osctrl-cli

osctrl-cli is the CLI for osctrl. Its purpose is to execute actions in osctrl without having to access directly the backend or use the admin interface. It can be very handy to automate actions in scripts or similar.

Execute ./osctrl-cli help to show the main help of the program:

$ ./osctrl-cli help
NAME:
   osctrl-cli - CLI for osctrl

USAGE:
   osctrl-cli [global options] [command [command options]]

DESCRIPTION:
   CLI for osctrl, a fast and efficient osquery management

COMMANDS:
   audit-logs        Get all audit logs for actions performed in osctrl
   carve             Commands for file carves
   check-api         Checks API token
   check-db          Checks DB connection
   environment, env  Commands for TLS environment
   login             Login into API and generate JSON config file with token
   node              Commands for nodes
   query             Commands for queries
   settings          Commands for settings
   tag               Commands for tags
   user              Commands for users
   help, h           Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --db, -d                           Connect to local osctrl DB using YAML config file [$DB_CONFIG]
   --api, -a                          Connect to remote osctrl using JSON config file [$API_CONFIG]
   --api-file FILE, -A FILE           Load API JSON configuration from FILE (default: "osctrl-api.json") [$API_CONFIG_FILE]
   --api-url string, -U string        The URL for osctrl API to be used [$API_URL]
   --api-token string, -T string      Token to authenticate with the osctrl API [$API_TOKEN]
   --db-file FILE, -D FILE            Load DB YAML configuration from FILE [$DB_CONFIG_FILE]
   --db-host string                   Backend host to be connected to (default: "127.0.0.1") [$DB_HOST]
   --db-port int                      Backend port to be connected to (default: 5432) [$DB_PORT]
   --db-name string                   Database name to be used in the backend (default: "osctrl") [$DB_NAME]
   --db-user string                   Username to be used for the backend (default: "postgres") [$DB_USER]
   --db-pass string                   Password to be used for the backend (default: "postgres") [$DB_PASS]
   --db-max-idle-conns int            Maximum number of connections in the idle connection pool (default: 20) [$DB_MAX_IDLE_CONNS]
   --db-max-open-conns int            Maximum number of open connections to the database (default: 100) [$DB_MAX_OPEN_CONNS]
   --db-conn-max-lifetime int         Maximum amount of time a connection may be reused (default: 30) [$DB_CONN_MAX_LIFETIME]
   --insecure, -i                     Allow insecure server connections when using SSL
   --verbose, -V                      Increase output verbosity for debugging
   --output-format string, -o string  Format to be used for data output (default: "pretty") [$OUTPUT_FORMAT]
   --silent, -s                       Silent mode
   --version, -v                      Print version information
   --help, -h                         show help

Each command has its own help and it is displayed appending -h to them. Each subcommand has its own help as well.