Files
2026-07-13 12:33:44 +08:00

778 lines
18 KiB
GraphQL

# -----------------------------------------------
# !!! THIS FILE WAS GENERATED BY TYPE-GRAPHQL !!!
# !!! DO NOT MODIFY THIS FILE BY YOURSELF !!!
# -----------------------------------------------
type Annotation {
beaconIdFromFirstCommand: String
commandCount: Float!
commandGroupId: String
commandIds: [String]
date: DateTime!
favorite: Boolean!
generation: GenerationType!
id: String!
tagCount: Float!
tags: [Tag!]
text: String!
user: String!
}
input AnonymizationInput {
findReplace: [FindReplaceInput!] = []
removeHidden: Boolean = false
removeKeystrokes: Boolean = false
removePasswordsHashes: Boolean = false
removeScreenshots: Boolean = false
replaceDomainsAndIps: Boolean = false
replaceHostnames: Boolean = false
replaceUsernames: Boolean = false
}
type Beacon {
"""
The name Cobalt Strike gives the beacon or the Cobalt Strike server name. Not _necessarily_ unique across a campaign but is unique to a server
"""
beaconName: String!
commandsCount: Float!
commentsCount: Float!
displayName: String
hidden: Boolean
host: Host
id: String!
logsCount: Float!
meta: [BeaconMeta!]!
mitreTechniques: [MitreTechniques]
serverId: String!
}
"""The type of line in a beacon log"""
enum BeaconLineType {
CHECKIN
ERROR
INDICATOR
INPUT
METADATA
MODE
OUTPUT
TASK
}
"""Data derived from the Beacon metadata line"""
type BeaconMeta {
"""The color of the node"""
color: NodeColors
"""The time that the last command was run"""
endTime: DateTime
id: String!
"""The IP of the host at the time of the metadata line"""
ip: String
"""Process Identifier the beacon is running on"""
pid: Int
"""The IP of the host at the time of the metadata line"""
port: Float
"""Process Identifier the beacon is running on"""
process: String
"""The shape of the beacon"""
shape: Shapes
"""The log line from which the BeaconMeta was extracted"""
source: LogEntry
"""The start time of the beacon"""
startTime: DateTime
"""The communication type used by the beacon"""
type: BeaconType
"""The username the beacon is running under"""
username: String
}
"""The communication type used by the beacon"""
enum BeaconType {
dns
http
https
smb
}
type Campaign {
annotationCount: Int!
beaconCount: Int!
commandCount: Int!
computerCount: Int!
creator: GlobalOperator
firstLogTime: DateTime
id: String!
lastLogTime: DateTime
lastOpenedBy: GlobalOperator
migrationError: Boolean!
name: String!
parsers: [CampaignParser!]
parsingStatus: ParsingStatus!
serverCount: Int!
}
type CampaignParser {
parserName: String
path: String
}
type Command {
attackIds: [String!]
beacon: Beacon!
commandFailed: Boolean!
commandGroups: [CommandGroup!]!
commentsCount: Float!
id: String!
input: LogEntry!
inputText: String!
mitreTechniques: [MitreTechniques]
operator: Operator
output: [LogEntry!]!
}
type CommandGroup {
annotations: [Annotation!]!
commandIds: [String!]!
commands: [Command!]!
commentCount: Float!
generation: GenerationType!
id: String!
}
type CommandTypeCount {
beaconsCount: Float!
commentsCount: Float!
count: Float!
id: String!
text: String!
}
"""
The javascript `Date` as string. Type represents date and time as the ISO Date string.
"""
scalar DateTime
type File {
dateTime: DateTime!
fileFlag: FileFlag!
fileName: String!
id: String!
location: String!
"""
Generated automatically when using the upload command, the MD5 message-digest algorithm is a widely used hash function producing a 128-bit hash value.
"""
md5: String
}
type FileDisplay {
editable: Boolean!
}
"Designates if this is an upload or download\n UPLOAD: File was put on or replace on a target host\n DOWNLOAD: File was taken from a target host\n "
enum FileFlag {
DOWNLOAD
UPLOAD
}
type FileUpload {
acceptedExtensions: [String!]
description: String!
example: String
type: UploadType!
validate: ValidationMode!
}
input FindReplaceInput {
find: String = ""
replace: String = ""
}
"""How the entity was generated"""
enum GenerationType {
MANUAL
PROCEDURAL
PROCEDURAL_MODIFIED
}
type GlobalOperator {
id: String!
name: String!
}
type Host {
beaconIds: [String!]!
cobaltStrikeServer: Boolean
commandsCount: Float!
commentCount: Float!
displayName: String
hidden: Boolean
hostName: String!
id: String!
meta: [HostMeta!]!
}
type HostMeta {
"""The color of the node"""
color: NodeColors
id: String!
ip: String
os: String
osVersion: String
shape: Shapes
type: String
}
type Image {
fileType: String!
id: String!
url: String
}
type Link {
command: Command
destination: Beacon
endTime: DateTime
id: String!
"""Was this Link manually created"""
manual: Boolean!
"""The display name of the link"""
name: String
origin: Beacon
"""Shouldn't be nullable but it is to handle bad data sets"""
startTime: DateTime
}
type LogEntry {
beacon: Beacon
"""All lines in a LogEntry"""
blob: String!
command: Command
dateTime: DateTime
filepath: String
id: String!
lineNumber: Float!
lineType: BeaconLineType
logType: LogType!
}
"""Basic Log Types based on the filename"""
enum LogType {
BEACON
DOWNLOAD
EVENT
KEYSTROKES
UNKNOWN
WEBLOG
}
"""High level mitre technique"""
enum MitreTechniques {
Collection
CommandAndControl
CredentialAccess
DefenseEvasion
Discovery
Execution
Exfiltration
GoldenTicket
Impact
InitialAccess
LateralMovement
Persistence
PrivilegeEscalation
Reconnaissance
ResourceDevelopment
}
type Mutation {
"""Add an Annotation to an existing CommandGroup"""
addAnnotationToCommandGroup(campaignId: String!, commandGroupId: String!, favorite: Boolean, tags: [String!]!, text: String!, user: String!): Annotation!
"""Create a CommandGroup annotation"""
addCommandGroupAnnotation(campaignId: String!, commandIds: [String!]!, favorite: Boolean, tags: [String!]!, text: String!, user: String!): Annotation!
"""Add an Command to an existing CommandGroup"""
addCommandToCommandGroup(campaignId: String!, commandGroupId: String!, commandId: String!): CommandGroup!
"""Add a server from folder already accessible from the server"""
addLocalServerFolder(campaignId: String!, name: String!, path: String!): Server! @deprecated(reason: "FOR CYPRESS TESTING PURPOSES ONLY")
"""Anonymize campaign for export"""
anonymizeCampaign(anonymizeOptions: AnonymizationInput!, campaignId: String!): String!
"""Create a new Campaign"""
createCampaign(creatorName: String!, name: String!, parser: String!): Campaign!
"""Create a global user"""
createGlobalOperator(password: String!, username: String!): GlobalOperator
"""Create a new link between two beacons"""
createLink(
campaignId: String!
"""command id to add to link"""
commandId: String!
"""destination beacon id"""
destinationId: String!
name: String!
"""origin beacon id"""
originId: String!
): Link!
"""Delete existing Annotation"""
deleteAnnotation(annotationId: String!, campaignId: String!): Annotation!
"""Delete a Campaign by id"""
deleteCampaign(campaignId: String!): Boolean!
"""Delete a link"""
deleteLink(campaignId: String!, id: String!): Link!
"""Edit a link"""
editLink(
campaignId: String!
"""command id to add to link"""
commandId: String!
"""destination beacon id"""
destinationId: String!
id: String!
name: String!
"""origin beacon id"""
originId: String!
): Link!
"""Rename existing Campaign"""
renameCampaign(campaignId: String!, name: String!): Campaign!
serversParse(campaignId: String!): Boolean!
"""Toggle beacon hidden state"""
toggleBeaconHidden(beaconId: String, beaconIds: [String!], campaignId: String!, setHidden: Boolean): [Beacon!]!
"""Toggle host hidden state"""
toggleHostHidden(campaignId: String!, hostId: String, hostIds: [String!], setHidden: Boolean): [Host!]!
"""Toggle server hidden state"""
toggleServerHidden(campaignId: String!, serverId: String, serverIds: [String!], setHidden: Boolean): [Server!]!
"""Update existing Annotation"""
updateAnnotation(annotationId: String!, campaignId: String!, favorite: Boolean, tags: [String!]!, text: String!, user: String!): Annotation!
"""Update existing Beacon Metadata"""
updateBeaconMetadata(beaconDisplayName: String, beaconId: String!, beaconTimeOfDeath: DateTime, beaconType: BeaconType, campaignId: String!, color: NodeColors, shape: Shapes): Beacon!
"""Update existing Host Display Name"""
updateHostMetadata(campaignId: String!, color: NodeColors, hostDisplayName: String, hostId: String!, shape: Shapes): Host!
"""Update existing Server name"""
updateServerMetadata(campaignId: String!, color: NodeColors, serverDisplayName: String, serverId: String!, serverType: ServerType, shape: Shapes): Server!
}
"""The color of the node"""
enum NodeColors {
default
forest
gold
green
indigo
lime
orange
red
rose
turquoise
vermilion
violet
}
type NonHidableEntities {
beacons: [String!]
hosts: [String!]
servers: [String!]
}
type Operator {
beaconIds: [String!]!
commentsCount: Float!
endTime: DateTime
id: String!
logIds: [String!]!
name: String!
startTime: DateTime
}
type ParserInfo {
id: String!
name: String!
uploadForm: UploadForm!
version: Float!
}
type ParsingProgress {
date: DateTime!
nextTaskDescription: String!
progress: [ServerParsingProgress!]!
}
"""The current state of Campaign parsing"""
enum ParsingStatus {
LIVE_PARSING_CS
NOT_READY_TO_PARSE
PARSING_COMPLETED
PARSING_FAILURE
PARSING_IN_PROGRESS
PARSING_NOT_STARTED
PARSING_QUEUED
}
type PresentationCommandGroup {
beaconIds: [String!]!
commandIds: [String!]!
id: String!
maxDate: DateTime
minDate: DateTime
}
type PresentationItem {
"""
Every beacon in the presentation. Including both presentation beacons and connection beacons.
"""
beaconIds: [String!]!
commandCount: Float!
commandGroupIds: [String!]!
commandGroups: [PresentationCommandGroup!]!
"""
Beacon Ids that are not in the command groups but are needed to link beacons to other beacons in the graph
"""
connectionBeaconIds: [String!]!
count: Float!
id: String!
key: String!
linkIds: [String!]!
}
type Query {
"""Get an annotation"""
annotation(annotationId: String!, campaignId: String!): Annotation
"""Get all annotations for a project"""
annotations(campaignId: String!): [Annotation]
"""Get all the beacons for a project"""
beacons(campaignId: String!, hidden: Boolean = false): [Beacon]
"""Get a single campaign"""
campaign(campaignId: String!): Campaign
"""Get the list of Campaigns"""
campaigns: [Campaign]
"""Get command group by id"""
commandGroup(campaignId: String!, commandGroupId: String!, hidden: Boolean = false): CommandGroup
"""Get command groups ids"""
commandGroupIds(beaconId: String, campaignId: String!, commandGroupIds: [String!], commandIds: [String!], commandType: String, hidden: Boolean = false, hostId: String, operatorId: String, sort: SortTypeComments = {sortBy: time}): [String]
"""Get command groups by ids"""
commandGroups(beaconId: String, campaignId: String!, commandGroupIds: [String!], commandIds: [String!], commandType: String, hidden: Boolean = false, hostId: String, operatorId: String, sort: SortTypeComments = {sortBy: time}): [CommandGroup]
"""Get commands by ids"""
commandIds(
beaconId: String
campaignId: String!
commandIds: [String!]
commandType: String
"""Should show hidden values"""
hidden: Boolean = false
hostId: String
operatorId: String
sort: SortType = {sortBy: name}
): [String]
"""Get command types"""
commandTypes(
campaignId: String!
"""Should show hidden values"""
hidden: Boolean = false
): [CommandTypeCount]
"""Get commands by ids"""
commands(beaconId: String, campaignId: String!, commandIds: [String!], commandType: String, hidden: Boolean = false, hostId: String, operatorId: String, sort: SortType = {sortBy: name}): [Command]
"""Get images by ids"""
files(beaconId: String, campaignId: String!, hostId: String): [File]
"""Get all the operators for all campaigns"""
globalOperators(password: String!): [GlobalOperator]
"""Get all the hosts for a project"""
hosts(campaignId: String!, hidden: Boolean = false): [Host]
"""Get images by ids"""
images(beaconId: String, campaignId: String!, hostId: String): [Image]
"""Get all links"""
links(campaignId: String!, hidden: Boolean = false): [Link]
"""Get log files from beacon"""
logFilesByBeaconId(beaconId: String!, campaignId: String!): [String!]!
"""Get log entries by ids"""
logs(beaconId: String, campaignId: String!, hostId: String): [LogEntry]
"""
Get logs from beacon sorted by time. The goal is to be able to re-create the full log for that beacon.
"""
logsByBeaconId(beaconId: String!, campaignId: String!): [LogEntry!]!
""""""
nonHidableEntities(beaconIds: [String!] = [], campaignId: String!, hostIds: [String!] = []): NonHidableEntities!
"""Get all the operators for a project"""
operators(campaignId: String!, hidden: Boolean = false): [Operator]
parserInfo: [ParserInfo!]!
"""Get the current progress of the parser"""
parsingProgress: ParsingProgress!
"""Get categories for presentation mode"""
presentationItems(campaignId: String!, commentsTabSort: SortTypeCommentsTab = {sortBy: minTime}, forOverviewComments: Boolean = false, hidden: Boolean = false, listSort: SortTypeCommentsList = {sortBy: alphabetical}, userOnly: Boolean = false): [PresentationItem]
"""Search Annotations from textQuery"""
searchAnnotations(campaignId: String!, hidden: Boolean = false, searchQuery: String!): [Annotation!]
"""Search Commands from textQuery"""
searchCommands(campaignId: String!, hidden: Boolean = false, searchQuery: String!): [Command!]
"""Get the list of servers for a project"""
servers(
campaignId: String!
"""Should show hidden values"""
hidden: Boolean = false
username: String!
): [Server]
"""Get all tags for a project"""
tags(campaignId: String!): [Tag]
"""Get a bucketed summary of active beacons and links with commands"""
timeline(campaignId: String!, hidden: Boolean = false, suggestedBuckets: Float = 100, suggestedEndTime: DateTime = "+275760-09-12T23:50:00.000Z", suggestedStartTime: DateTime = "1970-01-01T00:00:00.001Z"): Timeline!
}
type Server {
beaconCount: Float!
beacons: [Beacon!]!
commandsCount: Float!
commentCount: Float!
displayName: String
hidden: Boolean
id: String!
logsCount: Float!
meta: ServerMeta!
name: String!
}
enum ServerDelineationTypes {
Database
Folder
}
type ServerMeta {
"""The color of the node"""
color: NodeColors
id: String!
shape: Shapes
type: ServerType!
}
type ServerParsingProgress {
campaignId: String!
serverName: String!
tasksCompleted: Int!
totalTasks: Int!
}
"""The communication type used by the server"""
enum ServerType {
dns
http
https
smb
}
"""The shape of the node"""
enum Shapes {
circle
diamond
hexagonDown
hexagonUp
pentagonDown
pentagonUp
square
triangleDown
triangleUp
}
"""The desired sort direction"""
enum SortDirection {
ASC
DESC
}
"""The desired property to sort on"""
enum SortOption {
name
text
time
}
"""The desired property to sort Comments on"""
enum SortOptionComments {
fav
time
user
}
"""The desired property to sort Comments List on"""
enum SortOptionCommentsList {
alphabetical
commandCount
commentCount
}
"""The desired property to sort overview Comments Tab on"""
enum SortOptionCommentsTab {
fav
minTime
user
}
input SortType {
direction: SortDirection = ASC
sortBy: SortOption = name
}
input SortTypeComments {
direction: SortDirection = ASC
sortBy: SortOptionComments = time
}
input SortTypeCommentsList {
direction: SortDirection = ASC
sortBy: SortOptionCommentsList = alphabetical
}
input SortTypeCommentsTab {
direction: SortDirection = ASC
sortBy: SortOptionCommentsTab = minTime
}
type Tag {
commandsCount: Float!
commentCount: Float!
id: String!
text: String!
}
type Timeline {
bucketEndTime: DateTime!
"""The number of minutes a bucket spans"""
bucketMinutes: Float!
bucketStartTime: DateTime!
buckets: [TimelineBucket!]!
campaignEndTime: DateTime!
campaignStartTime: DateTime!
}
type TimelineBucket {
"""
Beacons that were active during the entire time interval (mutually exclusive with all other beacon lists)
"""
activeBeacons: [String!]!
"""
Links that were active during the entire time interval. (mutually exclusive to all other link lists)
"""
activeLinks: [String!]!
beaconCommandCountPair: [TimelineCommandCountTuple!]!
bucketEndTime: DateTime!
bucketStartTime: DateTime!
"""
Beacons that were created during this time interval (Not mutually exclusive with dying but is mutually exclusive with active and dead)
"""
createdBeacons: [String!]!
"""
Links that were created during this time interval (Not mutually exclusive with dying but is mutually exclusive with active and dead)
"""
createdLinks: [String!]!
"""
Beacons that used to exist by this point in time but have either failed or exited (mutually exclusive with all other beacon lists)
"""
deadBeacons: [String!]!
"""
links that used to exist by this point in time but no longer exist (mutually exclusive to all other link lists)
"""
deadLinks: [String!]!
"""
Beacons that died or exited during this time interval (mutually exclusive with dead and active beacons but not with created)
"""
dyingBeacons: [String!]!
"""
Links that died or exited during this time interval (Not mutually exclusive with created links list but is mutually exclusive with active and dead)
"""
dyingLinks: [String!]!
}
type TimelineCommandCountTuple {
beaconId: String!
"""The number of commands run during this time interval"""
commandCount: Float!
}
type UploadForm {
enabledInBlueTeam: Boolean!
fileDisplay: FileDisplay!
fileUpload: FileUpload!
serverDelineation: ServerDelineationTypes!
tabTitle: String!
}
enum UploadType {
Directory
File
}
enum ValidationMode {
FileExtensions
None
Parser
}