diff --git a/content/usage/osctrl-admin/_index.md b/content/usage/osctrl-admin/_index.md index 5b422f6..f97fdd5 100644 --- a/content/usage/osctrl-admin/_index.md +++ b/content/usage/osctrl-admin/_index.md @@ -7,10 +7,10 @@ pre = "" `osctrl-admin` is the Admin service for **osctrl**. -Execute `./osctrl-admin -h` to show the main help of the program: +Execute `./osctrl-admin help` to show the main help of the program: ```properties -$ ./osctrl-admin -h +$ ./osctrl-admin help NAME: osctrl-admin - Admin service for osctrl, a fast and efficient osquery management @@ -18,7 +18,7 @@ USAGE: osctrl-admin [global options] command [command options] [arguments...] VERSION: - 0.3.7 + 0.4.1 DESCRIPTION: Admin service for osctrl, a fast and efficient osquery management @@ -53,6 +53,7 @@ GLOBAL OPTIONS: --db-name value Database name to be used in the backend (default: "osctrl") [$DB_NAME] --db-user value Username to be used for the backend (default: "postgres") [$DB_USER] --db-pass value Password to be used for the backend (default: "postgres") [$DB_PASS] + --db-sslmode value SSL native support to encrypt the connection to the backend (default: "disable") [$DB_SSLMODE] --db-max-idle-conns value Maximum number of connections in the idle connection pool (default: 20) [$DB_MAX_IDLE_CONNS] --db-max-open-conns value Maximum number of open connections to the database (default: 100) [$DB_MAX_OPEN_CONNS] --db-conn-max-lifetime value Maximum amount of time a connection may be reused (default: 30) [$DB_CONN_MAX_LIFETIME] @@ -65,8 +66,8 @@ GLOBAL OPTIONS: --jwt-file FILE Load JWT configuration from FILE (default: "config/jwt.json") [$JWT_CONFIG_FILE] --jwt-secret value Password to be used for the backend [$JWT_SECRET] --jwt-expire value Maximum amount of hours for the tokens to expire (default: 3) [$JWT_EXPIRE] - --osquery-version value Set osquery version as default to be used (default: "5.12.1") [$OSQUERY_VERSION] - --osquery-tables FILE Load osquery tables schema from FILE (default: "data/5.12.1.json") [$OSQUERY_TABLES] + --osquery-version value Set osquery version as default to be used (default: "5.13.1") [$OSQUERY_VERSION] + --osquery-tables FILE Load osquery tables schema from FILE (default: "data/5.13.1.json") [$OSQUERY_TABLES] --logger-file value, -F value Logger configuration to handle status/results logs from nodes (default: "config/logger.json") [$LOGGER_FILE] --logger-db-same Use the same DB configuration for the logger (default: false) [$LOGGER_DB_SAME] --static value, -s value Directory with all the static files needed for the osctrl-admin UI (default: "./static") [$STATIC_FILES] diff --git a/content/usage/osctrl-api/_index.md b/content/usage/osctrl-api/_index.md index 011d743..1a78833 100644 --- a/content/usage/osctrl-api/_index.md +++ b/content/usage/osctrl-api/_index.md @@ -7,10 +7,10 @@ pre = "" `osctrl-api` is the API service for **osctrl**. -Execute `./osctrl-api -h` to show the main help of the program: +Execute `./osctrl-api help` to show the main help of the program: ```properties -$ ./osctrl-api -h +$ ./osctrl-api help NAME: osctrl-api - API service for osctrl, a fast and efficient osquery management @@ -18,7 +18,7 @@ USAGE: osctrl-api [global options] command [command options] [arguments...] VERSION: - 0.3.7 + 0.4.1 DESCRIPTION: API service for osctrl, a fast and efficient osquery management @@ -49,6 +49,7 @@ GLOBAL OPTIONS: --db-name value Database name to be used in the backend (default: "osctrl") [$DB_NAME] --db-user value Username to be used for the backend (default: "postgres") [$DB_USER] --db-pass value Password to be used for the backend (default: "postgres") [$DB_PASS] + --db-sslmode value SSL native support to encrypt the connection to the backend (default: "disable") [$DB_SSLMODE] --db-max-idle-conns value Maximum number of connections in the idle connection pool (default: 20) [$DB_MAX_IDLE_CONNS] --db-max-open-conns value Maximum number of open connections to the database (default: 100) [$DB_MAX_OPEN_CONNS] --db-conn-max-lifetime value Maximum amount of time a connection may be reused (default: 30) [$DB_CONN_MAX_LIFETIME] diff --git a/content/usage/osctrl-cli/_index.md b/content/usage/osctrl-cli/_index.md index 3a54e8d..d16f0f3 100644 --- a/content/usage/osctrl-cli/_index.md +++ b/content/usage/osctrl-cli/_index.md @@ -7,10 +7,10 @@ pre = "" `osctrl-cli` is the CLI for **osctrl**. Its purpose is to execute actions in **osctrl** without having to access directly the backend or use the admin interface. It can be very handy to automate actions in scripts or similar. -Execute `./osctrl-cli -h` to show the main help of the program: +Execute `./osctrl-cli help` to show the main help of the program: ```properties -$ ./osctrl-cli -h +$ ./osctrl-cli help NAME: osctrl-cli - CLI for osctrl @@ -18,7 +18,7 @@ USAGE: osctrl-cli [global options] command [command options] [arguments...] VERSION: - 0.3.7 + 0.4.1 DESCRIPTION: CLI for osctrl, a fast and efficient osquery management diff --git a/content/usage/osctrl-cli/carve/_index.md b/content/usage/osctrl-cli/carve/_index.md new file mode 100644 index 0000000..d8c0cbe --- /dev/null +++ b/content/usage/osctrl-cli/carve/_index.md @@ -0,0 +1,130 @@ ++++ +title = "carve" +date = 2024-11-04T12:21:37+01:00 +weight = 8 +pre = "" ++++ + +### Carve + +```properties +$ ./osctrl-cli carve -h +NAME: + osctrl-cli carve - Commands for file carves + +USAGE: + osctrl-cli carve command [command options] [arguments...] + +COMMANDS: + complete, c Mark an file carve query as completed + delete, d Mark a file carve query as deleted + expire, e Mark a file carve query as expired + run, r Start a new carve for a file or a directory + list, l List file carves + list-queries, l List file carves queries + help, h Shows a list of commands or help for one command + +OPTIONS: + --help, -h show help +``` + +#### Complete carve + +```properties +$ ./osctrl-cli carve complete -h +NAME: + osctrl-cli carve complete - Mark an file carve query as completed + +USAGE: + osctrl-cli carve complete [command options] [arguments...] + +OPTIONS: + --name value, -n value Carve name to be completed + --env value, -e value Environment to be used + --help, -h show help +``` + +#### Delete carve + +```properties +$ ./osctrl-cli carve delete -h +NAME: + osctrl-cli carve delete - Mark a file carve query as deleted + +USAGE: + osctrl-cli carve delete [command options] [arguments...] + +OPTIONS: + --name value, -n value Carve name to be deleted + --env value, -e value Environment to be used + --help, -h show help +``` + +#### Expire carve + +```properties +$ ./osctrl-cli carve expire -h +NAME: + osctrl-cli carve expire - Mark a file carve query as expired + +USAGE: + osctrl-cli carve expire [command options] [arguments...] + +OPTIONS: + --name value, -n value Carve name to be expired + --env value, -e value Environment to be used + --help, -h show help +``` + +#### Run carve + +```properties +$ ./osctrl-cli carve run -h +NAME: + osctrl-cli carve run - Start a new carve for a file or a directory + +USAGE: + osctrl-cli carve run [command options] [arguments...] + +OPTIONS: + --path value, -p value File or directory path to be carved + --env value, -e value Environment to be used + --uuid value, -u value Node UUID to be used + --expiration value, -E value Expiration in hours (0 for no expiration) (default: 6) + --help, -h show help +``` + +#### List carves + +```properties +$ ./osctrl-cli carve list -h +NAME: + osctrl-cli carve list - List file carves + +USAGE: + osctrl-cli carve list [command options] [arguments...] + +OPTIONS: + --env value, -e value Environment to be used + --help, -h show help +``` + +#### List carve queries + +```properties +$ ./osctrl-cli carve list-queries -h +NAME: + osctrl-cli carve list-queries - List file carves queries + +USAGE: + osctrl-cli carve list-queries [command options] [arguments...] + +OPTIONS: + --all, -A Show all file carves queries (default: false) + --active, -a Show active file carves queries (default: false) + --completed, -c Show completed file carves queries (default: false) + --expired, -E Show expired file carves queries (default: false) + --deleted, -d Show deleted file carves queries (default: false) + --env value, -e value Environment to be used + --help, -h show help +``` diff --git a/content/usage/osctrl-cli/check-api/_index.md b/content/usage/osctrl-cli/check-api/_index.md new file mode 100644 index 0000000..c013fa3 --- /dev/null +++ b/content/usage/osctrl-cli/check-api/_index.md @@ -0,0 +1,22 @@ ++++ +title = "check-api" +date = 2024-11-04T12:21:37+01:00 +weight = 7 +pre = "" ++++ + +### Check + +```properties +$ ./osctrl-cli check-api -h +NAME: + osctrl-cli check-api - Checks API token + +USAGE: + osctrl-cli check-api [command options] [arguments...] + +OPTIONS: + --help, -h show help +``` + +Although this command may appear a bit confusing, it comes in really handy to verify when the `osctrl-api` component is ready to go and the validity of a token. diff --git a/content/usage/osctrl-cli/check/_index.md b/content/usage/osctrl-cli/check-db/_index.md similarity index 50% rename from content/usage/osctrl-cli/check/_index.md rename to content/usage/osctrl-cli/check-db/_index.md index 5179cd7..96e647a 100644 --- a/content/usage/osctrl-cli/check/_index.md +++ b/content/usage/osctrl-cli/check-db/_index.md @@ -1,6 +1,6 @@ +++ -title = "check" -date = 2019-08-17T15:24:52-07:00 +title = "check-db" +date = 2024-11-04T12:21:37+01:00 weight = 6 pre = "" +++ @@ -8,15 +8,15 @@ pre = "" ### Check ```properties -$ ./osctrl-cli check -h +$ ./osctrl-cli check-db -h NAME: - osctrl-cli check - Checks DB connection + osctrl-cli check-db - Checks DB connection USAGE: - osctrl-cli check [command options] [arguments...] + osctrl-cli check-db [command options] [arguments...] OPTIONS: - --help, -h show help (default: false) + --help, -h show help ``` Although this command may appear a bit confusing, it comes in really handy to verify when the backend component is ready to go. diff --git a/content/usage/osctrl-cli/environment/_index.md b/content/usage/osctrl-cli/environment/_index.md index 8b94b17..2d3b754 100644 --- a/content/usage/osctrl-cli/environment/_index.md +++ b/content/usage/osctrl-cli/environment/_index.md @@ -27,14 +27,10 @@ COMMANDS: remove-pack Remove query pack from the osquery configuration add-query-to-pack Add a new query to the given query pack remove-query-from-pack Remove query from the given query pack + node-actions Node enroll actions for an environment delete, d Delete an existing TLS environment show, s Show a TLS environment - show-flags, w Show the flags for a TLS environment - gen-flags, g Generate and save the flags for a TLS environment list, l List all existing TLS environments - quick-add, q Generates one-liner for quick adding nodes to environment - flags, f Generates the flags to run nodes in an environment - secret, x Output the secret to enroll nodes in an environment help, h Shows a list of commands or help for one command OPTIONS: @@ -70,14 +66,18 @@ USAGE: osctrl-cli environment update [command options] [arguments...] OPTIONS: - --name value, -n value Environment name to be updated - --debug, -d Environment debug capability (default: false) - --enroll, -e Environment enroll capability (default: false) - --hostname value, --host value Environment host to be updated - --logging value, -l value Logging interval in seconds (default: 0) - --config value, -c value Config interval in seconds (default: 0) - --query value, -q value Query interval in seconds (default: 0) - --help, -h show help + --name value, -n value Environment name to be updated + --debug, -d Environment debug capability (default: false) + --enroll, -e Environment enroll capability (default: false) + --hostname value, --host value Environment host to be updated + --logging value, -l value Logging interval in seconds (default: 0) + --config value, -c value Config interval in seconds (default: 0) + --query value, -q value Query interval in seconds (default: 0) + --deb value, --deb-package value DEB package to be updated + --rpm value, --rpm-package value RPM package to be updated + --msi value, --msi-package value MSI package to be updated + --pkg value, --pkg-package value PKG package to be updated + --help, -h show help ``` #### Add scheduled query to environment @@ -242,125 +242,295 @@ OPTIONS: --help, -h show help ``` -#### Delete environment +#### Node actions ```properties -$ ./osctrl-cli environment delete -h +$ ./osctrl-cli environment node-actions -h NAME: - osctrl-cli environment delete - Delete an existing TLS environment + osctrl-cli environment node-actions - Node enroll actions for an environment USAGE: - osctrl-cli environment delete [command options] [arguments...] + osctrl-cli environment node-actions command [command options] [arguments...] + +COMMANDS: + show-flags, s Show the enroll flags for a TLS environment + new-flags, f Generate new enroll flags and save them for a TLS environment + gen-flags, F Generate and show the enroll flags for a TLS environment + quick-add, q Generates one-liner for quick enrolling nodes to a TLS environment + extend-enroll, f Extend the existing enroll URL for a TLS environment + rotate-enroll, f Rotate to a new enroll URL for a TLS environment + expire-enroll, f Expire the existing enroll URL for a TLS environment + notexpire-enroll, f Set the existing enroll URL for a TLS environment to NOT expire + quick-remove, Q Generates one-liner for quick removing nodes to a TLS environment + extend-remove, f Extend the existing enroll URL for a TLS environment + rotate-remove, f Rotate to a new enroll URL for a TLS environment + expire-remove, f Expire the existing remove URL for a TLS environment + notexpire-remove, f Set the existing remove URL for a TLS environment to NOT expire + secret, x Output the secret to enroll nodes in an environment + certificate, c, cert Output the certificate to enroll nodes in an environment + help, h Shows a list of commands or help for one command OPTIONS: - --name value, -n value Environment name to be deleted + --name value, -n value Environment name to be updated --help, -h show help ``` -#### Show environment +##### Show flags ```properties -$ ./osctrl-cli environment show -h +$ ./osctrl-cli environment node-actions show-flags -h NAME: - osctrl-cli environment show - Show a TLS environment + osctrl-cli environment node-actions show-flags - Show the enroll flags for a TLS environment USAGE: - osctrl-cli environment show [command options] [arguments...] + osctrl-cli environment node-actions show-flags [command options] [arguments...] OPTIONS: - --name value, -n value Environment name to be displayed - --help, -h show help + --help, -h show help ``` -#### Show environment flags +##### New flags ```properties -$ ./osctrl-cli environment show-flags -h +$ ./osctrl-cli environment node-actions new-flags -h NAME: - osctrl-cli environment show-flags - Show the flags for a TLS environment + osctrl-cli environment node-actions new-flags - Generate new enroll flags and save them for a TLS environment USAGE: - osctrl-cli environment show-flags [command options] [arguments...] + osctrl-cli environment node-actions new-flags [command options] [arguments...] OPTIONS: - --name value, -n value Environment name to be displayed - --help, -h show help + --help, -h show help ``` -#### Re-generate and update environment flags +##### Generate flags ```properties -$ ./osctrl-cli environment gen-flags -h +$ ./osctrl-cli environment node-actions gen-flags -h NAME: - osctrl-cli environment gen-flags - Generate and save the flags for a TLS environment + osctrl-cli environment node-actions gen-flags - Generate and show the enroll flags for a TLS environment USAGE: - osctrl-cli environment gen-flags [command options] [arguments...] + osctrl-cli environment node-actions gen-flags [command options] [arguments...] OPTIONS: - --name value, -n value Environment name to be displayed - --help, -h show help + --certificate value, --crt value Certificate file path to be used + --secret value, -s value Secret file path to be used + --help, -h show help ``` -#### List environments +##### Quick add ```properties -$ ./osctrl-cli environment list -h +$ ./osctrl-cli environment node-actions quick-add -h NAME: - osctrl-cli environment list - List all existing TLS environments + osctrl-cli environment node-actions quick-add - Generates one-liner for quick enrolling nodes to a TLS environment USAGE: - osctrl-cli environment list [command options] [arguments...] + osctrl-cli environment node-actions quick-add [command options] [arguments...] + +OPTIONS: + --target value, -t value Type of one-liner script (default: "sh") + --insecure, -i Generate insecure one-liner, without HTTPS (default: false) + --help, -h show help +``` + +##### Extend enroll + +```properties +$ ./osctrl-cli environment node-actions extend-enroll -h +NAME: + osctrl-cli environment node-actions extend-enroll - Extend the existing enroll URL for a TLS environment + +USAGE: + osctrl-cli environment node-actions extend-enroll [command options] [arguments...] OPTIONS: --help, -h show help ``` -#### Quick-add to environment +##### Rotate enroll ```properties -$ ./osctrl-cli environment quick-add -h +$ ./osctrl-cli environment node-actions rotate-enroll -h NAME: - osctrl-cli environment quick-add - Generates one-liner for quick adding nodes to environment + osctrl-cli environment node-actions rotate-enroll - Rotate to a new enroll URL for a TLS environment USAGE: - osctrl-cli environment quick-add [command options] [arguments...] + osctrl-cli environment node-actions rotate-enroll [command options] [arguments...] OPTIONS: - --name value, -n value Environment name to be used - --target value, -t value Type of one-liner (default: "sh") - --insecure, -i Generate insecure one-liner (default: false) + --help, -h show help +``` + +##### Expire enroll + +```properties +$ ./osctrl-cli environment node-actions expire-enroll -h +NAME: + osctrl-cli environment node-actions expire-enroll - Expire the existing enroll URL for a TLS environment + +USAGE: + osctrl-cli environment node-actions expire-enroll [command options] [arguments...] + +OPTIONS: + --help, -h show help +``` + +##### Not expire enroll + +```properties +$ ./osctrl-cli environment node-actions notexpire-enroll -h +NAME: + osctrl-cli environment node-actions notexpire-enroll - Set the existing enroll URL for a TLS environment to NOT expire + +USAGE: + osctrl-cli environment node-actions notexpire-enroll [command options] [arguments...] + +OPTIONS: + --help, -h show help +``` + +##### Quick remove + +```properties +$ ./osctrl-cli environment node-actions quick-remove -h +NAME: + osctrl-cli environment node-actions quick-remove - Generates one-liner for quick removing nodes to a TLS environment + +USAGE: + osctrl-cli environment node-actions quick-remove [command options] [arguments...] + +OPTIONS: + --target value, -t value Type of one-liner script (default: "sh") + --insecure, -i Generate insecure one-liner, without HTTPS (default: false) --help, -h show help ``` -#### Flags +##### Extend remove ```properties -$ ./osctrl-cli environment flags -h +$ ./osctrl-cli environment node-actions extend-remove -h NAME: - osctrl-cli environment flags - Generates the flags to run nodes in an environment + osctrl-cli environment node-actions extend-remove - Extend the existing enroll URL for a TLS environment USAGE: - osctrl-cli environment flags [command options] [arguments...] + osctrl-cli environment node-actions extend-remove [command options] [arguments...] OPTIONS: - --name value, -n value Environment name to be used - --certificate value, --crt value Certificate path to be used - --secret value, -s value Secret file path to be used - --help, -h show help + --help, -h show help ``` -#### Secret +##### Rotate remove ```properties -$ ./osctrl-cli environment secret -h +$ ./osctrl-cli environment node-actions rotate-remove -h NAME: - osctrl-cli environment secret - Output the secret to enroll nodes in an environment + osctrl-cli environment node-actions rotate-remove - Rotate to a new enroll URL for a TLS environment USAGE: - osctrl-cli environment secret [command options] [arguments...] + osctrl-cli environment node-actions rotate-remove [command options] [arguments...] OPTIONS: - --name value, -n value Environment name to be used + --help, -h show help +``` + +##### Expire remove + +```properties +$ ./osctrl-cli environment node-actions expire-remove -h +NAME: + osctrl-cli environment node-actions expire-remove - Expire the existing remove URL for a TLS environment + +USAGE: + osctrl-cli environment node-actions expire-remove [command options] [arguments...] + +OPTIONS: + --help, -h show help +``` + +##### Not expire remove + +```properties +$ ./osctrl-cli environment node-actions notexpire-remove -h +NAME: + osctrl-cli environment node-actions notexpire-remove - Set the existing remove URL for a TLS environment to NOT expire + +USAGE: + osctrl-cli environment node-actions notexpire-remove [command options] [arguments...] + +OPTIONS: + --help, -h show help +``` + +##### Secret + +```properties +$ ./osctrl-cli environment node-actions secret -h +NAME: + osctrl-cli environment node-actions secret - Output the secret to enroll nodes in an environment + +USAGE: + osctrl-cli environment node-actions secret [command options] [arguments...] + +OPTIONS: + --help, -h show help +``` + +##### Certificate + +```properties +$ ./osctrl-cli environment node-actions certificate -h +NAME: + osctrl-cli environment node-actions certificate - Output the certificate to enroll nodes in an environment + +USAGE: + osctrl-cli environment node-actions certificate [command options] [arguments...] + +OPTIONS: + --help, -h show help +``` + +#### Delete environment + +```properties +$ ./osctrl-cli environment delete -h +NAME: + osctrl-cli environment delete - Delete an existing TLS environment + +USAGE: + osctrl-cli environment delete [command options] [arguments...] + +OPTIONS: + --name value, -n value Environment name to be deleted --help, -h show help ``` + +#### Show environment + +```properties +$ ./osctrl-cli environment show -h +NAME: + osctrl-cli environment show - Show a TLS environment + +USAGE: + osctrl-cli environment show [command options] [arguments...] + +OPTIONS: + --name value, -n value Environment name to be displayed + --help, -h show help +``` + +#### List environments + +```properties +$ ./osctrl-cli environment list -h +NAME: + osctrl-cli environment list - List all existing TLS environments + +USAGE: + osctrl-cli environment list [command options] [arguments...] + +OPTIONS: + --help, -h show help +``` diff --git a/content/usage/osctrl-cli/login/_index.md b/content/usage/osctrl-cli/login/_index.md new file mode 100644 index 0000000..cbbec59 --- /dev/null +++ b/content/usage/osctrl-cli/login/_index.md @@ -0,0 +1,23 @@ ++++ +title = "login" +date = 2024-11-04T12:21:37+01:00 +weight = 9 +pre = "" ++++ + +### Login + +```properties +$ ./osctrl-cli login -h +NAME: + osctrl-cli login - Login into API and generate JSON config file with token + +USAGE: + osctrl-cli login [command options] [arguments...] + +OPTIONS: + --username value, -u value User to be used in login + --environment value, -e value Environment to be used in login + --write-api-file, -w Write API configuration to JSON file (default: false) + --help, -h show help +``` diff --git a/content/usage/osctrl-cli/node/_index.md b/content/usage/osctrl-cli/node/_index.md index 56914b4..fbfc473 100644 --- a/content/usage/osctrl-cli/node/_index.md +++ b/content/usage/osctrl-cli/node/_index.md @@ -16,8 +16,11 @@ USAGE: osctrl-cli node command [command options] [arguments...] COMMANDS: - delete, d Delete and archive an existing node - list, l List enrolled nodes + delete, d Delete and archive an existing node + tag, t Tag an existing node + list, l List enrolled nodes + show, s Show an existing node + help, h Shows a list of commands or help for one command OPTIONS: --help, -h show help @@ -35,6 +38,25 @@ USAGE: OPTIONS: --uuid value, -u value Node UUID to be deleted + --env value, -e value Environment to be used + --help, -h show help +``` + +#### Tag node + +```properties +$ ./osctrl-cli node tag -h +NAME: + osctrl-cli node tag - Tag an existing node + +USAGE: + osctrl-cli node tag [command options] [arguments...] + +OPTIONS: + --uuid value, -u value Node UUID to be tagged + --env value, -e value Environment to be used + --tag-value value, -T value Tag value to be used. It will be created if does not exist + --help, -h show help ``` #### List nodes @@ -48,6 +70,25 @@ USAGE: osctrl-cli node list [command options] [arguments...] OPTIONS: - --all, -v Show all nodes - --inactive, -i Show inactive nodes + --active, -a Show active nodes (default: true) + --all, -A Show all nodes (default: false) + --inactive, -i Show inactive nodes (default: false) + --env value, -e value Environment to be used + --help, -h show help +``` + +#### Show node + +```properties +$ ./osctrl-cli node show -h +NAME: + osctrl-cli node show - Show an existing node + +USAGE: + osctrl-cli node show [command options] [arguments...] + +OPTIONS: + --uuid value, -u value Node UUID to be shown + --env value, -e value Environment to be used + --help, -h show help ``` diff --git a/content/usage/osctrl-cli/query/_index.md b/content/usage/osctrl-cli/query/_index.md index 7aa686a..b2b2436 100644 --- a/content/usage/osctrl-cli/query/_index.md +++ b/content/usage/osctrl-cli/query/_index.md @@ -16,9 +16,12 @@ USAGE: osctrl-cli query command [command options] [arguments...] COMMANDS: - complete, c Mark an on-demand query as completed - delete, d Mark an on-demand query as deleted - list, l List on-demand queries + complete, c Mark an on-demand query as completed + delete, d Mark an on-demand query as deleted + expire, e Mark an on-demand query as expired + run, r Start a new on-demand query + list, l List on-demand queries + help, h Shows a list of commands or help for one command OPTIONS: --help, -h show help @@ -36,6 +39,8 @@ USAGE: OPTIONS: --name value, -n value Query name to be completed + --env value, -e value Environment to be used + --help, -h show help ``` #### Delete query @@ -50,6 +55,43 @@ USAGE: OPTIONS: --name value, -n value Query name to be deleted + --env value, -e value Environment to be used + --help, -h show help +``` + +#### Expire query + +```properties +$ ./osctrl-cli query expire -h +NAME: + osctrl-cli query expire - Mark an on-demand query as expired + +USAGE: + osctrl-cli query expire [command options] [arguments...] + +OPTIONS: + --name value, -n value Query name to be expired + --env value, -e value Environment to be used + --help, -h show help +``` + +#### Run query + +```properties +$ ./osctrl-cli query run -h +NAME: + osctrl-cli query run - Start a new on-demand query + +USAGE: + osctrl-cli query run [command options] [arguments...] + +OPTIONS: + --query value, -q value Query to be issued + --env value, -e value Environment to be used + --uuid value, -u value Node UUID to be used + --hidden, -x Mark query as hidden (default: false) + --expiration value, -E value Expiration in hours (0 for no expiration) (default: 6) + --help, -h show help ``` #### List queries @@ -63,7 +105,12 @@ USAGE: osctrl-cli query list [command options] [arguments...] OPTIONS: - --active, -a Show active queries - --completed, -c Show completed queries - --deleted, -d Show deleted queries + --all, -A Show all queries (default: false) + --active, -a Show active queries (default: false) + --completed, -c Show completed queries (default: false) + --deleted, -d Show deleted queries (default: false) + --hidden, -x Show hidden queries (default: false) + --expired, -E Show expired queries (default: false) + --env value, -e value Environment to be used + --help, -h show help ``` diff --git a/content/usage/osctrl-cli/settings/_index.md b/content/usage/osctrl-cli/settings/_index.md index f8701a6..1699543 100644 --- a/content/usage/osctrl-cli/settings/_index.md +++ b/content/usage/osctrl-cli/settings/_index.md @@ -16,10 +16,11 @@ USAGE: osctrl-cli settings command [command options] [arguments...] COMMANDS: - add, a Add a new settings value - update, u Update a configuration value - delete, d Delete an existing configuration value - show, s Show all configuration values + add, a Add a new settings value + update, u Update a configuration value + delete, d Delete an existing configuration value + show, s Show all configuration values + help, h Shows a list of commands or help for one command OPTIONS: --help, -h show help @@ -41,8 +42,9 @@ OPTIONS: --type value, -t value Value type to be added --string value Value string --integer value Value integer (default: 0) - --boolean Value boolean + --boolean Value boolean (default: false) --info value, -i value Setting info + --help, -h show help ``` #### Update setting @@ -61,9 +63,10 @@ OPTIONS: --type value, -t value Value type to be updated --string value Value string --integer value Value integer (default: 0) - --true Value boolean true - --false Value boolean false + --true Value boolean true (default: false) + --false Value boolean false (default: false) --info value, -i value Setting info + --help, -h show help ``` #### Delete setting @@ -79,6 +82,7 @@ USAGE: OPTIONS: --name value, -n value Value name to be deleted --service value, -s value Value service to be deleted + --help, -h show help ``` #### Show settings @@ -89,5 +93,8 @@ NAME: osctrl-cli settings show - Show all configuration values USAGE: - osctrl-cli settings show [arguments...] + osctrl-cli settings show [command options] [arguments...] + +OPTIONS: + --help, -h show help ``` diff --git a/content/usage/osctrl-cli/tag/_index.md b/content/usage/osctrl-cli/tag/_index.md index 936de4d..b601d2a 100644 --- a/content/usage/osctrl-cli/tag/_index.md +++ b/content/usage/osctrl-cli/tag/_index.md @@ -21,6 +21,7 @@ COMMANDS: delete, d Delete an existing tag list, l List all tags show, s Show an existing tag + help, h Shows a list of commands or help for one command OPTIONS: --help, -h show help @@ -41,6 +42,7 @@ OPTIONS: --color value, -c value Tag color to be added --description value, -d value Tag description to be added --icon value, -i value Tag icon to be added + --help, -h show help ``` #### Edit tag @@ -58,6 +60,7 @@ OPTIONS: --color value, -c value Tag color to be edited --description value, -d value Tag description to be edited --icon value, -i value Tag icon to be edited + --help, -h show help ``` #### Delete tag @@ -72,6 +75,7 @@ USAGE: OPTIONS: --name value, -n value Tag name to be deleted + --help, -h show help ``` #### List tags @@ -82,7 +86,10 @@ NAME: osctrl-cli tag list - List all tags USAGE: - osctrl-cli tag list [arguments...] + osctrl-cli tag list [command options] [arguments...] + +OPTIONS: + --help, -h show help ``` #### Show tag @@ -97,4 +104,5 @@ USAGE: OPTIONS: --name value, -n value Tag name to be displayed + --help, -h show help ``` diff --git a/content/usage/osctrl-cli/user/_index.md b/content/usage/osctrl-cli/user/_index.md index 8b08b46..04548bf 100644 --- a/content/usage/osctrl-cli/user/_index.md +++ b/content/usage/osctrl-cli/user/_index.md @@ -16,10 +16,16 @@ USAGE: osctrl-cli user command [command options] [arguments...] COMMANDS: - add, a Add a new user - edit, e Edit an existing user - delete, d Delete an existing user - list, l List all existing users + add, a Add a new user + edit, e Edit an existing user + change-permissions, p, access Change permission in an environment for an existing user + reset-permissions, R, reset Clear and reset permissions for a user in an environment + show-permissions, S, perms Show permissions for a user in an environment + all-permissions, A, all-perms Show all permissions for an existing user + delete, d Delete an existing user + show, s Show an existing user + list, l List all existing users + help, h Shows a list of commands or help for one command OPTIONS: --help, -h show help @@ -38,10 +44,11 @@ USAGE: OPTIONS: --username value, -u value Username for the new user --password value, -p value Password for the new user - --admin, -a Make this user an admin - --environment value, -E value Default environment for the new user - --email value, -e value Email for the new user + --admin, -a Make this user an admin (default: false) + --environment value, -e value Default environment for the new user + --email value, -E value Email for the new user --fullname value, -n value Full name for the new user + --help, -h show help ``` #### Edit user @@ -55,13 +62,85 @@ USAGE: osctrl-cli user edit [command options] [arguments...] OPTIONS: - --username value, -u value User to be edited - --password value, -p value New password to be used - --email value, -e value Email to be used - --fullname value, -n value Full name to be used - --admin, -a Make this user an admin - --non-admin, -d Make this user an non-admin - --environment value, -E value Default environment for this user + --username value, -u value User to be edited + --password value, -p value New password to be used + --email value, -E value Email to be used + --fullname value, -n value Full name to be used + --admin, -a Make this user an admin (default: false) + --non-admin, -d Make this user an non-admin (default: false) + --environment value, --env value Default environment for this user + --help, -h show help +``` + +#### Change permissions + +```properties +$ ./osctrl-cli user change-permissions -h +NAME: + osctrl-cli user change-permissions - Change permission in an environment for an existing user + +USAGE: + osctrl-cli user change-permissions [command options] [arguments...] + +OPTIONS: + --username value, -u value User to perform the action + --environment value, -e value Environment for this user + --admin, -a Grant admin permissions (default: false) + --user, -U Grant user permissions (default: false) + --query, -q Grant query permissions (default: false) + --carve, -c Grant carve permissions (default: false) + --help, -h show help +``` + +#### Reset permissions + +```properties +$ ./osctrl-cli user reset-permissions -h +NAME: + osctrl-cli user reset-permissions - Clear and reset permissions for a user in an environment + +USAGE: + osctrl-cli user reset-permissions [command options] [arguments...] + +OPTIONS: + --username value, -u value User to perform the action + --environment value, -e value Environment for this user + --admin, -a Grant admin permissions (default: false) + --user, -U Grant user permissions (default: false) + --query, -q Grant query permissions (default: false) + --carve, -c Grant carve permissions (default: false) + --help, -h show help +``` + +#### Show permissions + +```properties +$ ./osctrl-cli user show-permissions -h +NAME: + osctrl-cli user show-permissions - Show permissions for a user in an environment + +USAGE: + osctrl-cli user show-permissions [command options] [arguments...] + +OPTIONS: + --username value, -u value User to perform the action + --environment value, -e value Environment for this user + --help, -h show help +``` + +#### All permissions + +```properties +$ ./osctrl-cli user all-permissions -h +NAME: + osctrl-cli user all-permissions - Show all permissions for an existing user + +USAGE: + osctrl-cli user all-permissions [command options] [arguments...] + +OPTIONS: + --username value, -u value User to perform the action + --help, -h show help ``` #### Delete user @@ -76,6 +155,22 @@ USAGE: OPTIONS: --username value, -u value User to be deleted + --help, -h show help +``` + +#### Show user + +```properties +$ ./osctrl-cli user show -h +NAME: + osctrl-cli user show - Show an existing user + +USAGE: + osctrl-cli user show [command options] [arguments...] + +OPTIONS: + --username value, -u value User to be displayed + --help, -h show help ``` #### List users @@ -86,5 +181,8 @@ NAME: osctrl-cli user list - List all existing users USAGE: - osctrl-cli user list [arguments...] + osctrl-cli user list [command options] [arguments...] + +OPTIONS: + --help, -h show help ``` diff --git a/content/usage/osctrl-tls/_index.md b/content/usage/osctrl-tls/_index.md index 7db0c9e..46e01f9 100644 --- a/content/usage/osctrl-tls/_index.md +++ b/content/usage/osctrl-tls/_index.md @@ -7,10 +7,10 @@ pre = "" `osctrl-tls` is the TLS service for **osctrl**. -Execute `./osctrl-tls -h` to show the main help of the program: +Execute `./osctrl-tls help` to show the main help of the program: ```properties -$ ./osctrl-tls -h +$ ./osctrl-tls help NAME: osctrl-tls - TLS service for osctrl, a fast and efficient osquery management @@ -18,7 +18,7 @@ USAGE: osctrl-tls [global options] command [command options] [arguments...] VERSION: - 0.3.7 + 0.4.1 DESCRIPTION: TLS service for osctrl, a fast and efficient osquery management @@ -27,50 +27,61 @@ COMMANDS: help GLOBAL OPTIONS: - --config, -c Provide service configuration via JSON file (default: false) [$SERVICE_CONFIG] - --config-file FILE, -C FILE Load service configuration from FILE (default: "config/tls.json") [$SERVICE_CONFIG_FILE] - --listener value, -l value Listener for the service (default: "0.0.0.0") [$SERVICE_LISTENER] - --port value, -p value TCP port for the service (default: "9000") [$SERVICE_PORT] - --auth value, -A value Authentication mechanism for the service (default: "none") [$SERVICE_AUTH] - --host value, -H value Exposed hostname the service uses (default: "0.0.0.0") [$SERVICE_HOST] - --logger value, -L value Logger mechanism to handle status/result logs from nodes (default: "db") [$SERVICE_LOGGER] - --redis, -r Provide redis configuration via JSON file (default: false) [$REDIS_CONFIG] - --redis-file FILE, -R FILE Load redis configuration from FILE (default: "config/redis.json") [$REDIS_CONFIG_FILE] - --redis-connection-string value Redis connection string, must include schema (://:@:/? [$REDIS_CONNECTION_STRING] - --redis-host value Redis host to be connected to (default: "127.0.0.1") [$REDIS_HOST] - --redis-port value Redis port to be connected to (default: "6379") [$REDIS_PORT] - --redis-pass value Password to be used for redis [$REDIS_PASS] - --redis-db value Redis database to be selected after connecting (default: 0) [$REDIS_DB] - --redis-status-exp value Redis expiration in hours for status logs (default: 24) [$REDIS_STATUS_EXP] - --redis-result-exp value Redis expiration in hours for result logs (default: 24) [$REDIS_RESULT_EXP] - --redis-query-exp value Redis expiration in hours for query logs (default: 24) [$REDIS_QUERY_EXP] - --redis-conn-retry value Time in seconds to retry the connection to the cache, if set to 0 the service will stop if the connection fails (default: 7) [$REDIS_CONN_RETRY] - --db, -d Provide DB configuration via JSON file (default: false) [$DB_CONFIG] - --db-file FILE, -D FILE Load DB configuration from FILE (default: "config/db.json") [$DB_CONFIG_FILE] - --db-host value Backend host to be connected to (default: "127.0.0.1") [$DB_HOST] - --db-port value Backend port to be connected to (default: "5432") [$DB_PORT] - --db-name value Database name to be used in the backend (default: "osctrl") [$DB_NAME] - --db-user value Username to be used for the backend (default: "postgres") [$DB_USER] - --db-pass value Password to be used for the backend (default: "postgres") [$DB_PASS] - --db-max-idle-conns value Maximum number of connections in the idle connection pool (default: 20) [$DB_MAX_IDLE_CONNS] - --db-max-open-conns value Maximum number of open connections to the database (default: 100) [$DB_MAX_OPEN_CONNS] - --db-conn-max-lifetime value Maximum amount of time a connection may be reused (default: 30) [$DB_CONN_MAX_LIFETIME] - --db-conn-retry value Time in seconds to retry the connection to the database, if set to 0 the service will stop if the connection fails (default: 7) [$DB_CONN_RETRY] - --tls, -t Enable TLS termination. It requires certificate and key (default: false) [$TLS_SERVER] - --cert FILE, -T FILE TLS termination certificate from FILE (default: "config/tls.crt") [$TLS_CERTIFICATE] - --key FILE, -K FILE TLS termination private key from FILE (default: "config/tls.key") [$TLS_KEY] - --logger-file value, -F value Logger configuration to handle status/results logs from nodes (default: "config/logger.json") [$LOGGER_FILE] - --logger-db-same Use the same DB configuration for the logger (default: false) [$LOGGER_DB_SAME] - --always-log, -a, --always Always log status and on-demand query logs from nodes in database (default: false) [$ALWAYS_LOG] - --carver-type value Carver to be used to receive files extracted from nodes (default: "db") [$CARVER_TYPE] - --carver-file value Carver configuration file to receive files extracted from nodes (default: "config/carver.json") [$CARVER_FILE] - --log-s3-bucket value S3 bucket to be used as configuration for logging [$LOG_S3_BUCKET] - --log-s3-region value S3 region to be used as configuration for logging [$LOG_S3_REGION] - --log-s3-key-id value S3 access key id to be used as configuration for logging [$LOG_S3_KEY_ID] - --log-s3-secret value S3 access key secret to be used as configuration for logging [$LOG_S3_SECRET] - --carver-s3-bucket value S3 bucket to be used as configuration for carves [$CARVER_S3_BUCKET] - --carver-s3-region value S3 region to be used as configuration for carves [$CARVER_S3_REGION] - --carve-s3-key-id value S3 access key id to be used as configuration for carves [$CARVER_S3_KEY_ID] - --carve-s3-secret value S3 access key secret to be used as configuration for carves [$CARVER_S3_SECRET] - --version, -v print the version + --config, -c Provide service configuration via JSON file (default: false) [$SERVICE_CONFIG] + --config-file FILE, -C FILE Load service configuration from FILE (default: "config/tls.json") [$SERVICE_CONFIG_FILE] + --listener value, -l value Listener for the service (default: "0.0.0.0") [$SERVICE_LISTENER] + --port value, -p value TCP port for the service (default: "9000") [$SERVICE_PORT] + --auth value, -A value Authentication mechanism for the service (default: "none") [$SERVICE_AUTH] + --metrics-listener value Listener for prometheus metrics (default: "0.0.0.0") [$METRICS_LISTENER] + --metrics-port value Port for exposing prometheus metrics (default: "9090") [$METRICS_PORT] + --metrics-enabled Enable prometheus metrics (default: false) [$METRICS_ENABLED] + --host value, -H value Exposed hostname the service uses (default: "0.0.0.0") [$SERVICE_HOST] + --logger value, -L value Logger mechanism to handle status/result logs from nodes (default: "db") [$SERVICE_LOGGER] + --redis, -r Provide redis configuration via JSON file (default: false) [$REDIS_CONFIG] + --redis-file FILE, -R FILE Load redis configuration from FILE (default: "config/redis.json") [$REDIS_CONFIG_FILE] + --redis-connection-string value Redis connection string, must include schema (://:@:/? [$REDIS_CONNECTION_STRING] + --redis-host value Redis host to be connected to (default: "127.0.0.1") [$REDIS_HOST] + --redis-port value Redis port to be connected to (default: "6379") [$REDIS_PORT] + --redis-pass value Password to be used for redis [$REDIS_PASS] + --redis-db value Redis database to be selected after connecting (default: 0) [$REDIS_DB] + --redis-status-exp value Redis expiration in hours for status logs (default: 24) [$REDIS_STATUS_EXP] + --redis-result-exp value Redis expiration in hours for result logs (default: 24) [$REDIS_RESULT_EXP] + --redis-query-exp value Redis expiration in hours for query logs (default: 24) [$REDIS_QUERY_EXP] + --redis-conn-retry value Time in seconds to retry the connection to the cache, if set to 0 the service will stop if the connection fails (default: 7) [$REDIS_CONN_RETRY] + --db, -d Provide DB configuration via JSON file (default: false) [$DB_CONFIG] + --db-file FILE, -D FILE Load DB configuration from FILE (default: "config/db.json") [$DB_CONFIG_FILE] + --db-host value Backend host to be connected to (default: "127.0.0.1") [$DB_HOST] + --db-port value Backend port to be connected to (default: "5432") [$DB_PORT] + --db-name value Database name to be used in the backend (default: "osctrl") [$DB_NAME] + --db-user value Username to be used for the backend (default: "postgres") [$DB_USER] + --db-pass value Password to be used for the backend (default: "postgres") [$DB_PASS] + --db-sslmode value SSL native support to encrypt the connection to the backend (default: "disable") [$DB_SSLMODE] + --db-max-idle-conns value Maximum number of connections in the idle connection pool (default: 20) [$DB_MAX_IDLE_CONNS] + --db-max-open-conns value Maximum number of open connections to the database (default: 100) [$DB_MAX_OPEN_CONNS] + --db-conn-max-lifetime value Maximum amount of time a connection may be reused (default: 30) [$DB_CONN_MAX_LIFETIME] + --db-conn-retry value Time in seconds to retry the connection to the database, if set to 0 the service will stop if the connection fails (default: 7) [$DB_CONN_RETRY] + --tls, -t Enable TLS termination. It requires certificate and key (default: false) [$TLS_SERVER] + --cert FILE, -T FILE TLS termination certificate from FILE (default: "config/tls.crt") [$TLS_CERTIFICATE] + --key FILE, -K FILE TLS termination private key from FILE (default: "config/tls.key") [$TLS_KEY] + --logger-file value, -F value Logger configuration to handle status/results logs from nodes (default: "config/logger.json") [$LOGGER_FILE] + --logger-db-same Use the same DB configuration for the logger (default: false) [$LOGGER_DB_SAME] + --always-log, -a, --always Always log status and on-demand query logs from nodes in database (default: false) [$ALWAYS_LOG] + --carver-type value Carver to be used to receive files extracted from nodes (default: "db") [$CARVER_TYPE] + --carver-file value Carver configuration file to receive files extracted from nodes (default: "config/carver.json") [$CARVER_FILE] + --log-s3-bucket value S3 bucket to be used as configuration for logging [$LOG_S3_BUCKET] + --log-s3-region value S3 region to be used as configuration for logging [$LOG_S3_REGION] + --log-s3-key-id value S3 access key id to be used as configuration for logging [$LOG_S3_KEY_ID] + --log-s3-secret value S3 access key secret to be used as configuration for logging [$LOG_S3_SECRET] + --carver-s3-bucket value S3 bucket to be used as configuration for carves [$CARVER_S3_BUCKET] + --carver-s3-region value S3 region to be used as configuration for carves [$CARVER_S3_REGION] + --carve-s3-key-id value S3 access key id to be used as configuration for carves [$CARVER_S3_KEY_ID] + --carve-s3-secret value S3 access key secret to be used as configuration for carves [$CARVER_S3_SECRET] + --log-kafka-boostrap-servers value Kafka bootstrap servers to be used as configuration for logging [$LOG_KAFKA_BOOTSTRAP_SERVERS] + --log-kafka-sslca-location value Kafka sslca location to be used as configuration for logging [$LOG_KAFKA_SSLCA_LOCATION] + --log-kafka-connection-timeout value Kafka connection timeout to be used as configuration for logging (default: 5s) [$LOG_KAFKA_CONNECTION_TIMEOUT] + --log-kafka-topic value Kafka topic to be used as configuration for logging [$LOG_KAFKA_TOPIC] + --log-kafka-sasl-mechanism value Kafka sasl mechanism' to be used as configuration for logging [$LOG_KAFKA_SASL_MECHANISM] + --log-kafka-sasl-username value Kafka sasl username' to be used as configuration for logging [$LOG_KAFKA_SASL_USERNAME] + --log-kafka-sasl-password value Kafka sasl password' to be used as configuration for logging [$LOG_KAFKA_SASL_PASSWORD] + --version, -v print the version ``` diff --git a/docs/404.html b/docs/404.html index 86c9e19..f8df1ab 100644 --- a/docs/404.html +++ b/docs/404.html @@ -9,15 +9,15 @@ 404 Page not found - - - - - - - + + + + + + + - + + + + + + + + + + + + + + +
+
+
+ +
+
+ + + + + + + + + + +
+
+ +
+
+ + +
+
+ +
+ +
+ +
+ +

+ + carve +

+ + + + + + +

Carve

+
$ ./osctrl-cli carve -h
+NAME:
+   osctrl-cli carve - Commands for file carves
+
+USAGE:
+   osctrl-cli carve command [command options] [arguments...]
+
+COMMANDS:
+   complete, c      Mark an file carve query as completed
+   delete, d        Mark a file carve query as deleted
+   expire, e        Mark a file carve query as expired
+   run, r           Start a new carve for a file or a directory
+   list, l          List file carves
+   list-queries, l  List file carves queries
+   help, h          Shows a list of commands or help for one command
+
+OPTIONS:
+   --help, -h  show help
+

Complete carve

+
$ ./osctrl-cli carve complete -h
+NAME:
+   osctrl-cli carve complete - Mark an file carve query as completed
+
+USAGE:
+   osctrl-cli carve complete [command options] [arguments...]
+
+OPTIONS:
+   --name value, -n value  Carve name to be completed
+   --env value, -e value   Environment to be used
+   --help, -h              show help
+

Delete carve

+
$ ./osctrl-cli carve delete -h
+NAME:
+   osctrl-cli carve delete - Mark a file carve query as deleted
+
+USAGE:
+   osctrl-cli carve delete [command options] [arguments...]
+
+OPTIONS:
+   --name value, -n value  Carve name to be deleted
+   --env value, -e value   Environment to be used
+   --help, -h              show help
+

Expire carve

+
$ ./osctrl-cli carve expire -h
+NAME:
+   osctrl-cli carve expire - Mark a file carve query as expired
+
+USAGE:
+   osctrl-cli carve expire [command options] [arguments...]
+
+OPTIONS:
+   --name value, -n value  Carve name to be expired
+   --env value, -e value   Environment to be used
+   --help, -h              show help
+

Run carve

+
$ ./osctrl-cli carve run -h
+NAME:
+   osctrl-cli carve run - Start a new carve for a file or a directory
+
+USAGE:
+   osctrl-cli carve run [command options] [arguments...]
+
+OPTIONS:
+   --path value, -p value        File or directory path to be carved
+   --env value, -e value         Environment to be used
+   --uuid value, -u value        Node UUID to be used
+   --expiration value, -E value  Expiration in hours (0 for no expiration) (default: 6)
+   --help, -h                    show help
+

List carves

+
$ ./osctrl-cli carve list -h
+NAME:
+   osctrl-cli carve list - List file carves
+
+USAGE:
+   osctrl-cli carve list [command options] [arguments...]
+
+OPTIONS:
+   --env value, -e value  Environment to be used
+   --help, -h             show help
+

List carve queries

+
$ ./osctrl-cli carve list-queries -h
+NAME:
+   osctrl-cli carve list-queries - List file carves queries
+
+USAGE:
+   osctrl-cli carve list-queries [command options] [arguments...]
+
+OPTIONS:
+   --all, -A              Show all file carves queries (default: false)
+   --active, -a           Show active file carves queries (default: false)
+   --completed, -c        Show completed file carves queries (default: false)
+   --expired, -E          Show expired file carves queries (default: false)
+   --deleted, -d          Show deleted file carves queries (default: false)
+   --env value, -e value  Environment to be used
+   --help, -h             show help
+
+ + + + +
+ +
+ + +
+ + +
+ + + +
+ +
+
+
+ + + + + + + + + + + + + + + + + + diff --git a/docs/usage/osctrl-cli/check/index.xml b/docs/usage/osctrl-cli/carve/index.xml similarity index 58% rename from docs/usage/osctrl-cli/check/index.xml rename to docs/usage/osctrl-cli/carve/index.xml index 3e601bb..1b2259b 100644 --- a/docs/usage/osctrl-cli/check/index.xml +++ b/docs/usage/osctrl-cli/carve/index.xml @@ -1,12 +1,12 @@ - check on osctrl: Fast and efficient osquery management - https://osctrl.net/usage/osctrl-cli/check/ - Recent content in check on osctrl: Fast and efficient osquery management + carve on osctrl: Fast and efficient osquery management + https://osctrl.net/usage/osctrl-cli/carve/ + Recent content in carve on osctrl: Fast and efficient osquery management Hugo en-us - + diff --git a/docs/usage/osctrl-cli/check-api/index.html b/docs/usage/osctrl-cli/check-api/index.html new file mode 100644 index 0000000..c58775e --- /dev/null +++ b/docs/usage/osctrl-cli/check-api/index.html @@ -0,0 +1,1783 @@ + + + + + + + + + + + + check-api :: osctrl: Fast and efficient osquery management + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ +
+
+ + + + + + + + + + +
+
+ +
+
+ + +
+
+ +
+ +
+ +
+ +

+ + check-api +

+ + + + + + +

Check

+
$ ./osctrl-cli check-api -h
+NAME:
+   osctrl-cli check-api - Checks API token
+
+USAGE:
+   osctrl-cli check-api [command options] [arguments...]
+
+OPTIONS:
+   --help, -h  show help
+

Although this command may appear a bit confusing, it comes in really handy to verify when the osctrl-api component is ready to go and the validity of a token.

+ + + + + +
+ +
+ + +
+ + +
+ + + +
+ +
+
+
+ + + + + + + + + + + + + + + + + + diff --git a/docs/usage/osctrl-cli/check-api/index.xml b/docs/usage/osctrl-cli/check-api/index.xml new file mode 100644 index 0000000..68513aa --- /dev/null +++ b/docs/usage/osctrl-cli/check-api/index.xml @@ -0,0 +1,12 @@ + + + + check-api on osctrl: Fast and efficient osquery management + https://osctrl.net/usage/osctrl-cli/check-api/ + Recent content in check-api on osctrl: Fast and efficient osquery management + Hugo + en-us + + + + diff --git a/docs/usage/osctrl-cli/check/index.html b/docs/usage/osctrl-cli/check-db/index.html similarity index 86% rename from docs/usage/osctrl-cli/check/index.html rename to docs/usage/osctrl-cli/check-db/index.html index cb43dd4..8334946 100644 --- a/docs/usage/osctrl-cli/check/index.html +++ b/docs/usage/osctrl-cli/check-db/index.html @@ -3,30 +3,30 @@ - + - check :: osctrl: Fast and efficient osquery management + check-db :: osctrl: Fast and efficient osquery management - - - - - - - - - + + + + + + + + + - + - + - +