# Attack Path

Fetches the attack path graph for a run.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…

About

Returns the attack paths of a simulation run, showing each compromised host and the actions taken on it in order, with their time, user and severity.


Example

Get the attack paths of run {run_uuid} of simulation {simulation_uuid}.

curl --request GET \
     --url https://api.picussecurity.com/v1/apv/simulations/{simulation_uuid}/runs/{run_uuid}/attack-path \
     --header 'Accept: application/json' \
     --header 'Authorization: Bearer access_token'
{
  "attack_paths": [
    {
      "implant": {
        "host_name": "WS-FIN-01",
        "integrity": "medium",
        "type": "Workstation"
      },
      "actions": [
        {
          "action_group_name": "Domain Discovery",
          "action_type": "Discovery",
          "description": "Enumerated domain users and groups",
          "severity": "Low",
          "time": 1751360400000,
          "user_name": "corp\\svc-backup",
          "user_type": "ad_user"
        },
        {
          "action_group_name": "Mimikatz Credential Dump",
          "action_type": "Credential",
          "description": "Dumped credentials from LSASS",
          "severity": "High",
          "time": 1751360460000,
          "user_name": "corp\\svc-backup",
          "user_type": "ad_user"
        }
      ]
    }
  ],
  "description": {
    "initial_access_point": "WS-FIN-01",
    "initiator": {
      "id": 102,
      "name": "LNX-AGENT-02",
      "type": "LINUX_AGENT"
    },
    "name": "Q3 Gray-Box Simulation",
    "simulation_type": "GRAY_BOX",
    "status": "COMPLETED"
  }
}
Path Params
string
required

Simulation UUID

string
required

Run UUID

Responses

Language
Credentials
Header
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json