Cobalt Strike Rest API streaming examples

Overview

Cobalt Strike REST API streaming lets clients receive live updates from the Team Server as activity happens, instead of polling for changes.

Use streaming to:

• Display Beacon output in near real time
• Follow shared operator activity as it appears in the Event Log
• Maintain a live session view for dashboards or terminal tools
• Reduce polling overhead in custom integrations

The streaming features are designed for customers building their own tooling around Cobalt Strike. They make it easier to create responsive user interfaces, automate workflows, and integrate live Team Server activity into external systems.

This repository contains the following example utilities to demonstrate the functionality:

• python_websocket/ Python WebSocket examples that log in via REST and use STOMP to stream:
  • beaconlog, which relates to the Beacon Console
  • eventlog, which relates to the Event Log view
  • beacons, which relates to sessions in a table view
• python_grpc/ Python gRPC examples that log in via REST and use gRPC to stream:
  • beaconlog, which relates to the Beacon Console
  • eventlog, which relates to the Event Log view
  • beacons, which relates to sessions in a table view
• shared/python/ Shared Python helpers for Cobalt Strike REST API examples:
  • cobaltstrike_restapi.py for common REST/auth/config helpers
  • cobaltstrike_terminal.py for ANSI/curses helpers and shared interactive console loop
  • cobaltstrike_beacons.py for reusable beacon selection UI