Module Expr Str ImportFrom alias Import alias Import alias Import alias Assign NameStore Str Import alias Assign NameStore Call AttributeLoad NameLoad attr NameLoad FunctionDef arguments args defaults body Expr Str Return IfExp Call AttributeLoad AttributeLoad NameLoad attr attr Str NameLoad NameLoad decorator_list FunctionDef arguments args defaults body Expr Str Assign NameStore Call AttributeLoad NameLoad attr If CompareIn Str NameLoad body If CompareGt BinOpSub NameLoad SubscriptLoad NameLoad Index Str Num body Assign SubscriptStore NameLoad Index Str NameLoad orelse Assign SubscriptStore NameLoad Index Str Call SubscriptLoad NameLoad Index Str orelse Assign SubscriptStore NameLoad Index Str NameLoad Assign SubscriptStore NameLoad Index Str Call SubscriptLoad NameLoad Index Str Return SubscriptLoad NameLoad Index Str decorator_list FunctionDef arguments args NameParam defaults body Expr Str If UnaryOpNot Call NameLoad NameLoad NameLoad body Return TupleLoad NameLoad Str Return TupleLoad NameLoad Str decorator_list FunctionDef arguments args NameParam defaults body Expr Str Assign NameStore ListLoad Assign NameStore Str Assign NameStore Call NameLoad Assign NameStore Call SubscriptLoad NameLoad Index Str Assign NameStore ListLoad For NameStore NameLoad body If Call NameLoad GeneratorExp CompareIn Call AttributeLoad Call AttributeLoad SubscriptLoad NameLoad Index NameLoad attr Str Str attr Str NameLoad comprehension NameStore NameLoad body Expr Call AttributeLoad NameLoad attr NameLoad If CompareNotIn NameLoad NameLoad body Assign SubscriptStore NameLoad Index NameLoad Dict For NameStore NameLoad body If CompareNotIn NameLoad SubscriptLoad NameLoad Index NameLoad body Assign NameStore ListLoad Str Str Str Str Str Call AttributeLoad Str attr NameLoad Assign SubscriptStore SubscriptLoad NameLoad Index NameLoad Index NameLoad Dict Assign SubscriptStore SubscriptLoad SubscriptLoad NameLoad Index NameLoad Index NameLoad Index Str Call AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr NameLoad keyword NameLoad keyword NameLoad keyword NameLoad keyword NameLoad Assign SubscriptStore SubscriptLoad SubscriptLoad NameLoad Index NameLoad Index NameLoad Index Str Call AttributeLoad SubscriptLoad NameLoad Index NameLoad attr Str For NameStore SubscriptLoad NameLoad Index NameLoad body Assign NameStore Str Assign NameStore Str While AttributeLoad SubscriptLoad SubscriptLoad SubscriptLoad NameLoad Index NameLoad Index NameLoad Index Str attr body Assign TupleStore NameStore NameStore Call AttributeLoad SubscriptLoad SubscriptLoad SubscriptLoad NameLoad Index NameLoad Index NameLoad Index Str attr If UnaryOpNot NameLoad body Break AugAssignAdd NameStore NameLoad AugAssignAdd NameStore NameLoad For NameStore Call AttributeLoad NameLoad attr Str body Assign NameStore Dict Str Str ListLoad NameLoad If CompareIn Str NameLoad body Assign NameStore Call AttributeLoad SubscriptLoad Call AttributeLoad NameLoad attr Str Index Num attr Str For TupleStore NameStore NameStore Call NameLoad NameLoad body If CompareEq NameLoad Num body Assign SubscriptStore NameLoad Index Str NameLoad Continue If CompareNotEq BinOpMod NameLoad Num Num body Expr Call AttributeLoad SubscriptLoad NameLoad Index Str attr NameLoad Assign SubscriptStore NameLoad Index Str SubscriptLoad SubscriptLoad SubscriptLoad NameLoad Index NameLoad Index NameLoad Index Str Expr Call AttributeLoad NameLoad attr NameLoad If UnaryOpNot Call AttributeLoad SubscriptLoad SubscriptLoad SubscriptLoad NameLoad Index NameLoad Index NameLoad Index Str attr body Expr Call AttributeLoad SubscriptLoad SubscriptLoad SubscriptLoad NameLoad Index NameLoad Index NameLoad Index Str attr Expr Call AttributeLoad SubscriptLoad NameLoad Index NameLoad attr NameLoad Return NameLoad decorator_list
N/A N/A 
Watch the shell commands being executed actively. This beacon requires strace.
 __future__ absolute_import N/A time N/A salt.utils N/A salt.utils.vt N/A __virtualname__ sh N/A logging N/A log N/A N/A logging getLogger __name__ __virtual__ N/A N/A N/A N/A N/A 
    Only load if strace is installed
     N/A N/A N/A N/A N/A salt utils which strace __virtualname__ False N/A _get_shells N/A N/A N/A N/A N/A 
    Return the valid shells on this system
     N/A start N/A N/A time time N/A N/A sh.last_shells __context__ N/A N/A N/A N/A start N/A __context__ N/A sh.last_shells 5 N/A N/A N/A __context__ N/A sh.last_shells start N/A N/A N/A __context__ N/A sh.shells N/A N/A __salt__ N/A cmd.shells N/A N/A N/A __context__ N/A sh.last_shells start N/A N/A __context__ N/A sh.shells N/A N/A __salt__ N/A cmd.shells N/A N/A __context__ N/A sh.shells N/A validate N/A N/A config N/A N/A N/A 
    Validate the beacon configuration
     N/A N/A N/A isinstance config dict N/A N/A N/A False Configuration for sh beacon must be a dictionary. N/A N/A True Valid beacon configuration N/A beacon N/A N/A config N/A N/A N/A 
    Scan the shell execve routines. This beacon will convert all login shells

    .. code-block:: yaml

        beacons:
          sh: {}
     N/A ret N/A N/A pkey sh.vt N/A shells N/A _get_shells N/A ps_out N/A N/A __salt__ N/A status.procs N/A track_pids N/A N/A pid ps_out N/A N/A N/A any N/A N/A N/A N/A N/A N/A N/A ps_out N/A pid get cmd lstrip - shell N/A shell shells N/A N/A N/A N/A track_pids append pid N/A N/A pkey __context__ N/A N/A N/A __context__ N/A pkey N/A N/A pid track_pids N/A N/A N/A pid N/A __context__ N/A pkey N/A N/A cmd N/A strace -f -e execve -p N/A N/A {0} format pid N/A N/A N/A __context__ N/A pkey N/A pid N/A N/A N/A N/A N/A __context__ N/A pkey N/A pid N/A vt N/A N/A N/A N/A salt utils vt Terminal cmd log_stdout True log_stderr True stream_stdout False stream_stderr False N/A N/A N/A N/A __context__ N/A pkey N/A pid N/A user N/A N/A N/A ps_out N/A pid get user N/A pid N/A __context__ N/A pkey N/A N/A out N/A err N/A N/A N/A N/A N/A __context__ N/A pkey N/A pid N/A vt has_unread_data N/A N/A N/A tout terr N/A N/A N/A N/A N/A __context__ N/A pkey N/A pid N/A vt recv N/A N/A terr N/A N/A N/A out tout N/A err terr N/A line N/A N/A err split N/A N/A event N/A args tag N/A pid N/A N/A execve line N/A N/A comps N/A N/A N/A N/A N/A line split execve N/A 1 split " N/A N/A ind field N/A enumerate comps N/A N/A N/A ind 1 N/A N/A N/A event N/A cmd field N/A N/A N/A N/A ind 2 0 N/A N/A N/A N/A N/A event N/A args append field N/A N/A event N/A user N/A N/A N/A __context__ N/A pkey N/A pid N/A user N/A N/A N/A ret append event N/A N/A N/A N/A N/A N/A N/A __context__ N/A pkey N/A pid N/A vt isalive N/A N/A N/A N/A N/A N/A N/A __context__ N/A pkey N/A pid N/A vt close N/A N/A N/A N/A __context__ N/A pkey pop pid N/A ret N/A