Running a shell command
An ExecuteAction for one command from shell history. The agent is the account that ran it, a Person with a username and the machine it belongs to (memberOf), marked as you with sameAs. The Command has the command text in body.
Shell history has no record IDs, so the action is keyed by its timestamp, the command, and the account and machine that ran it.
{
"@type": "ExecuteAction",
"@key": [
"@type",
"source",
"timestamp",
"object.body",
"agent.handle",
"agent.memberOf[*].handle"
],
"source": "shell",
"timestamp": "2026-03-14T09:26:53.000Z",
"agent": {
"@type": "Person",
"@key": ["@type", "source", "handle", "memberOf[*].handle"],
"source": "shell",
"handle": "sam",
"memberOf": [
{
"@type": "Realm",
"@key": ["@type", "source", "handle"],
"source": "hostname",
"handle": "studio"
}
],
"sameAs": ["@me"]
},
"object": {
"@type": "Command",
"@key": ["@type", "source", "body", "action.timestamp"],
"source": "shell",
"body": "git log --oneline -5"
}
}{
"@context": {
"@vocab": "https://schema.chronicle.app/",
"doc": "https://schema.chronicle.app/docs/"
},
"@type": "ExecuteAction",
"doc:key": {
"@list": [
"@type",
"source",
"timestamp",
"object.body",
"agent.handle",
"agent.memberOf[*].handle"
]
},
"source": "shell",
"timestamp": {
"@value": "2026-03-14T09:26:53.000Z",
"@type": "http://www.w3.org/2001/XMLSchema#dateTime"
},
"agent": {
"@type": "Person",
"doc:key": {
"@list": ["@type", "source", "handle", "memberOf[*].handle"]
},
"source": "shell",
"handle": "sam",
"memberOf": [
{
"@type": "Realm",
"doc:key": {
"@list": ["@type", "source", "handle"]
},
"source": "hostname",
"handle": "studio"
}
],
"sameAs": ["@me"]
},
"object": {
"@type": "Command",
"doc:key": {
"@list": ["@type", "source", "body", "action.timestamp"]
},
"source": "shell",
"body": "git log --oneline -5"
}
}@prefix : <https://schema.chronicle.app/> .
@prefix doc: <https://schema.chronicle.app/docs/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
[
a :ExecuteAction;
doc:key ("@type" "source" "timestamp" "object.body" "agent.handle" "agent.memberOf[*].handle");
:source "shell";
:timestamp "2026-03-14T09:26:53.000Z"^^xsd:dateTime;
:agent [
a :Person;
doc:key ("@type" "source" "handle" "memberOf[*].handle");
:source "shell";
:handle "sam";
:memberOf [
a :Realm;
doc:key ("@type" "source" "handle");
:source "hostname";
:handle "studio"
];
:sameAs "@me"
];
:object [
a :Command;
doc:key ("@type" "source" "body" "action.timestamp");
:source "shell";
:body "git log --oneline -5"
]
] .Terms in this example
ActionCommandDateTimeExecuteActionPersonRealmagentbodyhandlememberOfobjecttimestamp