Tutorial 5 of 7
Batches: error lines, permissions and suspicious strings
Intermediate 8 min
Run one tool over many rows — error messages grouped by cause, ls -l output checked for world-writable files, strings checked for look-alikes and Trojan Source.
Some evidence is a list: thirty error lines from a log, the ls -l of a deploy directory, user names from support tickets. A batch runs one tool for every line and groups the results.
1. Create a batch
Go to Batches (press 4) and choose New batch, or paste a list into Add evidence — Opsdeck recognises lists and suggests a batch. Kinds:
| Batch | Tool | What Opsdeck flags |
|---|---|---|
| Error messages | Error Message Translator | lines with the same cause are grouped ("ECONNREFUSED – connection refused appears 2 times.") |
| Permissions audit | Unix Permission Calculator | world-writable files and folders, setuid and setgid programs |
| Suspicious strings | Unicode Inspector | Trojan Source, bidirectional controls, invisible characters, mixed-script look-alikes |
| Lookups | Explorer of Everything | known vulnerabilities of packages, findings for domains and addresses |
| Encoded values | CyberChef-lite Pipeline | values that do not decode with the chosen recipe |
Put one item per line, or choose Blocks separated by a blank line for multi-line stack traces. Lines starting with # and the total 8 line of ls -l are skipped; at most 60 items run.
2. A permissions audit
Open Nightly jobs and the DST weekend and select ls -l of scripts and folders. It contains eight lines such as:
-rwxrwxrwx 1 app app 2210 Oct 9 18:40 /opt/app/bin/sync-inventory
-rwsr-xr-x 1 root root 64320 Oct 1 09:12 /usr/local/bin/rotate-helperPress Run. Results per item shows the tool's explanation of each mode; the findings name the path, for example World-writable (0777): any user on the system can change this file. for /opt/app/bin/sync-inventory and the setuid warning for rotate-helper. Paths stay in your browser — only the mode string is sent.
3. Errors and strings
In Checkout incident review, Errors collected from the logs groups eight lines into causes such as HTTP 502 Bad Gateway, certificate has expired and Docker: OOMKilled / exit code 137, each with the tool's first troubleshooting step. In Suspicious strings and encoded payloads, Strings from support tickets finds the Cyrillic “а” in pаypal-login.com, the zero-width space in an e-mail address and a Trojan Source comment.
A batch result is one analysis: change a line and the batch becomes Outdated until you run it again.
Ready to try it?