cisagov--redeye/docs/parser-guide/commands-api/parse-campaign/interfaces/ParserCommand.md

@redeye/parser-core / ParserCommand

Interface: ParserCommand

Table of contents

Properties

• attackIds
• beacon
• commandFailed
• input
• operator
• output

Properties

attackIds

• Optional attackIds: string[]

A list of the MITRE ATT&CK techniques used by the command

Default

[];

Example

attackIds = ['T1059', 'T1059.001'];

Defined in

parser-command.ts:68

---

beacon

• beacon: string

Name of the beacon that the command was run from Should match the name of a beacon in the beacons object

Example

beacon = 'beacon1';

Defined in

parser-command.ts:17

---

commandFailed

• Optional commandFailed: boolean

Whether the command was successful

Default

false;

Example

// The command output was not found in the logs or the command failed
commandFailed = true;

Defined in

parser-command.ts:38

---

input

• input: ParserLogEntry

The input that initialized the command

Example

input = {
	blob: 'ls',
	filepath: '<directory-of-parser>/logs/2023-02-01/log-1.txt',
	lineNumber: 123,
	logType: 'INPUT',
	dateTime: new Date('2021-01-01T00:00:00.000Z'),
};

Defined in

parser-command.ts:30

---

operator

• Optional operator: string

Name of the operator that sent the command Should match the name of an operator in the operators object

Example

operator = 'admin';

Defined in

parser-command.ts:10

---

output

• Optional output: ParserLogEntry

The output of the command

Example

// If the command was successful
output = {
	blob: '[System Process]\nsmss.exe\n...etc',
	filepath: '<directory-of-parser>/logs/2023-02-01/log-1.txt',
	lineNumber: 123,
	logType: 'OUTPUT',
	dateTime: new Date('2021-01-01T00:00:00.000Z'),
};
// If the command failed
output = undefined;
// or
output = {
	blob: 'Unknown command: pwd',
	filepath: '<directory-of-parser>/logs/2023-02-01/log-1.txt',
	lineNumber: 123,
	logType: 'ERROR',
	dateTime: new Date('2021-01-01T00:00:00.000Z'),
};

Defined in

parser-command.ts:61