MaxPatrol 10

https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/
Admin
MaxPatrol 10 is a SIEM and security management system designed for collecting, storing, and...
Tokens:415,627
Snippets:3,385
Trust Score:5.8
Update:2 months ago
Show doc for...
Tokens:
Raw
### POST /api-studio/siem/deploy

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/5706088331

Installs database objects into specified pipelines. Requires OAuth Bearer token authentication.

```APIDOC
## POST /api-studio/siem/deploy

### Description
Installs database objects into specified pipelines.

### Method
POST

### Endpoint
/api-studio/siem/deploy

### Parameters
#### Query Parameters
- **contentDatabase** (String) - Required - Name of the database.

#### Request Body
- **deployParams** (String) - Required - Identifiers of the pipelines where components are installed.

### Request Example
POST https://localhost:8091/api-studio/siem/deploy?contentDatabase=siem_content_for_test
Body: ["c9956036-fd79-4e2b-a178-e9c40f5acc68"]

### Response
#### Success Response (200)
- **Id** (UUID) - Installation identifier
- **PipelineId** (UUID) - Pipeline identifier

#### Response Example
{
  "Id": "10bcdf49-d7d4-41ed-953c-e50a413eee42",
  "PipelineId": "c9956036-fd79-4e2b-a178-e9c40f5acc68"
}
```

--------------------------------

### in_subnet Usage Example

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/343536011

An example demonstrating the use of in_subnet within a data processing context.

```text
| # Необработанное событие:  
---|---  
| # Example: 10.0.2.3 10.0.0.0/22  
| TEXT = 'Example: {$f1=IPV4} {$f2=STRING}'  
| datafield1 = in_subnet($f1, $f2)  
| time = "2017-10-18T12:00:00Z"  
| # Нормализованное событие: {  
| #    "datafield1": "true",  
| #    "time": "2017-10-18T12:00:00Z"}
```

--------------------------------

### Application and Environment Utilities

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/2082512523

Commands for checking versions, listing resources, and system information.

```bash
tarantool --version
```

```bash
tarantoolctl rocks list
```

```bash
tasklist /V /FO CSV
```

```bash
test -d <Путь>; echo $??
```

```bash
test -e /proc/self/status && cat /proc/self/status
```

```bash
test -e <Путь>; echo $??
```

```bash
test -f <Путь>; echo $??
```

```bash
timedatectl status
```

```bash
tt cfg dump | grep run_dir
```

```bash
tt instances
```

```bash
tt rocks list
```

```bash
tt status
```

```bash
uname
```

```bash
uname -a
```

```bash
uname -i
```

```bash
uname -m
```

```bash
uname -n
```

```bash
uname -p
```

```bash
uname -r
```

```bash
uname -s
```

```bash
unzip -p <Путь> <Файл>
```

```bash
update-alternatives --display java
```

```bash
useradd -D
```

```bash
vboxmanage -v
```

```bash
vgdisplay 2>/dev/null
```

```bash
which 7zz 2>/dev/null
```

```bash
which microsoft-edge-beta 2>/dev/null
```

```bash
which microsoft-edge-dev 2>/dev/null
```

```bash
which microsoft-edge-stable 2>/dev/null
```

```bash
which vault 2>/dev/null
```

```bash
who -r
```

--------------------------------

### GET /_cat/nodes

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/11744472715

Retrieves information about the nodes in the cluster.

```APIDOC
## GET /_cat/nodes

### Description
Retrieves information about cluster nodes, including IP addresses, CPU load, RAM usage, and node roles.

### Method
GET

### Endpoint
localhost:9200/_cat/nodes?v
```

--------------------------------

### GET /

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/11744472715

Checks the connection to the Elasticsearch client server.

```APIDOC
## GET /

### Description
Checks the connection to the client server. The response contains fields such as name, cluster_name, and version.

### Method
GET

### Endpoint
localhost:9200
```

--------------------------------

### Настройка параметра ExecStart для LXD

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/560849163

Добавьте ключ --syslog к параметру ExecStart в файле lxcfs.service для включения журналирования.

```bash
ExecStart=/usr/bin/lxd --group lxd --logfile=/var/log/lxd/lxd.log --syslog
```

--------------------------------

### GET /api-studio/siem/pipelines

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/5706088331

Retrieves identifiers for event processing pipelines.

```APIDOC
## GET /api-studio/siem/pipelines

### Description
Retrieves the identifiers for event processing pipelines.

### Method
GET

### Endpoint
/api-studio/siem/pipelines

### Parameters
#### Query Parameters
- **contentDatabase** (String) - Required - Name of the database.
```

--------------------------------

### System Information and Configuration Commands

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/2082512523

A collection of shell commands to retrieve system, network, and package information.

```bash
gitlab-rake gitlab:env:info
```

```bash
grep '__version__ = ' <Путь установки>/release.py
```

```bash
grep -r 'Plugin-Version: ' <Путь>/*/META-INF/MANIFEST.MF
```

```bash
grep database <Путь>/bitrix/.settings.php
```

```bash
grubby --info ALL
```

```bash
host <Поле, где хранится имя/домен/IP-адрес узла> 2>/dev/null
```

```bash
hostname
```

```bash
hostname --fqdn 2>/dev/null
```

```bash
hostname -f 2>/dev/null
```

```bash
hostname -s
```

```bash
hostnamectl
```

```bash
initctl list
```

```bash
initctl show-config
```

```bash
ip -4 route show
```

```bash
ip -6 route show
```

```bash
ip -detail a
```

```bash
ip neigh show
```

```bash
ip6tables-save
```

```bash
ipset list
```

```bash
iptables --version
```

```bash
iptables-save
```

```bash
java -jar <Путь установки>/jenkins.war --version
```

```bash
kadmin.local -q "get_principal kadmin/changepw"
```

```bash
kadmin.local -q "get_principal krbtgt/?realm"
```

```bash
klist -V
```

```bash
kubeadm version -o json
```

```bash
kubectl --client=true --output json version
```

```bash
kubelet --version
```

```bash
ls !<Путь> 2>/dev/null
```

```bash
ls -Lld !<Путь>
```

```bash
ls -Lld <Путь>
```

```bash
ls -l "/proc/<PID>/cwd"
```

```bash
ls -l /dev/disk/by-uuid/
```

```bash
ls -l /proc/*/exe 2>/dev/null
```

```bash
ls -l /proc/<PID>/cwd 2>/dev/null
```

```bash
ls -l /proc/<PID>/exe
```

```bash
ls -l <Путь>
```

```bash
ls -lL <Путь>
```

```bash
ls /etc/xinetd.d
```

```bash
ls <Путь к каталогу с ресурсами кластера>
```

```bash
lsblk -o UUID,MOUNTPOINT
```

```bash
lsmod
```

```bash
lspci
```

```bash
lsusb 2>/dev/null
```

```bash
lvdisplay 2>/dev/null
```

```bash
modinfo -F depends <Модуль>
```

```bash
modinfo -n <Модуль>
```

```bash
mount
```

```bash
netstat -ano
```

```bash
netstat -vpntua 2>/dev/null
```

```bash
nft --version
```

```bash
nsenter -t <PID контейнера> -m /bin/cat /etc/SuSE-release 2>/dev/null
```

```bash
nsenter -t <PID контейнера> -m /bin/cat /etc/centos-release
```

```bash
nsenter -t <PID контейнера> -m /bin/cat /etc/debian_version 2> /dev/null
```

```bash
nsenter -t <PID контейнера> -m /bin/cat /etc/enterprise-release
```

```bash
nsenter -t <PID контейнера> -m /bin/cat /etc/lsb-release 2> /dev/null
```

```bash
nsenter -t <PID контейнера> -m /bin/cat /etc/oracle-release
```

```bash
nsenter -t <PID контейнера> -m /bin/cat /etc/os-release 2>/dev/null
```

```bash
nsenter -t <PID контейнера> -m /bin/cat /etc/redhat-release
```

```bash
nsenter -t <PID контейнера> -m rpm -qa '*release*' 2>/dev/null
```

```bash
nsenter -t <PID службы> -m <Имя службы> --version
```

```bash
openssl ciphers --help
```

```bash
openssl ciphers -s <Протокол> -V '<Директива>' 2> /dev/null
```

```bash
ovirt-aaa-jdbc-tool settings show 2> /dev/null
```

```bash
pargs <PID>
```

```bash
pdpl-user <Пользователь>
```

```bash
pgrep -a xinetd
```

```bash
pgrep <Служба>
```

```bash
ping -n 1 -a <Поле для хранения имени узла, IP‑адреса сервера, устройства или любой конечной точки сети>
```

```bash
pkg -N
```

```bash
pkg which <Путь>
```

```bash
procstat -eh <PID>
```

```bash
procstat -f <PID> | awk '($3 == "<Имя>") {print $NF}'
```

```bash
ps -ax -o lstart,pid,ppid,user,tty,group,comm,args | cat -
```

```bash
ps -e -o "lstart:24,pid:14,ppid:14,user:35,tty:10,group:35,comm:20,label:80,args"
2>/dev/null | cat
```

```bash
ps -e -o pid,ppid,tty,user,group,etime,comm
```

```bash
pvdisplay 2>/dev/null
```

```bash
python3 --version
```

```bash
python3 -c "import platform; print(platform.machine())"
```

```bash
readlink -e /proc/<PID>/cwd
```

```bash
readlink -f !<Путь> 2>/dev/null
```

```bash
readlink -f /proc/<PID>/cwd
```

```bash
readlink -m !<Путь>
```

```bash
route print
```

```bash
rpm -qa '*release*' 2>/dev/null
```

```bash
rpm -qa --qf '%{NAME}|%{VERSION}|%{RELEASE}|%{URL}|%{ARCH}\n'
```

```bash
rpm -qa --qf 'Name=%{NAME}\nEpoch=%{EPOCH}\nVersion=%{VERSION}\nRelease=%{RELEASE}\nUrl=%{URL}\nSignature=%{RSAHEADER:pgpsig}\n\n'
```

```bash
rpm -qa --qf 'Name=%{NAME}\nEpoch=%{EPOCH}\nVersion=%{VERSION}\nRelease=%{RELEASE}\nUrl=%{URL}\nSignature=%{SIGGPG:pgpsig}\n\n'
```

--------------------------------

### Create user account

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/8241684363

Define a new user account with the specified credentials and roles.

```text
username <Логин> password <Пароль> role user encryption-level 7 enable true
```

--------------------------------

### GET /api-studio/siem/objects/list

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/5762443659

Retrieves a list of objects from the SIEM database.

```APIDOC
## GET /api-studio/siem/objects/list

### Description
Retrieves a list of database objects with their associated metadata, compilation status, and deployment information.

### Method
GET

### Endpoint
/api-studio/siem/objects/list

### Response
#### Success Response (201)
- **Count** (Number) - Quantity of found objects
- **Rows** (Array) - List of database object parameters

#### Error Handling
- 400 (Bad Request) - Syntax error in the request
- 401 (Unauthorized) - Authentication error
```

--------------------------------

### GET /api/incident_dictionaries/types

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/10809157643

Retrieves the list of available incident types.

```APIDOC
## GET /api/incident_dictionaries/types

### Description
Retrieves the list of available incident types.

### Method
GET

### Endpoint
/api/incident_dictionaries/types
```

--------------------------------

### Create User Account

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/8559418379

Create a user account with administrative privileges for SSH access.

```text
username <Логин>
password <Пароль>
privilege 15
```

--------------------------------

### Формат запуска kbtools createRootdb

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/2112098187

Синтаксис команды для создания пустой базы данных с обязательными параметрами.

```bash
| kbtools   
---|---  
|     createRootdb  
|     --db <Идентификатор БД>  
|     --kbHost <IP-адрес>  
|     --login <Логин>  
|     --password <Пароль>
```

--------------------------------

### GET /_cat/health

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/11744472715

Retrieves the current health status of the Elasticsearch cluster.

```APIDOC
## GET /_cat/health

### Description
Checks the state of the cluster. The cluster should be in a 'green' status.

### Method
GET

### Endpoint
localhost:9200/_cat/health
```

--------------------------------

### GET /api/incident_dictionaries/severities

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/10809157643

Retrieves the list of available incident severity levels.

```APIDOC
## GET /api/incident_dictionaries/severities

### Description
Retrieves the list of available incident severity levels.

### Method
GET

### Endpoint
/api/incident_dictionaries/severities
```

--------------------------------

### System and Application Information Commands

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/2082512523

A collection of shell commands for querying system state, network configuration, and package details.

```bash
gitlab-rake gitlab:env:info
grep '__version__ = ' <Путь установки>/release.py
grep -r 'Plugin-Version: ' ?path/*/META-INF/MANIFEST.MF
grep database <Путь>/bitrix/.settings.php
grubby --info ALL
host <Поле, где хранится имя/домен/IP-адрес узла> 2>/dev/null
hostname
hostname --fqdn 2>/dev/null
hostname -f 2>/dev/null
hostname -s
hostnamectl
initctl list
initctl show-config
ip -4 route show
ip -6 route show
ip -detail a
ip neigh show
ip6tables-save
ipset list
iptables --version
iptables-save
java -jar <Путь установки>/jenkins.war --version
kadmin.local -q "get_principal kadmin/changepw"
kadmin.local -q "get_principal krbtgt/<Имя зоны для ввода учетных данных>"
klist -V
kubeadm version -o json
kubectl --client=true --output json version
kubelet --version
ls !<Путь> 2>/dev/null
ls -Lld !<Путь>
ls -Lld <Путь>
ls -l /dev/disk/by-uuid/
ls -l /proc/*/exe 2>/dev/null
ls -l /proc/<PID>/cwd 2>/dev/null
ls -l /proc/<PID>/exe
ls -l <Путь>
ls -lL <Путь>
ls /etc/xinetd.d
ls <Путь к каталогу с ресурсами кластера>
lsblk -o UUID,MOUNTPOINT
lsmod
lspci
lsusb 2>/dev/null
lvdisplay 2>/dev/null
modinfo -F depends <Модуль>
modinfo -n <Модуль>
mount
netstat -ano
netstat -vpntua 2>/dev/null
nft --version
nsenter -t <PID контейнера> -m /bin/cat /etc/SuSE-release 2>/dev/null
nsenter -t <PID контейнера> -m /bin/cat /etc/centos-release
nsenter -t <PID контейнера> -m /bin/cat /etc/debian_version 2> /dev/null
nsenter -t <PID контейнера> -m /bin/cat /etc/enterprise-release
nsenter -t <PID контейнера> -m /bin/cat /etc/lsb-release 2> /dev/null
nsenter -t <PID контейнера> -m /bin/cat /etc/oracle-release
nsenter -t <PID контейнера> -m /bin/cat /etc/os-release 2>/dev/null
nsenter -t <PID контейнера> -m /bin/cat /etc/redhat-release
nsenter -t <PID контейнера>_pid -m rpm -qa '*release*' 2>/dev/null
nsenter -t <PID службы> -m ?service_name --version
openssl ciphers --help
openssl ciphers -s <Протокол> -V '<Директива>' 2> /dev/null
ovirt-aaa-jdbc-tool settings show 2> /dev/null
pargs <PID>
pgrep -a xinetd
pgrep <Служба>
ping -n 1 -a <Поле для хранения имени узла, IP‑адреса сервера, устройства или любой конечной точки сети>
pkg -N
pkg which <Путь>
procstat -eh <PID>
procstat -f <PID> | awk '($3 == "<Имя>") {print $NF}'
ps -ax -o lstart,pid,ppid,user,tty,group,comm,args | cat -
ps -e -o "lstart:24,pid:14,ppid:14,user:35,tty:10,group:35,comm:20,label:80,args" 2>/dev/null | cat
ps -e -o pid,ppid,tty,user,group,etime,comm
pvdisplay 2>/dev/null
python3 --version
python3 -c "import platform; print(platform.machine())"
readlink -e /proc/<PID>/cwd
readlink -f !<Путь> 2>/dev/null
readlink -f /proc/<PID>/cwd
readlink -m !<Пути>
route print
rpm -qa '*release*' 2>/dev/null
rpm -qa --qf '%{NAME}|%{VERSION}|%{RELEASE}|%{URL}|%{ARCH}\n'
rpm -qa --qf 'Name=%{NAME}\nEpoch=%{EPOCH}\nVersion=%{VERSION}\nRelease=%{RELEASE}\nUrl=%{URL}\nSignature=%{RSAHEADER:pgpsig}\n\n'
rpm -qa --qf 'Name=%{NAME}\nEpoch=%{EPOCH}\nVersion=%{VERSION}\nRelease=%{RELEASE}\nUrl=%{URL}\nSignature=%{SIGGPG:pgpsig}\n\n'
rpm -qa --qf 'Name=%{NAME}\nEpoch=%{EPOCH}\nVersion=%{VERSION}\nRelease=%{RELEASE}\nUrl=%{URL}\nSignature=%{SIGPGP:pgpsig}\n\n'
rpm -qa --qf 'Name=%{NAME}\nEpoch=%{EPOCH}\nVersion=%{VERSION}\nRelease=%{RELEASE}\nUrl=%{URL}\nSignature=%{SIGPGP:pgpsig}||%{RSAHEADER:pgpsig}\n\n'
rpm -qa --qf 'Name=%{NAME}\nVersion=%{VERSION}\nRelease=%{RELEASE}\nUrl=%{URL}\n\n'
rpm -qf --qf '%{NAME}\n' <Путь>
rpm -qf --qf '%{NAME}\n' <Путь> 2>/dev/null
rpm -qf <Путь>
rpm -qf <Путь> 2>/dev/null
rpm -qi <Имя> | grep Packager
rpm -qi <Пакет>
rpm -qi <Имя пакета>
rpm -qi glpi 2>/dev/null
rpm -qi openresty
rpm -ql <Имя> | grep -P 'bin/grafana$'
rpm -ql <Имя пакета> | grep "/<Имя файла>"
rpm -ql cassandra | grep -e "apache-cassandra-.*\.jar"
rpm -ql jenkins 2>/dev/null | grep jenkins.war
```

--------------------------------

### GET /api/incidentsReadModel/incidents/{id}

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/5187325451

Retrieves the details of a specific incident by its unique identifier.

```APIDOC
## GET /api/incidentsReadModel/incidents/{id}

### Description
Retrieves the full details of an incident identified by the provided UUID.

### Method
GET

### Endpoint
https://localhost/api/incidentsReadModel/incidents/{id}

### Parameters
#### Path Parameters
- **id** (string) - Required - The unique identifier of the incident.

### Response
#### Success Response (200)
- **id** (string) - Incident ID
- **key** (string) - Incident key
- **name** (string) - Incident name
- **source** (string) - Source of the incident
- **description** (string) - Incident description
- **isConfirmed** (boolean) - Confirmation status
- **status** (string) - Current status
- **measures** (string) - Measures taken
- **category** (string) - Incident category
- **severity** (string) - Severity level
- **type** (string) - Incident type
- **created** (string) - Creation timestamp
- **detected** (string) - Detection timestamp
- **modified** (object) - Modification details
- **reporter** (null) - Reporter information
- **assigned** (null) - Assigned user
- **influence** (null) - Influence data
- **groups** (array) - Associated groups
- **targets** (object) - Target entities
- **attackers** (object) - Attacker entities
- **parameters** (array) - Incident parameters
- **unitedNotificationCount** (null) - Notification count
- **correlationRuleNames** (array) - List of correlation rule names

### Response Example
{
  "id": "917490b0-1a4e-47f8-82d8-7d2031a1c518",
  "key": "INC-22",
  "name": "Пример инцидента",
  "source": "import",
  "description": "",
  "isConfirmed": false,
  "status": "New",
  "measures": "",
  "category": "Attack",
  "severity": "Medium",
  "type": "Spam",
  "created": "2021-03-23T08:43:11.0430000Z",
  "detected": "2021-03-15T21:43:00.0000000Z",
  "modified": {
    "date": "2021-05-13T14:31:04.1367790Z",
    "user": null,
    "properties": [
      {
        "name": "Name",
        "oldValue": "Test_inn22",
        "newValue": "Test_inn33"
      }
    ]
  },
  "reporter": null,
  "assigned": null,
  "influence": null,
  "groups": [
    {
      "type": "GroupInfo",
      "groupType": "static",
      "id": "1499141b-4c00-0001-0000-00000000000d",
      "name": "Import",
      "accessibility": "granted"
    }
  ],
  "targets": {
    "groups": [],
    "assets": [],
    "networks": [],
    "addresses": [],
    "others": []
  },
  "attackers": {
    "groups": [],
    "assets": [],
    "networks": [],
    "addresses": [],
    "others": []
  },
  "parameters": [
    {
      "id": "SpamMailCount",
      "value": ""
    }
  ],
  "unitedNotificationCount": null,
  "correlationRuleNames": []
}
```

--------------------------------

### Запуск скрипта установки

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/3425212939

Команда для запуска скрипта install.sh для настройки роли.

```bash
pt_<Название роли>_<Номер версии>/install.sh
```

--------------------------------

### GET /api/v2/incidents

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/10809157643

Retrieves a list of incidents based on specified filtering conditions.

```APIDOC
## GET /api/v2/incidents

### Description
Retrieves a list of incidents that satisfy the specified filtering conditions.

### Method
GET

### Endpoint
/api/v2/incidents

### Response
#### Success Response (200)
- **totalItems** (Number) - Total count of incidents matching the filter.
- **incidents** (Array) - List of incident objects.

#### Incident Object Structure
- **assigned** (Array) - Data of the person responsible for the investigation.
- **category** (Enum) - Incident category.
- **created** (DateTime) - Date and time of incident registration.
- **id** (UUID) - Incident identifier.
- **isConfirmed** (Bool) - Whether the incident is confirmed.
- **key** (String) - Incident identifier (e.g., INC-24453).
- **name** (String) - Incident name.
- **severity** (Enum) - Incident severity level (low, medium, high).
- **status** (Enum) - Incident status (New, Approved, InProgress, Resolved, Closed).
- **type** (Enum) - Incident type.
```

--------------------------------

### System Diagnostic and Configuration Commands

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/2082512523

A collection of shell commands for inspecting system state, kernel parameters, and service configurations.

```bash
rpm -ql vault | grep "bin/vault$"
```

```bash
sestatus
```

```bash
ss -lptn | grep <PID>
```

```bash
ss -tupan 2>/dev/null
```

```bash
sshd -T
```

```bash
stat -L <Путь к файлу>
```

```bash
sysctl kernel.kexec_load_disabled kernel.unprivileged_bpf_disabled kernel.randomize_va_space
    kernel.dmesg_restrict kernel.kptr_restrict kernel.perf_event_paranoid kernel.yama.ptrace_scope
    fs.protected_fifos fs.protected_hardlinks fs.protected_regular fs.protected_symlinks
    fs.suid_dumpable vm.mmap_min_addr vm.unprivileged_userfaultfd dev.tty.ldisc_autoload
    net.core.bpf_jit_harden user.max_user_namespaces net.ipv4.conf.all.accept_redirects
    net.ipv4.conf.default.accept_redirects net.ipv6.conf.all.accept_redirects net.ipv6.conf.default.accept_redirects
    net.ipv4.conf.all.send_redirects net.ipv4.conf.default.send_redirects net.ipv6.conf.all.forwarding
    net.ipv6.conf.all.accept_ra net.ipv6.conf.default.accept_ra net.ipv4.conf.all.secure_redirects
    net.ipv4.conf.default.secure_redirects net.ipv4.conf.all.accept_source_route net.ipv4.conf.default.accept_source_route
    net.ipv6.conf.all.accept_source_route net.ipv6.conf.default.accept_source_route
    net.ipv4.conf.all.rp_filter net.ipv4.conf.default.rp_filter net.ipv4.conf.all.log_martians
    net.ipv4.conf.default.log_martians net.ipv4.icmp_ignore_bogus_error_responses
    net.ipv4.icmp_echo_ignore_broadcasts net.ipv4.ip_forward net.ipv4.tcp_syncookies
    2>/dev/null
```

```bash
systemctl get-default
```

```bash
systemctl list-unit-files -t target --no-pager --no-legend
```

```bash
systemctl list-units --type=socket --all --no-pager --no-legend | awk 'length($1)==1
{print $2; next} {print $1}' | xargs systemctl show --property=Id,ActiveState,Triggers,Accept,UnitFileState
--no-pager 2>/dev/null
```

```bash
systemctl list-units -a --type target --no-pager --no-legend
```

```bash
systemctl list-units -t service --all --no-pager --no-legend
```

```bash
systemctl status <Юнит>
```

```bash
tarantool --version
```

```bash
tarantoolctl rocks list
```

```bash
tasklist /V /FO CSV
```

```bash
test -d <Путь>; echo $??
```

```bash
test -e /proc/self/status && cat /proc/self/status
```

```bash
test -e <Путь>; echo $??
```

```bash
test -f <Путь>; echo $??
```

```bash
timedatectl status
```

```bash
tt cfg dump | grep run_dir
```

```bash
tt instances
```

```bash
tt rocks list
```

```bash
tt status
```

```bash
uname
```

```bash
uname -a
```

```bash
uname -m
```

```bash
uname -n
```

```bash
uname -p
```

```bash
uname -r
```

```bash
uname -s
```

```bash
unzip -p <Путь> <Файл>
```

```bash
update-alternatives --display java
```

```bash
useradd -D
```

```bash
vboxmanage -v
```

```bash
vgdisplay 2>/dev/null
```

```bash
which 7zz 2>/dev/null
```

```bash
which microsoft-edge-beta 2>/dev/null
```

```bash
which microsoft-edge-dev 2>/dev/null
```

```bash
which microsoft-edge-stable 2>/dev/null
```

```bash
which vault 2>/dev/null
```

```bash
who -r
```

--------------------------------

### System Information and Diagnostic Commands

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/2082512523

General commands for retrieving system environment details, network configuration, and process information.

```bash
gitlab-rake gitlab:env:info
```

```bash
grep '__version__ = ' <Путь установки>/release.py
```

```bash
grep -r 'Plugin-Version: ' <Путь>/*/META-INF/MANIFEST.MF
```

```bash
grep database <Путь>/bitrix/.settings.php
```

```bash
grubby --info ALL
```

```bash
host <Поле, где хранится имя/домен/IP-адрес узла> 2>/dev/null
```

```bash
hostname
```

```bash
hostname --fqdn 2>/dev/null
```

```bash
hostname -f 2>/dev/null
```

```bash
hostname -s
```

```bash
hostnamectl
```

```bash
initctl list
```

```bash
initctl show-config
```

```bash
ip -4 route show
```

```bash
ip -6 route show
```

```bash
ip -detail a
```

```bash
ip neigh show
```

```bash
ip6tables-save
```

```bash
ipset list
```

```bash
iptables --version
```

```bash
iptables-save
```

```bash
java -jar <Полный путь для установки>/jenkins.war --version
```

```bash
kadmin.local -q "get_principal kadmin/changepw"
```

```bash
kadmin.local -q "get_principal krbtgt/<Имя зоны для ввода учетных данных>"
```

```bash
klist -V
```

```bash
kubeadm version -o json
```

```bash
kubectl --client=true --output json version
```

```bash
kubelet --version
```

```bash
ls !<Путь> 2>/dev/null
```

```bash
ls -Lld !<Путь>
```

```bash
ls -Lld <Путь>
```

```bash
ls -l "/proc/<PID>/cwd"
```

```bash
ls -l /dev/disk/by-uuid/
```

```bash
ls -l /proc/*/exe 2>/dev/null
```

```bash
ls -l /proc/<PID>/cwd 2>/dev/null
```

```bash
ls -l /proc/<PID>/exe
```

```bash
ls -l <Путь>
```

```bash
ls -lL <Путь>
```

```bash
ls /etc/xinetd.d
```

```bash
ls <Путь к каталогу с ресурсами кластера>
```

```bash
lsblk -o UUID,MOUNTPOINT
```

```bash
lsmod
```

```bash
lsnrctl status
```

```bash
lspci
```

```bash
lsusb 2>/dev/null
```

```bash
lvdisplay 2>/dev/null
```

```bash
modinfo -F depends <Модуль>
```

```bash
modinfo -n <Модуль>
```

```bash
mount
```

```bash
netstat -ano
```

```bash
netstat -vpntua 2>/dev/null
```

```bash
nft --version
```

```bash
nsenter -t <PID контейнера> -m /bin/cat /etc/SuSE-release 2>/dev/null
```

```bash
nsenter -t <PID контейнера> -m /bin/cat /etc/centos-release
```

```bash
nsenter -t <PID контейнера> -m /bin/cat /etc/debian_version 2> /dev/null
```

```bash
nsenter -t <PID контейнера> -m /bin/cat /etc/enterprise-release
```

```bash
nsenter -t <PID контейнера> -m /bin/cat /etc/lsb-release 2> /dev/null
```

```bash
nsenter -t <PID контейнера> -m /bin/cat /etc/oracle-release
```

```bash
nsenter -t <PID контейнера> -m /bin/cat /etc/os-release 2>/dev/null
```

```bash
nsenter -t <PID контейнера> -m /bin/cat /etc/redhat-release
```

```bash
nsenter -t <PID контейнера>-m rpm -qa '*release*' 2>/dev/null
```

```bash
nsenter -t <PID службы> -m <Имя службы> --version
```

```bash
openssl ciphers --help
```

```bash
openssl ciphers -s <Протокол> -V '?directive' 2> /dev/null
```

```bash
ovirt-aaa-jdbc-tool settings show 2> /dev/null
```

```bash
pargs <PID>
```

```bash
pgrep -a xinetd
```

```bash
pgrep <Служба>
```

```bash
ping -n 1 -a <Поле для хранения имени узла, IP‑адреса сервера, устройства или любой конечной точки сети>
```

```bash
pkg -N
```

```bash
pkg which <Путь>
```

```bash
procstat -eh <PID>
```

```bash
procstat -f <PID> | awk '($3 == "?name") {print $NF}'
```

```bash
ps -ax -o lstart,pid,ppid,user,tty,group,comm,args | cat -
```

```bash
ps -e -o "lstart:24,pid:14,ppid:14,user:35,tty:10,group:35,comm:20,label:80,args"
2>/dev/null | cat
```

```bash
ps -e -o pid,ppid,tty,user,group,etime,comm
```

```bash
ps -ef
```

```bash
pvdisplay 2>/dev/null
```

```bash
python3 --version
```

```bash
python3 -c "import platform; print(platform.machine())"
```

```bash
readlink -e /proc/<PID>/cwd
```

```bash
readlink -f !<Путь> 2>/dev/null
```

```bash
readlink -f /proc/<PID>/cwd
```

```bash
readlink -m !<Пути>
```

```bash
route print
```

```bash
rpm -qa '*release*' 2>/dev/null
```

```bash
rpm -qa --qf '%{NAME}|%{VERSION}|%{RELEASE}|%{URL}|%{ARCH}\n'
```

```bash
rpm -qa --qf 'Name=%{NAME}\nEpoch=%{EPOCH}\nVersion=%{VERSION}\nRelease=%{RELEASE}\nUrl=%{URL}\nSignature=%{RSAHEADER:pgpsig}\n\n'
```

--------------------------------

### Retrieve file system attributes

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/2082512523

Get ACLs or extended attributes for a file path.

```bash
getfacl --skip-base --absolute-names ! <Путь>
```

```bash
getfattr -n security.selinux --absolute-names !<Путь>
```

--------------------------------

### createRootdb

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/2112098187

Creates an empty database in the Knowledge Base.

```APIDOC
## createRootdb

### Description
Creates an empty database in the Knowledge Base. Requires administrator privileges in the Knowledge Base.

### Usage
kbtools createRootdb --db <DB_ID> --kbHost <IP_address> --login <Login> --password <Password> [options]

### Parameters
- **--db** (string) - Required - Database identifier.
- **--db_name** (string) - Optional - Database name for display in the interface.
- **--kbHost** (string) - Required - IP address of the Knowledge Base installation node.
- **--kbPort** (integer) - Optional - Port for connecting to the Knowledge Base (default: 8091).
- **--iamHost** (string) - Optional - Address of the PT MC installation node (default: same as Knowledge Base).
- **--iamPort** (integer) - Optional - Port for connecting to PT MC (default: 3334).
- **--login** (string) - Required - Login for connecting to the Knowledge Base.
- **--password** (string) - Required - Password for connecting to the Knowledge Base.

### Example
/var/lib/deployed-roles/kb-application/kb/tools/kbtools/kbtools createRootdb --db TestRootDB --db_name "Тестовая база" --kbHost kb.company.ru --login <Login> --password <Password>
```

--------------------------------

### GET /_nodes/<node_name>/stats

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/11744472715

Retrieves detailed statistics for a specific cluster node.

```APIDOC
## GET /_nodes/<node_name>/stats

### Description
Retrieves extended information with detailed statistics for the selected node, including roles, CPU load, RAM usage, disk status, and index status.

### Method
GET

### Endpoint
localhost:9200/_nodes/<node_name>/stats?pretty

### Parameters
#### Path Parameters
- **node_name** (string) - Required - The name of the cluster node.
```

--------------------------------

### Распаковка архива pt_siemstorage

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/8852483083

Команда для распаковки архива с компонентами хранилища на сервере с ролью Deployer.

```bash
tar -xf pt_siemstorage_<Номер версии>.tar.gz
```

--------------------------------

### Event Formatting Templates

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/10095289099

JSON-like structure for the final event and an example of a fully formed event.

```json
| "time":"<time>",  
---|---  
| "hostname":"<hostname>",  
| "source":"<source>"  
| "eventid":"<eventid>",  
| "items": {  
| 		"<type 1>":["<value 11>", "<value 12>",...]  
| 		"<type 2>":["<value 21>, "<value 22>,...]  
| 		...  
| }
```

```json
| "eventid":"a2243f85",  
---|---  
| "items":{  
| 		"AttackClient":["   
| 			browser=\"Chrome\"  
| 			browser_version=\"80.0\"  
| 			os=\"Windows\"  
| 			ip=\"10.0.76.108\"  
| 			username=\"\"  
| 		"],  
| 		"AttackEvent":["  
| 			ID=\"c53d0808\"  
| 			rule=\"cross_site_scripting_in_html_context\"  
| 			description=\"Some description.\"  
| 			actions=\"\"  
| 			severity=\"low\"  
| 			accuracy=\"8\"  
| 		"],  
| 		"AttackEventMatched":["  
| 			name=\"REQUEST_GET\"  
| 			key=\"c\"  
| 			value=\"<script>alert(\\\"Hello\\\")</script>\"  
| 		"],  
| 		"AttackHTTP":["  
| 			phase=\"on_request\"  
| 			transaction_id=\"2d0d3825\"  
| 			method=\"GET\"  
| 			path=\"/a?c=%3Cscript%3Ealert(%22Hello%22)%3C\"  
| 		"],  
| }
```

--------------------------------

### GET /api/incidentsReadModel/v2/incidents/{incidentId}/events

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/4589536907

Retrieves a list of events associated with a specific incident identifier.

```APIDOC
## GET /api/incidentsReadModel/v2/incidents/{incidentId}/events

### Description
Retrieves event data for a specific incident. Requires OAuth Bearer token authentication.

### Method
GET

### Endpoint
/api/incidentsReadModel/v2/incidents/{incidentId}/events

### Parameters
#### Path Parameters
- **incidentId** (String) - Required - The unique identifier of the incident.

### Response
#### Success Response (200)
- **id** (String) - Identifier of the event
- **timestamp** (String) - Date and time of the event

#### Error Response (400)
- **message** (String) - Error message
- **modelState** (Array) - Model state details
```

--------------------------------

### Удаление Docker-контейнеров

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/4884936971

Команда для удаления всех Docker-контейнеров на сервере.

```bash
docker rm $(docker ps -qa)
```

--------------------------------

### Проверка текущей политики sudo

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/7890913419

Используется для определения текущего статуса политики команды sudo.

```bash
control sudo status
```

--------------------------------

### GET /<index>/_search

Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/11744475915

Searches for events within a specific index using a query body.

```APIDOC
## GET /<index>/_search

### Description
Exports events from an Elasticsearch index based on a provided query.

### Method
GET

### Endpoint
localhost:9200/<index>/_search

### Parameters
#### Path Parameters
- **index** (string) - Required - The identifier of the index to search.

#### Query Parameters
- **pretty** (flag) - Optional - Returns a pretty-printed JSON response.
- **size** (integer) - Optional - The number of events to return.

### Request Body
- **query** (object) - Required - The search query definition (e.g., range or match).

### Request Example
{
  "query": {
    "range": {
      "time": {
        "gte": "2024-11-30T00:10:00Z",
        "lte": "2024-11-30T23:20:00Z"
      }
    }
  }
}
```
Tokens:
Raw