Artifacts¶

Artifacts are structured IOC records that Stentor automatically creates whenever a beacon executes a task. Each artifact captures what happened (process creation, file operation, registry modification, network connection), which MITRE ATT&CK technique was used, and which beacon produced it. Artifacts power the ATT&CK Navigator export, IOC reports, and engagement timeline.

How Artifacts Are Collected¶

The ArtifactRecorder runs in the task result pipeline and produces artifact records from two sources:

1. Implant-reported artifacts (source: "implant") -- The implant explicitly reports artifacts in its task result payload, including type, path, value, and optional technique ID.
2. Auto-inferred artifacts (source: "auto") -- When the implant does not report explicit artifacts, the recorder infers them from the task type using the built-in MITRE ATT&CK mapping table.

Artifact recording is non-blocking -- it runs in a background goroutine and batch-inserts records for performance. Failures are logged but never block the task result pipeline.

sequenceDiagram
    participant Implant
    participant Relay
    participant Backend
    participant ArtifactRecorder
    participant Database

    Implant->>Relay: Task result (with optional artifacts)
    Relay->>Backend: Forward result via WebSocket
    Backend->>Backend: Process task result
    Backend->>ArtifactRecorder: RecordFromResult(beaconID, taskID, taskType, result)

    alt Implant reported artifacts
        ArtifactRecorder->>ArtifactRecorder: Use explicit artifacts (source="implant")
    else No explicit artifacts
        ArtifactRecorder->>ArtifactRecorder: Infer from task type (source="auto")
    end

    ArtifactRecorder->>Database: Batch INSERT c2_artifacts

Artifact Object¶

Artifact Types¶

Automatic MITRE Mapping¶

When no explicit artifacts are reported by the implant, the recorder maps task types to MITRE ATT&CK techniques automatically:

Querying Artifacts¶

All artifact endpoints are under /api/v1/artifacts and support pagination via limit and offset query parameters.

Pagination Parameters¶

List All Artifacts¶

GET /api/v1/artifacts

curl -s "https://stentor.app/api/v1/artifacts?limit=50&offset=0" \
  -H "Authorization: Bearer $TOKEN" | jq

Response:

{
  "artifacts": [
    {
      "id": "artifact-uuid",
      "beacon_id": "beacon-uuid",
      "task_id": "task-uuid",
      "artifact_type": "process",
      "path": "cmd.exe",
      "value": "",
      "technique_id": "T1059.003",
      "tactic": "execution",
      "description": "Process created: cmd.exe (command shell)",
      "source": "auto",
      "created_at": "2026-02-21T14:30:00Z"
    }
  ],
  "total": 1247
}

Filter by Beacon¶

GET /api/v1/artifacts/by-beacon/:beaconId

curl -s "https://stentor.app/api/v1/artifacts/by-beacon/$BEACON_ID?limit=100" \
  -H "Authorization: Bearer $TOKEN" | jq

Filter by Task¶

GET /api/v1/artifacts/by-task/:taskId

Returns all artifacts for a specific task (no pagination -- returns the full set).

curl -s "https://stentor.app/api/v1/artifacts/by-task/$TASK_ID" \
  -H "Authorization: Bearer $TOKEN" | jq

Filter by Type¶

GET /api/v1/artifacts/by-type/:type

Valid types: process, file, registry, network, event_log, service.

curl -s "https://stentor.app/api/v1/artifacts/by-type/process?limit=50" \
  -H "Authorization: Bearer $TOKEN" | jq

curl -s "https://stentor.app/api/v1/artifacts/by-type/network?limit=50" \
  -H "Authorization: Bearer $TOKEN" | jq

curl -s "https://stentor.app/api/v1/artifacts/by-type/registry?limit=50" \
  -H "Authorization: Bearer $TOKEN" | jq

Filter by MITRE Technique¶

GET /api/v1/artifacts/by-technique/:techniqueId

curl -s "https://stentor.app/api/v1/artifacts/by-technique/T1059.001?limit=50" \
  -H "Authorization: Bearer $TOKEN" | jq

Filter by Time Range¶

GET /api/v1/artifacts/by-time

curl -s "https://stentor.app/api/v1/artifacts/by-time?start=2026-02-20T00:00:00Z&end=2026-02-21T23:59:59Z&limit=100" \
  -H "Authorization: Bearer $TOKEN" | jq

Technique Summary¶

Aggregated technique usage data across all artifacts, grouped by technique ID and tactic.

GET /api/v1/artifacts/summary

curl -s "https://stentor.app/api/v1/artifacts/summary" \
  -H "Authorization: Bearer $TOKEN" | jq

Response¶

{
  "techniques": [
    {
      "technique_id": "T1059.001",
      "tactic": "execution",
      "count": 47,
      "first_seen": "2026-02-19T08:12:00Z",
      "last_seen": "2026-02-21T16:45:00Z"
    },
    {
      "technique_id": "T1055.003",
      "tactic": "defense-evasion",
      "count": 12,
      "first_seen": "2026-02-19T10:30:00Z",
      "last_seen": "2026-02-21T14:00:00Z"
    }
  ]
}

This endpoint feeds the ATT&CK Navigator layer export and the technique breakdown in the IOC report.

ATT&CK Navigator Layer Export¶

Export your engagement's technique coverage as an ATT&CK Navigator v4.5 layer JSON file. The layer uses color interpolation (white to red) based on usage frequency.

Standard Layer¶

GET /api/v1/artifacts/navigator-layer

curl -s "https://stentor.app/api/v1/artifacts/navigator-layer" \
  -H "Authorization: Bearer $TOKEN" \
  -o navigator-layer.json

curl -s "https://stentor.app/api/v1/artifacts/navigator-layer?name=ACME+Corp+Q1+2026" \
  -H "Authorization: Bearer $TOKEN" \
  -o navigator-layer.json

curl -s "https://stentor.app/api/v1/artifacts/navigator-layer?preview=true" \
  -H "Authorization: Bearer $TOKEN" | jq

Per-Operation Layer¶

A second export mode colors techniques by which host/beacon used them, making it easy to visualize operational coverage across the engagement. Each host gets a distinct color, and a legend maps hostnames to colors.

GET /api/v1/artifacts/navigator-layer/by-operation

curl -s "https://stentor.app/api/v1/artifacts/navigator-layer/by-operation" \
  -H "Authorization: Bearer $TOKEN" \
  -o navigator-layer-operation.json

Color Schemes¶

Using with ATT&CK Navigator¶

1. Download the layer JSON from either endpoint
2. Open ATT&CK Navigator
3. Click Open Existing Layer and upload the JSON file
4. The heatmap renders your engagement's technique coverage

See MITRE ATT&CK Integration for the full knowledge base documentation.

IOC Report¶

Generate a structured Indicators of Compromise report from all recorded artifacts. The report groups artifacts by host and includes a technique breakdown section -- ideal for defender handoff after an engagement.

GET /api/v1/artifacts/ioc-report

curl -s "https://stentor.app/api/v1/artifacts/ioc-report" \
  -H "Authorization: Bearer $TOKEN" | jq

curl -s "https://stentor.app/api/v1/artifacts/ioc-report?format=pdf" \
  -H "Authorization: Bearer $TOKEN" \
  -o ioc-report.pdf

curl -s "https://stentor.app/api/v1/artifacts/ioc-report?format=html" \
  -H "Authorization: Bearer $TOKEN" \
  -o ioc-report.html

IOC Report Structure¶

{
  "generated_at": "2026-02-21T15:00:00Z",
  "total_artifacts": 523,
  "hosts": [
    {
      "hostname": "DC01",
      "ip": "10.10.10.10",
      "artifacts": [
        {
          "type": "process",
          "path": "powershell.exe",
          "value": "",
          "technique_id": "T1059.001",
          "tactic": "execution",
          "description": "Process created: powershell.exe",
          "source": "auto",
          "created_at": "2026-02-20T09:15:00Z"
        }
      ]
    }
  ],
  "technique_breakdown": [
    {
      "technique_id": "T1059.001",
      "technique_name": "PowerShell",
      "tactic": "execution",
      "artifact_count": 47,
      "hosts": ["DC01", "WS01", "WS02"]
    }
  ]
}

Engagement Timeline¶

A chronological view of all artifacts joined with beacon metadata, supporting multi-dimensional filtering. The timeline is ordered oldest-first (ascending) and is designed for engagement reconstruction and post-operation analysis.

GET /api/v1/artifacts/timeline

Filter Parameters¶

curl -s "https://stentor.app/api/v1/artifacts/timeline" \
  -H "Authorization: Bearer $TOKEN" | jq

curl -s "https://stentor.app/api/v1/artifacts/timeline?host=DC01&limit=100" \
  -H "Authorization: Bearer $TOKEN" | jq

curl -s "https://stentor.app/api/v1/artifacts/timeline?technique=T1059.001" \
  -H "Authorization: Bearer $TOKEN" | jq

curl -s "https://stentor.app/api/v1/artifacts/timeline?start=2026-02-19T00:00:00Z&end=2026-02-21T23:59:59Z" \
  -H "Authorization: Bearer $TOKEN" | jq

curl -s "https://stentor.app/api/v1/artifacts/timeline?format=pdf&host=DC01" \
  -H "Authorization: Bearer $TOKEN" \
  -o engagement-timeline.pdf

Timeline Response¶

{
  "timeline": {
    "generated_at": "2026-02-21T15:30:00Z",
    "total_entries": 834,
    "filters": {
      "hostname": "DC01",
      "technique_id": "T1059.001"
    },
    "entries": [
      {
        "timestamp": "2026-02-19T08:12:00Z",
        "beacon_id": "beacon-uuid",
        "hostname": "DC01",
        "username": "CORP\\jdoe",
        "ip": "10.10.10.10",
        "artifact_type": "process",
        "path": "powershell.exe",
        "value": "",
        "technique_id": "T1059.001",
        "tactic": "execution",
        "description": "Process created: powershell.exe",
        "source": "auto"
      }
    ]
  }
}

API Reference¶

See Also¶

• MITRE ATT&CK Integration -- Knowledge base, CNA scripting functions, and technique lookup
• Campaign Reports -- Campaign-scoped reports in 6 formats
• C2 Campaigns -- Campaign management and beacon association
• Audit Log -- Operator action audit trail