Running a shell command
An ExecuteAction for one command from shell history.
{
"@type": "ExecuteAction",
"@key": [
"@type",
"source",
"timestamp",
"object.body",
"agent.handle",
"agent.memberOf[*].handle"
],
"source": "shell",
"timestamp": "2026-03-14T09:26:53.000Z",
"agent": {
"@type": "Person",
"@key": ["@type", "source", "handle", "memberOf[*].handle"],
"source": "shell",
"handle": "sam",
"memberOf": [
{
"@type": "Realm",
"@key": ["@type", "source", "handle"],
"source": "hostname",
"handle": "studio"
}
],
"sameAs": ["@me"]
},
"object": {
"@type": "Command",
"@key": ["@type", "source", "body", "action.timestamp"],
"source": "shell",
"body": "git log --oneline -5"
}
}{
"@context": {
"@vocab": "https://schema.chronicle.app/",
"doc": "https://schema.chronicle.app/docs/"
},
"@type": "ExecuteAction",
"doc:key": {
"@list": [
"@type",
"source",
"timestamp",
"object.body",
"agent.handle",
"agent.memberOf[*].handle"
]
},
"source": "shell",
"timestamp": {
"@value": "2026-03-14T09:26:53.000Z",
"@type": "http://www.w3.org/2001/XMLSchema#dateTime"
},
"agent": {
"@type": "Person",
"doc:key": {
"@list": ["@type", "source", "handle", "memberOf[*].handle"]
},
"source": "shell",
"handle": "sam",
"memberOf": [
{
"@type": "Realm",
"doc:key": {
"@list": ["@type", "source", "handle"]
},
"source": "hostname",
"handle": "studio"
}
],
"sameAs": ["@me"]
},
"object": {
"@type": "Command",
"doc:key": {
"@list": ["@type", "source", "body", "action.timestamp"]
},
"source": "shell",
"body": "git log --oneline -5"
}
}@prefix : <https://schema.chronicle.app/> .
@prefix doc: <https://schema.chronicle.app/docs/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
[
a :ExecuteAction;
doc:key ("@type" "source" "timestamp" "object.body" "agent.handle" "agent.memberOf[*].handle");
:source "shell";
:timestamp "2026-03-14T09:26:53.000Z"^^xsd:dateTime;
:agent [
a :Person;
doc:key ("@type" "source" "handle" "memberOf[*].handle");
:source "shell";
:handle "sam";
:memberOf [
a :Realm;
doc:key ("@type" "source" "handle");
:source "hostname";
:handle "studio"
];
:sameAs "@me"
];
:object [
a :Command;
doc:key ("@type" "source" "body" "action.timestamp");
:source "shell";
:body "git log --oneline -5"
]
] .