### POST /api-studio/siem/deploy Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/5706088331 Installs database objects into specified pipelines. Requires OAuth Bearer token authentication. ```APIDOC ## POST /api-studio/siem/deploy ### Description Installs database objects into specified pipelines. ### Method POST ### Endpoint /api-studio/siem/deploy ### Parameters #### Query Parameters - **contentDatabase** (String) - Required - Name of the database. #### Request Body - **deployParams** (String) - Required - Identifiers of the pipelines where components are installed. ### Request Example POST https://localhost:8091/api-studio/siem/deploy?contentDatabase=siem_content_for_test Body: ["c9956036-fd79-4e2b-a178-e9c40f5acc68"] ### Response #### Success Response (200) - **Id** (UUID) - Installation identifier - **PipelineId** (UUID) - Pipeline identifier #### Response Example { "Id": "10bcdf49-d7d4-41ed-953c-e50a413eee42", "PipelineId": "c9956036-fd79-4e2b-a178-e9c40f5acc68" } ``` -------------------------------- ### in_subnet Usage Example Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/343536011 An example demonstrating the use of in_subnet within a data processing context. ```text | # Необработанное событие: ---|--- | # Example: 10.0.2.3 10.0.0.0/22 | TEXT = 'Example: {$f1=IPV4} {$f2=STRING}' | datafield1 = in_subnet($f1, $f2) | time = "2017-10-18T12:00:00Z" | # Нормализованное событие: { | #    "datafield1": "true", | #    "time": "2017-10-18T12:00:00Z"} ``` -------------------------------- ### Application and Environment Utilities Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/2082512523 Commands for checking versions, listing resources, and system information. ```bash tarantool --version ``` ```bash tarantoolctl rocks list ``` ```bash tasklist /V /FO CSV ``` ```bash test -d <Путь>; echo $?? ``` ```bash test -e /proc/self/status && cat /proc/self/status ``` ```bash test -e <Путь>; echo $?? ``` ```bash test -f <Путь>; echo $?? ``` ```bash timedatectl status ``` ```bash tt cfg dump | grep run_dir ``` ```bash tt instances ``` ```bash tt rocks list ``` ```bash tt status ``` ```bash uname ``` ```bash uname -a ``` ```bash uname -i ``` ```bash uname -m ``` ```bash uname -n ``` ```bash uname -p ``` ```bash uname -r ``` ```bash uname -s ``` ```bash unzip -p <Путь> <Файл> ``` ```bash update-alternatives --display java ``` ```bash useradd -D ``` ```bash vboxmanage -v ``` ```bash vgdisplay 2>/dev/null ``` ```bash which 7zz 2>/dev/null ``` ```bash which microsoft-edge-beta 2>/dev/null ``` ```bash which microsoft-edge-dev 2>/dev/null ``` ```bash which microsoft-edge-stable 2>/dev/null ``` ```bash which vault 2>/dev/null ``` ```bash who -r ``` -------------------------------- ### GET /_cat/nodes Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/11744472715 Retrieves information about the nodes in the cluster. ```APIDOC ## GET /_cat/nodes ### Description Retrieves information about cluster nodes, including IP addresses, CPU load, RAM usage, and node roles. ### Method GET ### Endpoint localhost:9200/_cat/nodes?v ``` -------------------------------- ### GET / Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/11744472715 Checks the connection to the Elasticsearch client server. ```APIDOC ## GET / ### Description Checks the connection to the client server. The response contains fields such as name, cluster_name, and version. ### Method GET ### Endpoint localhost:9200 ``` -------------------------------- ### Настройка параметра ExecStart для LXD Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/560849163 Добавьте ключ --syslog к параметру ExecStart в файле lxcfs.service для включения журналирования. ```bash ExecStart=/usr/bin/lxd --group lxd --logfile=/var/log/lxd/lxd.log --syslog ``` -------------------------------- ### GET /api-studio/siem/pipelines Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/5706088331 Retrieves identifiers for event processing pipelines. ```APIDOC ## GET /api-studio/siem/pipelines ### Description Retrieves the identifiers for event processing pipelines. ### Method GET ### Endpoint /api-studio/siem/pipelines ### Parameters #### Query Parameters - **contentDatabase** (String) - Required - Name of the database. ``` -------------------------------- ### System Information and Configuration Commands Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/2082512523 A collection of shell commands to retrieve system, network, and package information. ```bash gitlab-rake gitlab:env:info ``` ```bash grep '__version__ = ' <Путь установки>/release.py ``` ```bash grep -r 'Plugin-Version: ' <Путь>/*/META-INF/MANIFEST.MF ``` ```bash grep database <Путь>/bitrix/.settings.php ``` ```bash grubby --info ALL ``` ```bash host <Поле, где хранится имя/домен/IP-адрес узла> 2>/dev/null ``` ```bash hostname ``` ```bash hostname --fqdn 2>/dev/null ``` ```bash hostname -f 2>/dev/null ``` ```bash hostname -s ``` ```bash hostnamectl ``` ```bash initctl list ``` ```bash initctl show-config ``` ```bash ip -4 route show ``` ```bash ip -6 route show ``` ```bash ip -detail a ``` ```bash ip neigh show ``` ```bash ip6tables-save ``` ```bash ipset list ``` ```bash iptables --version ``` ```bash iptables-save ``` ```bash java -jar <Путь установки>/jenkins.war --version ``` ```bash kadmin.local -q "get_principal kadmin/changepw" ``` ```bash kadmin.local -q "get_principal krbtgt/?realm" ``` ```bash klist -V ``` ```bash kubeadm version -o json ``` ```bash kubectl --client=true --output json version ``` ```bash kubelet --version ``` ```bash ls !<Путь> 2>/dev/null ``` ```bash ls -Lld !<Путь> ``` ```bash ls -Lld <Путь> ``` ```bash ls -l "/proc//cwd" ``` ```bash ls -l /dev/disk/by-uuid/ ``` ```bash ls -l /proc/*/exe 2>/dev/null ``` ```bash ls -l /proc//cwd 2>/dev/null ``` ```bash ls -l /proc//exe ``` ```bash ls -l <Путь> ``` ```bash ls -lL <Путь> ``` ```bash ls /etc/xinetd.d ``` ```bash ls <Путь к каталогу с ресурсами кластера> ``` ```bash lsblk -o UUID,MOUNTPOINT ``` ```bash lsmod ``` ```bash lspci ``` ```bash lsusb 2>/dev/null ``` ```bash lvdisplay 2>/dev/null ``` ```bash modinfo -F depends <Модуль> ``` ```bash modinfo -n <Модуль> ``` ```bash mount ``` ```bash netstat -ano ``` ```bash netstat -vpntua 2>/dev/null ``` ```bash nft --version ``` ```bash nsenter -t -m /bin/cat /etc/SuSE-release 2>/dev/null ``` ```bash nsenter -t -m /bin/cat /etc/centos-release ``` ```bash nsenter -t -m /bin/cat /etc/debian_version 2> /dev/null ``` ```bash nsenter -t -m /bin/cat /etc/enterprise-release ``` ```bash nsenter -t -m /bin/cat /etc/lsb-release 2> /dev/null ``` ```bash nsenter -t -m /bin/cat /etc/oracle-release ``` ```bash nsenter -t -m /bin/cat /etc/os-release 2>/dev/null ``` ```bash nsenter -t -m /bin/cat /etc/redhat-release ``` ```bash nsenter -t -m rpm -qa '*release*' 2>/dev/null ``` ```bash nsenter -t -m <Имя службы> --version ``` ```bash openssl ciphers --help ``` ```bash openssl ciphers -s <Протокол> -V '<Директива>' 2> /dev/null ``` ```bash ovirt-aaa-jdbc-tool settings show 2> /dev/null ``` ```bash pargs ``` ```bash pdpl-user <Пользователь> ``` ```bash pgrep -a xinetd ``` ```bash pgrep <Служба> ``` ```bash ping -n 1 -a <Поле для хранения имени узла, IP‑адреса сервера, устройства или любой конечной точки сети> ``` ```bash pkg -N ``` ```bash pkg which <Путь> ``` ```bash procstat -eh ``` ```bash procstat -f | awk '($3 == "<Имя>") {print $NF}' ``` ```bash ps -ax -o lstart,pid,ppid,user,tty,group,comm,args | cat - ``` ```bash ps -e -o "lstart:24,pid:14,ppid:14,user:35,tty:10,group:35,comm:20,label:80,args" 2>/dev/null | cat ``` ```bash ps -e -o pid,ppid,tty,user,group,etime,comm ``` ```bash pvdisplay 2>/dev/null ``` ```bash python3 --version ``` ```bash python3 -c "import platform; print(platform.machine())" ``` ```bash readlink -e /proc//cwd ``` ```bash readlink -f !<Путь> 2>/dev/null ``` ```bash readlink -f /proc//cwd ``` ```bash readlink -m !<Путь> ``` ```bash route print ``` ```bash rpm -qa '*release*' 2>/dev/null ``` ```bash rpm -qa --qf '%{NAME}|%{VERSION}|%{RELEASE}|%{URL}|%{ARCH}\n' ``` ```bash rpm -qa --qf 'Name=%{NAME}\nEpoch=%{EPOCH}\nVersion=%{VERSION}\nRelease=%{RELEASE}\nUrl=%{URL}\nSignature=%{RSAHEADER:pgpsig}\n\n' ``` ```bash rpm -qa --qf 'Name=%{NAME}\nEpoch=%{EPOCH}\nVersion=%{VERSION}\nRelease=%{RELEASE}\nUrl=%{URL}\nSignature=%{SIGGPG:pgpsig}\n\n' ``` -------------------------------- ### Create user account Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/8241684363 Define a new user account with the specified credentials and roles. ```text username <Логин> password <Пароль> role user encryption-level 7 enable true ``` -------------------------------- ### GET /api-studio/siem/objects/list Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/5762443659 Retrieves a list of objects from the SIEM database. ```APIDOC ## GET /api-studio/siem/objects/list ### Description Retrieves a list of database objects with their associated metadata, compilation status, and deployment information. ### Method GET ### Endpoint /api-studio/siem/objects/list ### Response #### Success Response (201) - **Count** (Number) - Quantity of found objects - **Rows** (Array) - List of database object parameters #### Error Handling - 400 (Bad Request) - Syntax error in the request - 401 (Unauthorized) - Authentication error ``` -------------------------------- ### GET /api/incident_dictionaries/types Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/10809157643 Retrieves the list of available incident types. ```APIDOC ## GET /api/incident_dictionaries/types ### Description Retrieves the list of available incident types. ### Method GET ### Endpoint /api/incident_dictionaries/types ``` -------------------------------- ### Create User Account Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/8559418379 Create a user account with administrative privileges for SSH access. ```text username <Логин> password <Пароль> privilege 15 ``` -------------------------------- ### Формат запуска kbtools createRootdb Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/2112098187 Синтаксис команды для создания пустой базы данных с обязательными параметрами. ```bash | kbtools ---|--- |     createRootdb |     --db <Идентификатор БД> |     --kbHost |     --login <Логин> |     --password <Пароль> ``` -------------------------------- ### GET /_cat/health Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/11744472715 Retrieves the current health status of the Elasticsearch cluster. ```APIDOC ## GET /_cat/health ### Description Checks the state of the cluster. The cluster should be in a 'green' status. ### Method GET ### Endpoint localhost:9200/_cat/health ``` -------------------------------- ### GET /api/incident_dictionaries/severities Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/10809157643 Retrieves the list of available incident severity levels. ```APIDOC ## GET /api/incident_dictionaries/severities ### Description Retrieves the list of available incident severity levels. ### Method GET ### Endpoint /api/incident_dictionaries/severities ``` -------------------------------- ### System and Application Information Commands Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/2082512523 A collection of shell commands for querying system state, network configuration, and package details. ```bash gitlab-rake gitlab:env:info grep '__version__ = ' <Путь установки>/release.py grep -r 'Plugin-Version: ' ?path/*/META-INF/MANIFEST.MF grep database <Путь>/bitrix/.settings.php grubby --info ALL host <Поле, где хранится имя/домен/IP-адрес узла> 2>/dev/null hostname hostname --fqdn 2>/dev/null hostname -f 2>/dev/null hostname -s hostnamectl initctl list initctl show-config ip -4 route show ip -6 route show ip -detail a ip neigh show ip6tables-save ipset list iptables --version iptables-save java -jar <Путь установки>/jenkins.war --version kadmin.local -q "get_principal kadmin/changepw" kadmin.local -q "get_principal krbtgt/<Имя зоны для ввода учетных данных>" klist -V kubeadm version -o json kubectl --client=true --output json version kubelet --version ls !<Путь> 2>/dev/null ls -Lld !<Путь> ls -Lld <Путь> ls -l /dev/disk/by-uuid/ ls -l /proc/*/exe 2>/dev/null ls -l /proc//cwd 2>/dev/null ls -l /proc//exe ls -l <Путь> ls -lL <Путь> ls /etc/xinetd.d ls <Путь к каталогу с ресурсами кластера> lsblk -o UUID,MOUNTPOINT lsmod lspci lsusb 2>/dev/null lvdisplay 2>/dev/null modinfo -F depends <Модуль> modinfo -n <Модуль> mount netstat -ano netstat -vpntua 2>/dev/null nft --version nsenter -t -m /bin/cat /etc/SuSE-release 2>/dev/null nsenter -t -m /bin/cat /etc/centos-release nsenter -t -m /bin/cat /etc/debian_version 2> /dev/null nsenter -t -m /bin/cat /etc/enterprise-release nsenter -t -m /bin/cat /etc/lsb-release 2> /dev/null nsenter -t -m /bin/cat /etc/oracle-release nsenter -t -m /bin/cat /etc/os-release 2>/dev/null nsenter -t -m /bin/cat /etc/redhat-release nsenter -t _pid -m rpm -qa '*release*' 2>/dev/null nsenter -t -m ?service_name --version openssl ciphers --help openssl ciphers -s <Протокол> -V '<Директива>' 2> /dev/null ovirt-aaa-jdbc-tool settings show 2> /dev/null pargs pgrep -a xinetd pgrep <Служба> ping -n 1 -a <Поле для хранения имени узла, IP‑адреса сервера, устройства или любой конечной точки сети> pkg -N pkg which <Путь> procstat -eh procstat -f | awk '($3 == "<Имя>") {print $NF}' ps -ax -o lstart,pid,ppid,user,tty,group,comm,args | cat - ps -e -o "lstart:24,pid:14,ppid:14,user:35,tty:10,group:35,comm:20,label:80,args" 2>/dev/null | cat ps -e -o pid,ppid,tty,user,group,etime,comm pvdisplay 2>/dev/null python3 --version python3 -c "import platform; print(platform.machine())" readlink -e /proc//cwd readlink -f !<Путь> 2>/dev/null readlink -f /proc//cwd readlink -m !<Пути> route print rpm -qa '*release*' 2>/dev/null rpm -qa --qf '%{NAME}|%{VERSION}|%{RELEASE}|%{URL}|%{ARCH}\n' rpm -qa --qf 'Name=%{NAME}\nEpoch=%{EPOCH}\nVersion=%{VERSION}\nRelease=%{RELEASE}\nUrl=%{URL}\nSignature=%{RSAHEADER:pgpsig}\n\n' rpm -qa --qf 'Name=%{NAME}\nEpoch=%{EPOCH}\nVersion=%{VERSION}\nRelease=%{RELEASE}\nUrl=%{URL}\nSignature=%{SIGGPG:pgpsig}\n\n' rpm -qa --qf 'Name=%{NAME}\nEpoch=%{EPOCH}\nVersion=%{VERSION}\nRelease=%{RELEASE}\nUrl=%{URL}\nSignature=%{SIGPGP:pgpsig}\n\n' rpm -qa --qf 'Name=%{NAME}\nEpoch=%{EPOCH}\nVersion=%{VERSION}\nRelease=%{RELEASE}\nUrl=%{URL}\nSignature=%{SIGPGP:pgpsig}||%{RSAHEADER:pgpsig}\n\n' rpm -qa --qf 'Name=%{NAME}\nVersion=%{VERSION}\nRelease=%{RELEASE}\nUrl=%{URL}\n\n' rpm -qf --qf '%{NAME}\n' <Путь> rpm -qf --qf '%{NAME}\n' <Путь> 2>/dev/null rpm -qf <Путь> rpm -qf <Путь> 2>/dev/null rpm -qi <Имя> | grep Packager rpm -qi <Пакет> rpm -qi <Имя пакета> rpm -qi glpi 2>/dev/null rpm -qi openresty rpm -ql <Имя> | grep -P 'bin/grafana$' rpm -ql <Имя пакета> | grep "/<Имя файла>" rpm -ql cassandra | grep -e "apache-cassandra-.*\.jar" rpm -ql jenkins 2>/dev/null | grep jenkins.war ``` -------------------------------- ### GET /api/incidentsReadModel/incidents/{id} Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/5187325451 Retrieves the details of a specific incident by its unique identifier. ```APIDOC ## GET /api/incidentsReadModel/incidents/{id} ### Description Retrieves the full details of an incident identified by the provided UUID. ### Method GET ### Endpoint https://localhost/api/incidentsReadModel/incidents/{id} ### Parameters #### Path Parameters - **id** (string) - Required - The unique identifier of the incident. ### Response #### Success Response (200) - **id** (string) - Incident ID - **key** (string) - Incident key - **name** (string) - Incident name - **source** (string) - Source of the incident - **description** (string) - Incident description - **isConfirmed** (boolean) - Confirmation status - **status** (string) - Current status - **measures** (string) - Measures taken - **category** (string) - Incident category - **severity** (string) - Severity level - **type** (string) - Incident type - **created** (string) - Creation timestamp - **detected** (string) - Detection timestamp - **modified** (object) - Modification details - **reporter** (null) - Reporter information - **assigned** (null) - Assigned user - **influence** (null) - Influence data - **groups** (array) - Associated groups - **targets** (object) - Target entities - **attackers** (object) - Attacker entities - **parameters** (array) - Incident parameters - **unitedNotificationCount** (null) - Notification count - **correlationRuleNames** (array) - List of correlation rule names ### Response Example { "id": "917490b0-1a4e-47f8-82d8-7d2031a1c518", "key": "INC-22", "name": "Пример инцидента", "source": "import", "description": "", "isConfirmed": false, "status": "New", "measures": "", "category": "Attack", "severity": "Medium", "type": "Spam", "created": "2021-03-23T08:43:11.0430000Z", "detected": "2021-03-15T21:43:00.0000000Z", "modified": { "date": "2021-05-13T14:31:04.1367790Z", "user": null, "properties": [ { "name": "Name", "oldValue": "Test_inn22", "newValue": "Test_inn33" } ] }, "reporter": null, "assigned": null, "influence": null, "groups": [ { "type": "GroupInfo", "groupType": "static", "id": "1499141b-4c00-0001-0000-00000000000d", "name": "Import", "accessibility": "granted" } ], "targets": { "groups": [], "assets": [], "networks": [], "addresses": [], "others": [] }, "attackers": { "groups": [], "assets": [], "networks": [], "addresses": [], "others": [] }, "parameters": [ { "id": "SpamMailCount", "value": "" } ], "unitedNotificationCount": null, "correlationRuleNames": [] } ``` -------------------------------- ### Запуск скрипта установки Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/3425212939 Команда для запуска скрипта install.sh для настройки роли. ```bash pt_<Название роли>_<Номер версии>/install.sh ``` -------------------------------- ### GET /api/v2/incidents Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/10809157643 Retrieves a list of incidents based on specified filtering conditions. ```APIDOC ## GET /api/v2/incidents ### Description Retrieves a list of incidents that satisfy the specified filtering conditions. ### Method GET ### Endpoint /api/v2/incidents ### Response #### Success Response (200) - **totalItems** (Number) - Total count of incidents matching the filter. - **incidents** (Array) - List of incident objects. #### Incident Object Structure - **assigned** (Array) - Data of the person responsible for the investigation. - **category** (Enum) - Incident category. - **created** (DateTime) - Date and time of incident registration. - **id** (UUID) - Incident identifier. - **isConfirmed** (Bool) - Whether the incident is confirmed. - **key** (String) - Incident identifier (e.g., INC-24453). - **name** (String) - Incident name. - **severity** (Enum) - Incident severity level (low, medium, high). - **status** (Enum) - Incident status (New, Approved, InProgress, Resolved, Closed). - **type** (Enum) - Incident type. ``` -------------------------------- ### System Diagnostic and Configuration Commands Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/2082512523 A collection of shell commands for inspecting system state, kernel parameters, and service configurations. ```bash rpm -ql vault | grep "bin/vault$" ``` ```bash sestatus ``` ```bash ss -lptn | grep ``` ```bash ss -tupan 2>/dev/null ``` ```bash sshd -T ``` ```bash stat -L <Путь к файлу> ``` ```bash sysctl kernel.kexec_load_disabled kernel.unprivileged_bpf_disabled kernel.randomize_va_space kernel.dmesg_restrict kernel.kptr_restrict kernel.perf_event_paranoid kernel.yama.ptrace_scope fs.protected_fifos fs.protected_hardlinks fs.protected_regular fs.protected_symlinks fs.suid_dumpable vm.mmap_min_addr vm.unprivileged_userfaultfd dev.tty.ldisc_autoload net.core.bpf_jit_harden user.max_user_namespaces net.ipv4.conf.all.accept_redirects net.ipv4.conf.default.accept_redirects net.ipv6.conf.all.accept_redirects net.ipv6.conf.default.accept_redirects net.ipv4.conf.all.send_redirects net.ipv4.conf.default.send_redirects net.ipv6.conf.all.forwarding net.ipv6.conf.all.accept_ra net.ipv6.conf.default.accept_ra net.ipv4.conf.all.secure_redirects net.ipv4.conf.default.secure_redirects net.ipv4.conf.all.accept_source_route net.ipv4.conf.default.accept_source_route net.ipv6.conf.all.accept_source_route net.ipv6.conf.default.accept_source_route net.ipv4.conf.all.rp_filter net.ipv4.conf.default.rp_filter net.ipv4.conf.all.log_martians net.ipv4.conf.default.log_martians net.ipv4.icmp_ignore_bogus_error_responses net.ipv4.icmp_echo_ignore_broadcasts net.ipv4.ip_forward net.ipv4.tcp_syncookies 2>/dev/null ``` ```bash systemctl get-default ``` ```bash systemctl list-unit-files -t target --no-pager --no-legend ``` ```bash systemctl list-units --type=socket --all --no-pager --no-legend | awk 'length($1)==1 {print $2; next} {print $1}' | xargs systemctl show --property=Id,ActiveState,Triggers,Accept,UnitFileState --no-pager 2>/dev/null ``` ```bash systemctl list-units -a --type target --no-pager --no-legend ``` ```bash systemctl list-units -t service --all --no-pager --no-legend ``` ```bash systemctl status <Юнит> ``` ```bash tarantool --version ``` ```bash tarantoolctl rocks list ``` ```bash tasklist /V /FO CSV ``` ```bash test -d <Путь>; echo $?? ``` ```bash test -e /proc/self/status && cat /proc/self/status ``` ```bash test -e <Путь>; echo $?? ``` ```bash test -f <Путь>; echo $?? ``` ```bash timedatectl status ``` ```bash tt cfg dump | grep run_dir ``` ```bash tt instances ``` ```bash tt rocks list ``` ```bash tt status ``` ```bash uname ``` ```bash uname -a ``` ```bash uname -m ``` ```bash uname -n ``` ```bash uname -p ``` ```bash uname -r ``` ```bash uname -s ``` ```bash unzip -p <Путь> <Файл> ``` ```bash update-alternatives --display java ``` ```bash useradd -D ``` ```bash vboxmanage -v ``` ```bash vgdisplay 2>/dev/null ``` ```bash which 7zz 2>/dev/null ``` ```bash which microsoft-edge-beta 2>/dev/null ``` ```bash which microsoft-edge-dev 2>/dev/null ``` ```bash which microsoft-edge-stable 2>/dev/null ``` ```bash which vault 2>/dev/null ``` ```bash who -r ``` -------------------------------- ### System Information and Diagnostic Commands Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/2082512523 General commands for retrieving system environment details, network configuration, and process information. ```bash gitlab-rake gitlab:env:info ``` ```bash grep '__version__ = ' <Путь установки>/release.py ``` ```bash grep -r 'Plugin-Version: ' <Путь>/*/META-INF/MANIFEST.MF ``` ```bash grep database <Путь>/bitrix/.settings.php ``` ```bash grubby --info ALL ``` ```bash host <Поле, где хранится имя/домен/IP-адрес узла> 2>/dev/null ``` ```bash hostname ``` ```bash hostname --fqdn 2>/dev/null ``` ```bash hostname -f 2>/dev/null ``` ```bash hostname -s ``` ```bash hostnamectl ``` ```bash initctl list ``` ```bash initctl show-config ``` ```bash ip -4 route show ``` ```bash ip -6 route show ``` ```bash ip -detail a ``` ```bash ip neigh show ``` ```bash ip6tables-save ``` ```bash ipset list ``` ```bash iptables --version ``` ```bash iptables-save ``` ```bash java -jar <Полный путь для установки>/jenkins.war --version ``` ```bash kadmin.local -q "get_principal kadmin/changepw" ``` ```bash kadmin.local -q "get_principal krbtgt/<Имя зоны для ввода учетных данных>" ``` ```bash klist -V ``` ```bash kubeadm version -o json ``` ```bash kubectl --client=true --output json version ``` ```bash kubelet --version ``` ```bash ls !<Путь> 2>/dev/null ``` ```bash ls -Lld !<Путь> ``` ```bash ls -Lld <Путь> ``` ```bash ls -l "/proc//cwd" ``` ```bash ls -l /dev/disk/by-uuid/ ``` ```bash ls -l /proc/*/exe 2>/dev/null ``` ```bash ls -l /proc//cwd 2>/dev/null ``` ```bash ls -l /proc//exe ``` ```bash ls -l <Путь> ``` ```bash ls -lL <Путь> ``` ```bash ls /etc/xinetd.d ``` ```bash ls <Путь к каталогу с ресурсами кластера> ``` ```bash lsblk -o UUID,MOUNTPOINT ``` ```bash lsmod ``` ```bash lsnrctl status ``` ```bash lspci ``` ```bash lsusb 2>/dev/null ``` ```bash lvdisplay 2>/dev/null ``` ```bash modinfo -F depends <Модуль> ``` ```bash modinfo -n <Модуль> ``` ```bash mount ``` ```bash netstat -ano ``` ```bash netstat -vpntua 2>/dev/null ``` ```bash nft --version ``` ```bash nsenter -t -m /bin/cat /etc/SuSE-release 2>/dev/null ``` ```bash nsenter -t -m /bin/cat /etc/centos-release ``` ```bash nsenter -t -m /bin/cat /etc/debian_version 2> /dev/null ``` ```bash nsenter -t -m /bin/cat /etc/enterprise-release ``` ```bash nsenter -t -m /bin/cat /etc/lsb-release 2> /dev/null ``` ```bash nsenter -t -m /bin/cat /etc/oracle-release ``` ```bash nsenter -t -m /bin/cat /etc/os-release 2>/dev/null ``` ```bash nsenter -t -m /bin/cat /etc/redhat-release ``` ```bash nsenter -t -m rpm -qa '*release*' 2>/dev/null ``` ```bash nsenter -t -m <Имя службы> --version ``` ```bash openssl ciphers --help ``` ```bash openssl ciphers -s <Протокол> -V '?directive' 2> /dev/null ``` ```bash ovirt-aaa-jdbc-tool settings show 2> /dev/null ``` ```bash pargs ``` ```bash pgrep -a xinetd ``` ```bash pgrep <Служба> ``` ```bash ping -n 1 -a <Поле для хранения имени узла, IP‑адреса сервера, устройства или любой конечной точки сети> ``` ```bash pkg -N ``` ```bash pkg which <Путь> ``` ```bash procstat -eh ``` ```bash procstat -f | awk '($3 == "?name") {print $NF}' ``` ```bash ps -ax -o lstart,pid,ppid,user,tty,group,comm,args | cat - ``` ```bash ps -e -o "lstart:24,pid:14,ppid:14,user:35,tty:10,group:35,comm:20,label:80,args" 2>/dev/null | cat ``` ```bash ps -e -o pid,ppid,tty,user,group,etime,comm ``` ```bash ps -ef ``` ```bash pvdisplay 2>/dev/null ``` ```bash python3 --version ``` ```bash python3 -c "import platform; print(platform.machine())" ``` ```bash readlink -e /proc//cwd ``` ```bash readlink -f !<Путь> 2>/dev/null ``` ```bash readlink -f /proc//cwd ``` ```bash readlink -m !<Пути> ``` ```bash route print ``` ```bash rpm -qa '*release*' 2>/dev/null ``` ```bash rpm -qa --qf '%{NAME}|%{VERSION}|%{RELEASE}|%{URL}|%{ARCH}\n' ``` ```bash rpm -qa --qf 'Name=%{NAME}\nEpoch=%{EPOCH}\nVersion=%{VERSION}\nRelease=%{RELEASE}\nUrl=%{URL}\nSignature=%{RSAHEADER:pgpsig}\n\n' ``` -------------------------------- ### Retrieve file system attributes Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/2082512523 Get ACLs or extended attributes for a file path. ```bash getfacl --skip-base --absolute-names ! <Путь> ``` ```bash getfattr -n security.selinux --absolute-names !<Путь> ``` -------------------------------- ### createRootdb Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/2112098187 Creates an empty database in the Knowledge Base. ```APIDOC ## createRootdb ### Description Creates an empty database in the Knowledge Base. Requires administrator privileges in the Knowledge Base. ### Usage kbtools createRootdb --db --kbHost --login --password [options] ### Parameters - **--db** (string) - Required - Database identifier. - **--db_name** (string) - Optional - Database name for display in the interface. - **--kbHost** (string) - Required - IP address of the Knowledge Base installation node. - **--kbPort** (integer) - Optional - Port for connecting to the Knowledge Base (default: 8091). - **--iamHost** (string) - Optional - Address of the PT MC installation node (default: same as Knowledge Base). - **--iamPort** (integer) - Optional - Port for connecting to PT MC (default: 3334). - **--login** (string) - Required - Login for connecting to the Knowledge Base. - **--password** (string) - Required - Password for connecting to the Knowledge Base. ### Example /var/lib/deployed-roles/kb-application/kb/tools/kbtools/kbtools createRootdb --db TestRootDB --db_name "Тестовая база" --kbHost kb.company.ru --login --password ``` -------------------------------- ### GET /_nodes//stats Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/11744472715 Retrieves detailed statistics for a specific cluster node. ```APIDOC ## GET /_nodes//stats ### Description Retrieves extended information with detailed statistics for the selected node, including roles, CPU load, RAM usage, disk status, and index status. ### Method GET ### Endpoint localhost:9200/_nodes//stats?pretty ### Parameters #### Path Parameters - **node_name** (string) - Required - The name of the cluster node. ``` -------------------------------- ### Распаковка архива pt_siemstorage Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/8852483083 Команда для распаковки архива с компонентами хранилища на сервере с ролью Deployer. ```bash tar -xf pt_siemstorage_<Номер версии>.tar.gz ``` -------------------------------- ### Event Formatting Templates Source: https://help.ptsecurity.com/ru-RU/projects/mp10/27.6/help/10095289099 JSON-like structure for the final event and an example of a fully formed event. ```json | "time":"