The Snowbit STA comes, prebuilt with tools and services that automatically handle the majority of the management issues of the STA so you won’t have to do anything.
Just in case you’ll need it, the STA comes with a collection of commands that will help you control it. In this article, we’ll explain each command and when to use it.
STA Commands
sta-acknowledge-installation-id
When you have finished installing the STA, it is recommended that you will run the command sta-get-installation-id and store its output in some secure place and then run this command. The installation ID is required to get privileged access to the STA, thing which might be required by our support team. Once you run the acknowledgement command, it will erase the installation ID from the instance.
sta-get-status-short
This command will print something similar to the following output which will indicate the current status of every service in the STA. If the STA was just installed it is normal that it takes for some services some time (up to 10 minutes) to fully stabilize:
sta-test-coralogix-connection
This command will test the connection to Coralogix by sending a dummy event to your Coralogix account. If you see it in Coralogix within a second or two it means that the connection to Coralogix is working properly.
sta-get-version
Provides the current version of the STA.
sta-update-version
By default the STA is updating itself seamlessly. This command requires 1 additional argument which can be set to a <specific_version>/latest update. in case you provided a specific version for the STA using this command, please note that the STA won’t update itself until this command will be executed again with "latest" as an argument.
sta-get-defacto-config
This command returns the STA’s current full configuration as JSON output.
sta-edit-config
Editing STA’s configuration can be performed only when not using a remote storage such as S3 (highly recommended).
this holds the full configuration for the STA and all its relevant components and services.
sta-select-config-editor
By using this command you can select your preferred editor for example VI or nano. please see command above for the editing constraints.
sta-diag-validate-config
In case you are using a remote storage, you can validate the current sta.conf file’s schema. Note that when editing the configuration the STA is validating the schema on the fly – so this command is not mandatory when configuration changes are executed.
sta-encrypt-config-value
As the STA’s configuration can hold delicate information that you might want to prevent from other users to read it, you can encrypt desired values by following the steps after running the command.
sta-get-service-logs
Using this command, you can investigate different services that are running within the STA. additional argument is required which is representing the desired service. The service name can be found when running the command sta-get-status-short that presented above.
If you have installed Wazuh agents and have connected them to the STA, this command will display a list of all the connected agents like this:
Available agents:
ID: 001, Name: ip-172-31-29-200, IP: any
ID: 002, Name: ip-172-31-29-10, IP: any
ID: 003, Name: ip-172-31-30-89, IP: any
ID: 004, Name: ip-172-31-27-174, IP: any
ID: 005, Name: ip-172-31-31-73, IP: any
ID: 006, Name: ip-172-31-30-60, IP: any
ID: 007, Name: ip-172-31-21-241, IP: any
ID: 008, Name: ip-172-31-17-78, IP: any
ID: 009, Name: ip-172-31-29-40, IP: any
ID: 010, Name: ip-172-31-23-114, IP: any
sta-wazuh-add-agent
You can add Wazuh agents from different machines manually using this command. This command requires 2 additional arguments: agent name and agent ip. To see the constraints for those arguments please run this command without no arguments. Please note that if you are installing Wazuh agents using our Documentation, those agents are added automatically and no actions are required.
sta-wazuh-remove-agent
You can remove Wazuh agents from different machines manually using this command. This command requires 1 additional argument: agent id. To get all agents IDs use sta-wazuh-list-agents command. Please note that the STA is monitoring each agent, and in case no communication is received from the agent for some time, the STA removes it automatically.
sta-wazuh-restart-agents
By using this command, the STA restarting all Wazuh agents that are currently connected.
sta-wazuh-get-key
Use this command to get Wazuh agent’s key. requires 1 additional argument: agent id. To get all agents IDs use sta-wazuh-list-agents command.
sta-force-rules-updater
Normally, the STA will update its set of rules for Suricata, Zeek and Wazuh every day at 07:07AM at the STA’s local time. If you want it to update these rules now run this command.
sta-force-sync-configs
Normally, the STA will attempt to synchronize its config files from the S3 bucket that has been configured during the installation phase every three minutes. If you have made a change to your configuration and would like to apply these changes now you can run this command.
sta-diag-general
Provides a general overview of the STA’s performance including both network, processor, disk and memory metrics.
sta-diag-network
Provides detailed real-time information about the network usage in the STA.
sta-diag-top
Launches a “top” like tool that provides information about processes, threads, memory and tasks metrics.
sta-diag-delete-traffic-mirror-sessions
Currently supported for STA deployed on AWS. This command will delete a Traffic Mirror Session depended on a required argument representing available <traffic_mirror_target_id> (tmt-*) or <traffic_mirror_filter_id> (tmf-*)
sta-diag-disk-usage
This command will provide current disk usage separated per root level folders. To see the disk usage iterated recursively over whole paths use the following command: sta-diag-disk-usage-detailed.
sta-diag-dump-cache
using this command, you can dump all into console all available cache enrichment files. the output is separated per enrichment represented as files. this is the representation per line:
Enrichment file’s full path
File’s name written in encoded base64
decoded content from the name written above
relevant socket that provided that enrichment
sta-test-enrich
Tests the enrichment of data by the various services in the STA.
sta-set-mgmt-ip
Useful for on-prem installations where each server has a manual management IP address. In such cases use this command to specify the address you would like the STA to have.
sta-set-mgmt-ip-dhcp
Useful for on-prem installations. In case you used the sta-set-mgmt-ip command to force the STA to use a manually set IP address for its management network interface and now interested in reverting that to the default (using an IP address from a DHCP).
sta-reload-mgmt-nic
This command tears down current management NIC and bringing it up again. use this when you want to restart the management NIC that handles all STA’s traffic communication.
sta-get-disk-usage
Run this command to see how the storage is used per root’s folders. If you wish to see every folder separately in a recursive manner use sta-get-disk-usage-detailed.
sta-diag-get-debug-package
by using this command, the STA collects all possible logs from all services, system processes, etc. and compresses them into one archive. This command is available so you’ll be able to provide our support a full state of your STA.
Note – This command is a very heavy process. Use this command as last resort for investigating issues in your STAs as this archive hold everything and it similar to look for a needle in a haystack.
sta-get-metric-value
by using this command, you are able to inspect specific metric files and perform aggregation functions in specific timeframe. the initial path for all metric files is: /coralogix/sta/metrics/ – from there, locate the desired Whisper file which representing your metric. The supported aggregation functions are: max|min|last|avg|len.
Notes
Other commands that exist on the STA are meant to be used by Coralogix customer success team in very special cases.
If you think that you need root access to the STA, there is a way to get that. Please contact us via the chat in Coralogix for additional details.
Oh no!We didn’t find anything for “”,
