The run file
On this page
One run is one JSON document about one host. This page maps its parts, so you can read it, script against it, or know what the console shows.
The parts of a run
Key | What it holds |
|---|---|
| Which run, made by which Signal, in which output format. |
| When it ran (UTC) and how long it took. |
| The host - name, machine ID, Windows version and build, domain role, time zone - and the account that ran Signal. |
| The scoping profile the run was given: name, version, author, SHA-256, window, and any problems found in it. |
| The health of every evidence type: read or not and why, records, time covered, prerequisites. |
| Each module's result (below). |
| Signals grouped by the thing they are about, across modules. |
| What was read about each entity: a file's hashes, signature and version; an account's record. |
| The meaning of every field the run's rules read. |
| With |
A module's result
Key | What it holds |
|---|---|
| How the module ran. |
| The module's question, the evidence it reads, its ATT&CK techniques and its parameters. |
| One per rule that fired, each with its signals ( |
| The state of each source the module's detection depends on. |
| Headline numbers (KPIs), each with a status and a note. |
| Small, capped tables: logon sources, persistence entries, applications, and |
| Every rule of the module with its outcome on this run: flagged, clear or not run with the reason. |
A signal's source
Every signal carries source: the evidence type, what it proves, and exactly where it was read - for example "Security log, event ID 4688, record number 1400". With that line you can go back to the original record in Event Viewer.
Versions of the format
schema_version changes whenever a field is removed, renamed or changes meaning. Signal Console upgrades runs of older formats on import, marking them "older output", and refuses a format newer than it knows - update the console.
Reading a run with PowerShell
$run = Get-Content .\WS-ALPHA-*.json -Raw | ConvertFrom-Json
foreach ($m in $run.modules.PSObject.Properties) {
$m.Value.findings | Where-Object { $_.severity -in 'critical','high' } |
Select-Object @{n='module';e={$m.Name}}, rule_id, severity, title
}