Admiral Console

data collectors integrations on-premises secureworks

The Admiral console allows you to access information about a deployed Taegis™ XDR Collector locally. The tools provided within Admiral assist in device setup and troubleshooting of common problems such as network connectivity.

Overview ⫘

Admiral is a text-based console application made available via the XDR Collector's console or serial port. Administrators can use Admiral to issue commands to the collector in order to obtain device information such as hostname, network details, NTP configuration, and more. You can also issue diagnostic commands to determine if there are any health or connectivity issues affecting the device and obtain verbose results that may help provide details to aid in resolving problems.

Admiral Console

Accessing Admiral ⫘

Access the Admiral console via the console or serial port of the XDR Collector. For instructions on accessing Admiral on each supported platform, reference the corresponding section below.

VMware ⫘

In VMware, access Admiral from the collector’s console. There are multiple ways to access the virtual machine console from within VMware, depending on your setup. For steps on how to access the console, refer to the official VMware documentation.

HyperV ⫘

In HyperV, access Admiral from the virtual machine console. Follow these steps:

1. Find the collector's virtual machine from System Center Virtual Machine Manager, also referred to as SCVMM or VMM.
2. Right click the virtual machine and select Connect or View. A sub-menu displays.
3. Select Connect via Console. A new window opens with the console. If the screen is initially blank, press Enter to see the console.

AWS ⫘

In AWS, access Admiral from the EC2 serial console. Follow these steps:

1. Find the collector instance in EC2 and bring up the instance summary.
2. Select Actions and choose Monitor and troubleshoot. A sub-menu displays.
3. Select EC2 serial console from the sub-menu. The EC2 serial console screen displays.
4. Select Connect to connect to the instance's serial console. A new window opens where you can interact with the console. If the screen is initially blank, press Enter to see the console.

Azure ⫘

In Azure, access Admiral from the VM serial console. Follow these steps:

1. Find the collector virtual machine in Azure and bring up the overview.
2. From the left menu in the virtual machine context, select Serial console from the Help header. Azure connects to the serial console and displays it in the right portion of the screen. If the screen is initially blank, press Enter to see the console.

GCP ⫘

In GCP, access Admiral from the serial console. Follow these steps:

1. Find the collector virtual machine and bring up the instance details.
2. At the top of the Details tab, select the Connect to serial console button to be connected to serial port 1. A new window opens and the serial console appears. If the screen is initially blank, press Enter to see the console.

Using Admiral ⫘

Basic Usage ⫘

Admiral is a text-based command line application. While using Admiral, the application provides you with suggestions based on what you type and supports auto-completion using the Tab key.

The Admiral prompt displays when you access Admiral for the first time. This contains the hostname of the collector followed by a > symbol. Begin typing commands into Admiral for it to execute. To see what commands Admiral supports, use the help command, which outputs a list of currently supported commands with a brief description of each.

Suggestions and Auto-Complete ⫘

As you type, Admiral provides a list of suggestions based on your input. These suggestions contain the same brief descriptions of each available command seen when using help. To use a suggestion, press the Tab key to have Admiral auto-complete it. Once you have pressed Tab, scroll through the list of all suggested commands using the up and down arrows, and use Enter to execute the command that you have chosen.

To get a new blank line without executing what you have already typed, press Ctrl-C. Admiral brings you to a new clean line without attempting to process any command you have already entered.

When typing a command, the suggestions list only shows you the top suggestions, requiring you to press Tab and then scroll to see the complete list. However, press the ? key at any time and Admiral displays every suggested command without needing to tab into the list to scroll.

Command Types ⫘

Admiral commands are divided into two types: show commands that provide information about the state of the collector and run commands that cause actions to occur. As a rule, show commands never change the state of the collector or generate any network traffic, whereas run commands are allowed to perform actions that may cause the collector to update its state or create network connections.

Check Commands and Verbosity ⫘

One special type of run command is the check command. Checks are routines that exist to provide feedback on various collector systems that are necessary for it to collect data. In their normal form they provide very simple output as to if a system is found to be functioning correctly or not. However, if more in-depth information is desired, use the verbose form of the check to obtain more detailed output that can be useful for troubleshooting.

For example, the run dns check command displays a simple output showing if DNS resolution of the Taegis API FQDN is successful. If you need more detailed information about the DNS resolution process, use run dns check with verbose output.

Commands and Command Menus ⫘

Admiral commands are organized into menus. The directory command displays a list of available menus. To enter a menu, use the enter command followed by the name of the menu you wish to enter. To exit a menu, use the exit command.

Currently, there are two menus: default and maintenance. The default menu contains the basic run and show commands. The maintenance menu contains commands that are useful for troubleshooting special scenarios when working with Secureworks support. When entering a different menu, the prompt changes to indicate which menu you are in to help you keep track of where you are.

Default Menu Available Commands ⫘

The following table details each command available in Admiral in the default menu. This menu is used when Admiral starts. Exiting this menu exits Admiral.

Command	Description
about	show about dialog
cancel shutdown	cancel a pending shutdown or pending reboot
clear	clear the screen
directory	show a list of available command menus
enter	enter a different command menu
exit	exit the recovery console
help	show available commands in your current command menu
run all checks	run all available checks one after another
run dns check	check if the dns servers can resolve the Secureworks Taegis API
run e2e check	end-to-end check confirming access to Secureworks Taegis API
run ntp check	check to see if the ntp can synchronize
run ping check	check to see if this device can ping the default gateway
run reboot	schedule a system reboot one minute in the future
run shutdown	schedule a system power-off one minute in the future
run tunnel check	verify the tunnel to Secureworks Taegis is running
show arp	show the arp table
show cluster status	show the status of the cluster
show date	show the current date and time
show disk	show basic disk information
show management interface	show the management interface
show memory	show the current memory usage in kilobytes
show network	show the running network configuration
show ntp status	show information related to ntp
show routes	show management interface routing information
show system info	show various diagnostic information about this collector
show uptime	show the system uptime
show virtual memory	show the virtual memory usage over a few seconds

Maintenance Menu Available Commands ⫘

The following table details each command available in Admiral in the maintenance menu. This menu is used when you enter the maintenance menu. Exiting this menu will return you to the default menu.

Command	Description
clear	clear the screen
directory	show a list of available command menus
enter	enter a different command menu
exit	return to the default command menu
help	show available commands in your current command menu
restart cluster service	restart the cluster service on this node
restart management service	restart the tunnel and management agent for support connectivity
restart ntp service	force synchronization to the ntp server and restart ntp
restart tunnel service	restart the tunnel service between the node and Taegis