Skip to content

Interactive Console: Agent search not working and Windows command execution consistently failing #1752

@mjabascal10

Description

@mjabascal10

Acknowledgements

Describe the bug

Issue: Agent Search in Interactive Console Does Not Work
The search bar in the left sidebar (list of agents) is not functioning.
Typing any text does not filter or return matching agents.

Issue: Interactive Commands Fail on Windows Agents
Interactive commands executed on Windows agents consistently fail, even when using valid PowerShell syntax.

Examples tested:

powershell
Get-ADUser drivera | Select-Object Enabled

Even invoking PowerShell explicitly does not work:

powershell
powershell -NoProfile -Command "(Get-ADUser -Identity drivera -Properties Enabled).Enabled"

No variation of the command succeeds, suggesting that something in the interactive execution pipeline is breaking Windows command handling.

This needs to be tested directly on a Windows agent to identify whether:

PowerShell is not being invoked correctly

The command wrapper is escaping or sanitizing incorrectly

The agent is not executing commands in the expected shell

Output parsing is failing and returning an error upstream

Regression Issue

  • Select this option if this issue appears to be a regression.

Expected Behavior

The agent search should filter the list of agents in real time
Windows agents should execute PowerShell commands normally
Commands like Get-ADUser should return valid output when the environment supports them

Current Behavior

Agent search does nothing
Windows commands fail regardless of syntax
PowerShell invocation does not work even when explicitly called

Reproduction Steps

  1. Open SOAR → Interactive Console
  2. Try searching for any agent in the sidebar
  3. Select a Windows agent
  4. Execute any PowerShell command
  5. Observe that all commands fail

Possible Solution

Fix the search input binding for the agent list
Validate how the backend invokes commands on Windows agents
Test direct PowerShell invocation on a Windows host to confirm whether the agent wrapper is breaking command execution
Ensure the interactive console uses the correct shell for Windows (PowerShell vs CMD)

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

Status

🏗 In progress

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions