Interactive Console & Execution

Beyond automated workflows, UTMStack SOAR provides an Interactive Console for running commands on agents in real time, Automation Variables for storing reusable values, and an Execution Audit view for tracking all SOAR activity.

Interactive Console

The Interactive Console provides a live, WebSocket-based terminal to any connected UTMStack agent. Access it from the SOAR section at SOAR > Interactive Console.

How It Works

1. The left sidebar displays all registered agents, searchable by hostname

2. Select an agent to open a terminal session

3. Type commands directly — they are sent to the agent and executed in real time

4. Output streams back to the console as the command runs

The console supports the same shell environments as automated workflows:

• Windows agents: CMD or PowerShell

• Linux agents: Bash

• macOS agents: Bash

Use Cases

• Ad-hoc investigation: Run forensic commands on a compromised endpoint without needing SSH/RDP access

• Manual containment: Execute response commands immediately when automated workflows are not configured

• Workflow testing: Test commands before adding them to an automated workflow

• Troubleshooting: Verify agent connectivity and command execution

Automation Variables

Automation Variables are reusable key-value pairs that can be injected into SOAR workflow commands. They are managed at SOAR > Automation Variables.

Variable Types

Using Variables in Commands

Variables are referenced in workflow commands using the $[variables.variableName] syntax:

curl -H "Authorization: Bearer $[variables.apiToken]" https://api.example.com/block/$[variables.firewallEndpoint]

At execution time, the variable placeholders are replaced with their actual values. Secret variables are decrypted only at the agent-manager level — the backend never sees the decrypted values.

Security Protections

The system prevents commands that would expose secret variable values by detecting output commands such as echo, printf, Write-Output, cat, type, console.log, print, and pipe operators. Commands containing these patterns with secret variables are rejected.

Managing Variables

Execution Flow (How Commands Reach Agents)

Understanding the execution pipeline helps with troubleshooting and performance expectations.

sequenceDiagram
    participant Alert as Alert Engine
    participant Backend as UTMStack Backend
    participant AgentMgr as Agent Manager (gRPC)
    participant Agent as Endpoint Agent

    Alert->>Backend: New alert detected
    Backend->>Backend: Evaluate active rules against alert
    Backend->>Backend: Create PENDING execution record
    Note over Backend: Scheduled job runs every 5 minutes
    Backend->>AgentMgr: ProcessCommand (gRPC)
    AgentMgr->>AgentMgr: Decrypt secret variables
    AgentMgr->>Agent: Forward command via bidirectional stream
    Agent->>Agent: Execute command in specified shell
    Agent->>AgentMgr: Return result
    AgentMgr->>Backend: CommandResult
    Backend->>Backend: Update execution status (EXECUTED/ERROR)

Key Details

Execution Statuses

Non-Execution Causes

When a workflow cannot execute, the system records the reason:

Execution Audit

The SOAR > Audit view provides a real-time table (refreshing every 30 seconds) of all SOAR command executions.

Audit Table Columns

Filtering

The audit view supports filtering by:

• Origin type: Alert, Incident, Incident Response, User Execution

• Agent: Filter by specific agent hostname

Origin Types

API Endpoints

Workflow Rules

Action Templates

Execution History

Automation Variables

Jobs (Command Execution)