Interactive Console & Execution

Beyond automated workflows, Unified Security Stack SOAR provides an Interactive Console for running commands on agents in real time, Automation Variables for storing reusable values, and an Execution Audit This view tracks all SOAR activity.

Interactive Console

The Interactive Console offers a live terminal based on WebSocket to any connected Unified Security Stack agent. Reach it from the SOAR section at SOAR > Interactive Console.

How It Works

1. The left sidebar displays all registered agents, searchable by hostname

2. Select an agent to open a terminal session

3. Type commands directly — they are sent to the agent and executed in real time

4. Output streams back to the console as the command runs

The console supports the same shell environments as automated workflows:

• Windows agents: CMD or PowerShell

• Linux agents: Bash

• macOS agents: Bash

Use Cases

• Ad-hoc investigation: Run forensic commands on a compromised endpoint without needing SSH/RDP access

• Manual containment: Execute response commands immediately when automated workflows are not configured

• Workflow testing: Test commands before adding them to an automated workflow

• Troubleshooting: Verify agent connectivity and command execution

Automation Variables

Automation Variables are reusable key-value pairs that may be injected into SOAR workflow commands. They are managed at SOAR > Automation Variables.

Variable Types

Using Variables in Commands

Variables are referenced in workflow commands using the $[variables.variableName] syntax:

curl -H "Authorization: Bearer $[variables.apiToken]" https://api.example.com/block/$[variables.firewallEndpoint]

During execution, the placeholders for variables are swapped with their real values. Secret variables are decrypted only at the agent-manager level — the backend never views the decrypted values.

Security Protections

The system prevents commands that would expose secret variable values by detecting output commands such as echo, printf, Write-Output, cat, type, console.log, print, and pipe operators. Commands that contain these patterns together with secret variables are rejected.

Managing Variables

Execution Flow (How Commands Reach Agents)

Knowing the execution pipeline helps troubleshooting and performance expectations.

sequenceDiagram
    participant Alert as Alert Engine
    participant Backend as Unified Security Stack Backend
    participant AgentMgr as Agent Manager (gRPC)
    participant Agent as Endpoint Agent

    Alert->>Backend: New alert detected
    Backend->>Backend: Evaluate active rules against alert
    Backend->>Backend: Create PENDING execution record
    Note over Backend: Scheduled job runs every 5 minutes
    Backend->>AgentMgr: ProcessCommand (gRPC)
    AgentMgr->>AgentMgr: Decrypt secret variables
    AgentMgr->>Agent: Forward command via bidirectional stream
    Agent->>Agent: Execute command in specified shell
    Agent->>AgentMgr: Return result
    AgentMgr->>Backend: CommandResult
    Backend->>Backend: Update execution status (EXECUTED/ERROR)

Key Details

Execution Statuses

Non-Execution Causes

When a workflow cannot execute, the system records the reason:

Execution Audit

The SOAR > Audit view offers a real-time table (updating every 30 seconds) of every SOAR command execution.

Audit Table Columns

Filtering

The audit view supports filtering by:

• Origin type: Alert, Incident, Incident Response, User Execution

• Agent: Filter by specific agent hostname

Origin Types

API Endpoints

Workflow Rules

Action Templates

Execution History

Automation Variables

Jobs (Command Execution)