Shutdown Windows Host

This action executes a shutdown on the host by issuing the shutdown command/syscall (depending on the operating system). You can instruct the action to issue a host restart when desired - in which case the command/syscall will be adapted as necessary.

Details

Kubernetes Nodes

If you're using the reboot option on Kubernetes nodes, it might be the case that the host finished rebooting and restarting the containers before the control plane takes notice. You can verify the behaviour of this attack for example by using the uptime command on the hosts.

Virtual Machines

Note that this action will not differentiate between bare-metal or virtual machines. It will always attempt to shut down/reboot a host using the above-mentioned strategy.

Parameters

Parameter	Description	Default
Reboot	Should the host reboot after shutting down?	true

Useful Templates

See all

Windows host reboot is alerted by Datadog

When a windows host is suddenly missing from your system, Datadog should alert you to this. Eventually, everything should recover when only rebooting the host.

Motivation

When you're working in a less volatile system environment, where you expect hosts always to run, you should validate whether you notice whenever a host is rebooting.

Structure

Before restarting a host, we verify that the Datadog monitor is in an ok state Afterward, we trigger the shutdown of a host and expect Datadog to alert about the missing host. Eventually, the host should come back and Datadog turn into an OK state again. While experimenting, we create a downtime for the Monitor so that it will not escalate due to the ongoing alert.