get
https://api.picussecurity.com/v1/apv/simulations//runs//attack-path
Fetches the attack path graph for a run.
Recent Requests
Log in to see full request history
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Loading…
About
Returns the attack paths of a simulation run, showing each compromised host and the actions taken on it in order, with their time, user and severity.
Example
Get the attack paths of run {run_uuid} of simulation {simulation_uuid}.
curl --request GET \
--url https://api.picussecurity.com/v1/apv/simulations/{simulation_uuid}/runs/{run_uuid}/attack-path \
--header 'Accept: application/json' \
--header 'Authorization: Bearer access_token'{
"attack_paths": [
{
"implant": {
"host_name": "WS-FIN-01",
"integrity": "medium",
"type": "Workstation"
},
"actions": [
{
"action_group_name": "Domain Discovery",
"action_type": "Discovery",
"description": "Enumerated domain users and groups",
"severity": "Low",
"time": 1751360400000,
"user_name": "corp\\svc-backup",
"user_type": "ad_user"
},
{
"action_group_name": "Mimikatz Credential Dump",
"action_type": "Credential",
"description": "Dumped credentials from LSASS",
"severity": "High",
"time": 1751360460000,
"user_name": "corp\\svc-backup",
"user_type": "ad_user"
}
]
}
],
"description": {
"initial_access_point": "WS-FIN-01",
"initiator": {
"id": 102,
"name": "LNX-AGENT-02",
"type": "LINUX_AGENT"
},
"name": "Q3 Gray-Box Simulation",
"simulation_type": "GRAY_BOX",
"status": "COMPLETED"
}
}