+---
+
+### os
+
+• `Optional` **os**: `string`
+
+The operating system of the host
+
+**`Example`**
+
+```ts
+os = 'Windows';
+```
+
+#### Defined in
+
+[parser-host.ts:16](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L16)
+
+---
+
+### osVersion
+
+• `Optional` **osVersion**: `string`
+
+The version of the operating system of the host
+
+**`Example`**
+
+```ts
+osVersion = '10.0.19041';
+```
+
+#### Defined in
+
+[parser-host.ts:22](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L22)
+
+---
+
+### server
+
+• **server**: `string`
+
+The name of the server that first ran a command or spawned a beacon on the host
+This should match the name of a server in the servers object
+
+#### Defined in
+
+[parser-host.ts:10](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L10)
+
+---
+
+### type
+
+• `Optional` **type**: `string`
+
+The type of host
+
+**`Example`**
+
+```ts
+type = 'workstation';
+type = 'server';
+type = 'laptop';
+type = 'virtual machine';
+```
+
+#### Defined in
+
+[parser-host.ts:37](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L37)
@@ -0,0 +1,65 @@
+[@redeye/parser-core](../index.md) / ParserImage
+
+# Interface: ParserImage
+
+## Table of contents
+
+### Properties
+
+- [fileName](ParserImage.md#filename)
+- [filePath](ParserImage.md#filepath)
+- [fileType](ParserImage.md#filetype)
+
+## Properties
+
+### fileName
+
+• `Optional` **fileName**: `string`
+
+The name of the image if the local file name is different from the name of the image
+
+**`Example`**
+
+```ts
+name = 'host-desktop-screenshot.png';
+```
+
+#### Defined in
+
+[parser-beacon.ts:116](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L116)
+
+---
+
+### filePath
+
+• **filePath**: `string`
+
+Path to the image that RedEye can access
+
+**`Example`**
+
+```ts
+filePath = '<directory-of-parser>/images/image.png';
+```
+
+#### Defined in
+
+[parser-beacon.ts:110](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L110)
+
+---
+
+### fileType
+
+• **fileType**: `string`
+
+The type of image
+
+**`Example`**
+
+```ts
+type = 'png';
+```
+
+#### Defined in
+
+[parser-beacon.ts:104](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L104)
@@ -0,0 +1,47 @@
+[@redeye/parser-core](../index.md) / ParserLink
+
+# Interface: ParserLink
+
+## Table of contents
+
+### Properties
+
+- [from](ParserLink.md#from)
+- [to](ParserLink.md#to)
+
+## Properties
+
+### from
+
+• **from**: `string`
+
+The origin of the link, can be a beacon or server
+
+**`Example`**
+
+```ts
+from = 'beacon1';
+from = 'server1';
+```
+
+#### Defined in
+
+[parser-link.ts:8](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-link.ts#L8)
+
+---
+
+### to
+
+• **to**: `string`
+
+The destination of the link, can be a beacon
+
+**`Example`**
+
+```ts
+to = 'beacon2';
+```
+
+#### Defined in
+
+[parser-link.ts:14](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-link.ts#L14)
@@ -0,0 +1,147 @@
+[@redeye/parser-core](../index.md) / ParserLogEntry
+
+# Interface: ParserLogEntry
+
+## Table of contents
+
+### Properties
+
+- [blob](ParserLogEntry.md#blob)
+- [dateTime](ParserLogEntry.md#datetime)
+- [filepath](ParserLogEntry.md#filepath)
+- [lineNumber](ParserLogEntry.md#linenumber)
+- [lineType](ParserLogEntry.md#linetype)
+- [logType](ParserLogEntry.md#logtype)
+
+## Properties
+
+### blob
+
+• **blob**: `string`
+
+The text of the log entry, can be a command input or output
+
+**`Example`**
+
+```ts
+blob = 'ls';
+blob = 'cd C:\\Users\\admin\\Desktop';
+blob = 'dir';
+blob = '[System Process]\nsmss.exe\n...etc';
+```
+
+#### Defined in
+
+[parser-log-entry.ts:12](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L12)
+
+---
+
+### dateTime
+
+• `Optional` **dateTime**: `Date`
+
+The date and time the log entry was created
+
+**`Example`**
+
+```ts
+dateTime = new Date('2021-01-01T00:00:00.000Z');
+```
+
+#### Defined in
+
+[parser-log-entry.ts:66](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L66)
+
+---
+
+### filepath
+
+• `Optional` **filepath**: `string`
+
+Local path to the file that the log entry was found in
+
+**`Example`**
+
+```ts
+filepath = '<directory-of-parser>/logs/2023-02-01/log-1.txt';
+```
+
+#### Defined in
+
+[parser-log-entry.ts:18](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L18)
+
+---
+
+### lineNumber
+
+• `Optional` **lineNumber**: `number`
+
+The starting line number of the log entry in the file
+
+**`Example`**
+
+```ts
+lineNumber = 123;
+```
+
+#### Defined in
+
+[parser-log-entry.ts:24](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L24)
+
+---
+
+### lineType
+
+• `Optional` **lineType**: `"METADATA"` \| `"INPUT"` \| `"TASK"` \| `"CHECKIN"` \| `"OUTPUT"` \| `"MODE"` \| `"ERROR"` \| `"INDICATOR"`
+
+The type of log line if the logType is 'BEACON'
+
+**`Example`**
+
+```ts
+// If the log entry is a command input
+logType = 'INPUT';
+// If the log entry is a command output
+logType = 'OUTPUT';
+// If the log entry is a beacon status checkin with the server
+logType = 'CHECKIN';
+// If the log entry is the C2 server acknowledging a command
+logType = 'TASK';
+// If the log entry is an error of any kind
+logType = 'ERROR';
+// If the log entry is miscellaneous metadata tied to a beacon
+logType = 'METADATA';
+```
+
+#### Defined in
+
+[parser-log-entry.ts:42](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L42)
+
+---
+
+### logType
+
+• **logType**: `"BEACON"` \| `"EVENT"` \| `"DOWNLOAD"` \| `"WEBLOG"` \| `"KEYSTROKES"` \| `"UNKNOWN"`
+
+The type of log entry
+
+**`Example`**
+
+```ts
+// A beacon log entry
+logType = 'BEACON';
+// Misc events on the C2 server (e.g. operator login)
+logType = 'EVENT';
+// A file download from a beacon
+logType = 'DOWNLOAD';
+// A web log entry from a beacon
+logType = 'WEBLOG';
+// A keystroke log entry from a beacon
+logType = 'KEYSTROKES';
+// Any other log entry
+logType = 'UNKNOWN';
+```
+
+#### Defined in
+
+[parser-log-entry.ts:60](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L60)
@@ -0,0 +1,64 @@
+[@redeye/parser-core](../index.md) / ParserOperator
+
+# Interface: ParserOperator
+
+## Table of contents
+
+### Properties
+
+- [endTime](ParserOperator.md#endtime)
+- [name](ParserOperator.md#name)
+- [startTime](ParserOperator.md#starttime)
+
+## Properties
+
+### endTime
+
+• `Optional` **endTime**: `Date`
+
+The date and time the operator last sent a command
+
+**`Example`**
+
+```ts
+// If the operator is still active
+endTime = new Date();
+// If the operator has never sent a command
+endTime = undefined;
+// If the operator is no longer active
+endTime = new Date('<date of last command>');
+```
+
+#### Defined in
+
+[parser-operator.ts:22](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-operator.ts#L22)
+
+---
+
+### name
+
+• **name**: `string`
+
+The name of the operator
+
+#### Defined in
+
+[parser-operator.ts:5](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-operator.ts#L5)
+
+---
+
+### startTime
+
+• `Optional` **startTime**: `Date`
+
+The date and time the operator first sent a command
+
+**`Example`**
+
+```ts
+startTime = new Date('<date of first command>');
+```
+
+#### Defined in
+
+[parser-operator.ts:11](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-operator.ts#L11)
@@ -0,0 +1,206 @@
+[@redeye/parser-core](../index.md) / ParserOutput
+
+# Interface: ParserOutput
+
+## Table of contents
+
+### Properties
+
+- [beacons](ParserOutput.md#beacons)
+- [commands](ParserOutput.md#commands)
+- [hosts](ParserOutput.md#hosts)
+- [links](ParserOutput.md#links)
+- [operators](ParserOutput.md#operators)
+- [servers](ParserOutput.md#servers)
+
+## Properties
+
+### beacons
+
+• **beacons**: `Object`
+
+A key-value pair of beacon names and their metadata
+
+**`Example`**
+
+```ts
+// If the beacon 'beacon1' was created from server 'server1' on host 'DESKTOP-312' at 2021-01-01T00:00:00 and last checked in at 2021-02-02T00:00:02
+beacons = {
+	beacon1: {
+		name: 'beacon1',
+		server: 'server1',
+		host: 'DESKTOP-312',
+		ip: '192.168.23.2',
+		process: 'svchost.exe',
+		pid: 1234,
+		startTime: new Date('2021-01-01T00:00:00.000Z'),
+		endTime: new Date('2021-02-02T00:00:02.000Z'),
+	},
+};
+```
+
+#### Index signature
+
+▪ [beaconName: `string`]: [`ParserBeacon`](ParserBeacon.md)
+
+#### Defined in
+
+[index.ts:62](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L62)
+
+---
+
+### commands
+
+• **commands**: `Object`
+
+A key-value pair of unique command identifiers and commands with inputs and outputs, sent by operators to beacons
+
+**`Example`**
+
+```ts
+// If the operator 'admin' sent a command to the beacon 'beacon1' at 2021-01-01T00:00:00
+commands = {
+	'admin-beacon1-2021-01-01T00:00:00': {
+		operator: 'admin',
+		beacon: 'beacon1',
+		input: {
+			blob: 'shell whoami',
+			filepath: 'C:\\Users\\admin\\Desktop\\command.txt',
+			lineNumber: 1,
+			logType: 'BEACON',
+		},
+		output: {
+			blob: 'admin',
+			filepath: 'C:\\Users\\admin\\Desktop\\command.txt',
+			lineNumber: 2,
+			logType: 'BEACON',
+		},
+		attackIds: ['T1033'],
+	},
+};
+```
+
+#### Index signature
+
+▪ [commandName: `string`]: [`ParserCommand`](ParserCommand.md)
+
+#### Defined in
+
+[index.ts:106](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L106)
+
+---
+
+### hosts
+
+• **hosts**: `Object`
+
+A key-value pair of host names and their metadata
+
+**`Example`**
+
+```ts
+// If the host 'DESKTOP-312' was first discovered or had a beacon spawned by server 'server1' with os 'Windows 10.0.19041'
+hosts = {
+	'DESKTOP-312': {
+		name: 'DESKTOP-312',
+		server: 'server1',
+		os: 'Windows',
+		osVersion: '10.0.19041',
+		ip: '192.168.23.2',
+		type: 'desktop',
+	},
+};
+```
+
+#### Index signature
+
+▪ [hostName: `string`]: [`ParserHost`](ParserHost.md)
+
+#### Defined in
+
+[index.ts:41](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L41)
+
+---
+
+### links
+
+• **links**: `Object`
+
+A key-value pair of '<from>-<to>' and links from servers to beacons and beacons to beacons
+
+**`Example`**
+
+```ts
+// If the server 'server1' has a beacon named 'beacon1'
+links = {
+	'server1-beacon1': {
+		from: 'server1',
+		to: 'beacon1',
+	},
+};
+```
+
+#### Index signature
+
+▪ [linkName: `string`]: [`ParserLink`](ParserLink.md)
+
+#### Defined in
+
+[index.ts:120](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L120)
+
+---
+
+### operators
+
+• **operators**: `Object`
+
+A key-value pair of operator names and the time range of their first and last command
+
+**`Example`**
+
+```ts
+// If the operator 'admin' their first command at 2021-01-01T00:00:00 and last command at 2021-02-02T00:00:02
+operators = {
+	admin: {
+		name: 'admin',
+		startTime: new Date('2021-01-01T00:00:00.000Z'),
+		endTime: new Date('2021-02-02T00:00:02.000Z'),
+	},
+};
+```
+
+#### Index signature
+
+▪ [operatorName: `string`]: [`ParserOperator`](ParserOperator.md)
+
+#### Defined in
+
+[index.ts:78](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L78)
+
+---
+
+### servers
+
+• **servers**: `Object`
+
+A key-value pair of server names and their metadata
+
+**`Example`**
+
+```ts
+// If a C2 server was create with name 'server1' and will be communicating over https
+servers = {
+	server1: {
+		name: 'server1',
+		type: 'https',
+	},
+};
+```
+
+#### Index signature
+
+▪ [serverName: `string`]: [`ParserServer`](ParserServer.md)
+
+#### Defined in
+
+[index.ts:22](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L22)
@@ -0,0 +1,46 @@
+[@redeye/parser-core](../index.md) / ParserServer
+
+# Interface: ParserServer
+
+## Table of contents
+
+### Properties
+
+- [name](ParserServer.md#name)
+- [type](ParserServer.md#type)
+
+## Properties
+
+### name
+
+• **name**: `string`
+
+The name of the server
+
+#### Defined in
+
+[parser-server.ts:7](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-server.ts#L7)
+
+---
+
+### type
+
+• `Optional` **type**: `"http"` \| `"https"` \| `"smb"` \| `"dns"`
+
+The type of server
+
+**`Default`**
+
+```ts
+'http';
+```
+
+**`Example`**
+
+```ts
+type = 'https';
+```
+
+#### Defined in
+
+[parser-server.ts:15](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-server.ts#L15)