cisagov--redeye/docs/parser-guide/commands-api/parse-campaign/interfaces/ParserOutput.md

@redeye/parser-core / ParserOutput

Interface: ParserOutput

Table of contents

Properties

• beacons
• commands
• hosts
• links
• operators
• servers

Properties

beacons

• beacons: Object

A key-value pair of beacon names and their metadata

Example

// If the beacon 'beacon1' was created from server 'server1' on host 'DESKTOP-312' at 2021-01-01T00:00:00 and last checked in at 2021-02-02T00:00:02
beacons = {
	beacon1: {
		name: 'beacon1',
		server: 'server1',
		host: 'DESKTOP-312',
		ip: '192.168.23.2',
		process: 'svchost.exe',
		pid: 1234,
		startTime: new Date('2021-01-01T00:00:00.000Z'),
		endTime: new Date('2021-02-02T00:00:02.000Z'),
	},
};

Index signature

▪ [beaconName: string]: ParserBeacon

Defined in

index.ts:62

---

commands

• commands: Object

A key-value pair of unique command identifiers and commands with inputs and outputs, sent by operators to beacons

Example

// If the operator 'admin' sent a command to the beacon 'beacon1' at 2021-01-01T00:00:00
commands = {
	'admin-beacon1-2021-01-01T00:00:00': {
		operator: 'admin',
		beacon: 'beacon1',
		input: {
			blob: 'shell whoami',
			filepath: 'C:\\Users\\admin\\Desktop\\command.txt',
			lineNumber: 1,
			logType: 'BEACON',
		},
		output: {
			blob: 'admin',
			filepath: 'C:\\Users\\admin\\Desktop\\command.txt',
			lineNumber: 2,
			logType: 'BEACON',
		},
		attackIds: ['T1033'],
	},
};

Index signature

▪ [commandName: string]: ParserCommand

Defined in

index.ts:106

---

hosts

• hosts: Object

A key-value pair of host names and their metadata

Example

// If the host 'DESKTOP-312' was first discovered or had a beacon spawned by server 'server1' with os 'Windows 10.0.19041'
hosts = {
	'DESKTOP-312': {
		name: 'DESKTOP-312',
		server: 'server1',
		os: 'Windows',
		osVersion: '10.0.19041',
		ip: '192.168.23.2',
		type: 'desktop',
	},
};

Index signature

▪ [hostName: string]: ParserHost

Defined in

index.ts:41

---

links

• links: Object

A key-value pair of '-' and links from servers to beacons and beacons to beacons

Example

// If the server 'server1' has a beacon named 'beacon1'
links = {
	'server1-beacon1': {
		from: 'server1',
		to: 'beacon1',
	},
};

Index signature

▪ [linkName: string]: ParserLink

Defined in

index.ts:120

---

operators

• operators: Object

A key-value pair of operator names and the time range of their first and last command

Example

// If the operator 'admin' their first command at 2021-01-01T00:00:00 and last command at 2021-02-02T00:00:02
operators = {
	admin: {
		name: 'admin',
		startTime: new Date('2021-01-01T00:00:00.000Z'),
		endTime: new Date('2021-02-02T00:00:02.000Z'),
	},
};

Index signature

▪ [operatorName: string]: ParserOperator

Defined in

index.ts:78

---

servers

• servers: Object

A key-value pair of server names and their metadata

Example

// If a C2 server was create with name 'server1' and will be communicating over https
servers = {
	server1: {
		name: 'server1',
		type: 'https',
	},
};

Index signature

▪ [serverName: string]: ParserServer

Defined in

index.ts:22