environment
Environment
$ ./osctrl-cli environment -h
NAME:
osctrl-cli environment - Commands for TLS environment
USAGE:
osctrl-cli environment command [command options] [arguments...]
COMMANDS:
add, a Add a new TLS environment
update, u Update an existing TLS environment
add-scheduled-query Add a new query to the osquery schedule for an environment
remove-scheduled-query Remove query from the osquery schedule for an environment
add-osquery-option Add or change an osquery option to the configuration
remove-osquery-option Remove an option for the osquery configuration
add-new-pack Add a new query pack to the osquery configuration
add-local-pack Add a new local query pack to the osquery configuration
remove-pack Remove query pack from the osquery configuration
add-query-to-pack Add a new query to the given query pack
remove-query-from-pack Remove query from the given query pack
delete, d Delete an existing TLS environment
show, s Show a TLS environment
show-flags, w Show the flags for a TLS environment
gen-flags, g Generate and save the flags for a TLS environment
list, l List all existing TLS environments
quick-add, q Generates one-liner for quick adding nodes to environment
flags, f Generates the flags to run nodes in an environment
secret, x Output the secret to enroll nodes in an environment
help, h Shows a list of commands or help for one command
OPTIONS:
--help, -h show help
Add environment
$ ./osctrl-cli environment add -h
NAME:
osctrl-cli environment add - Add a new TLS environment
USAGE:
osctrl-cli environment add [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be added
--hostname value, --host value Environment host to be added
--debug, -d Environment debug capability (default: false)
--certificate value, --crt value Certificate file to be read
--help, -h show help
Update environment
$ ./osctrl-cli environment update -h
NAME:
osctrl-cli environment update - Update an existing TLS environment
USAGE:
osctrl-cli environment update [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be updated
--debug, -d Environment debug capability (default: false)
--enroll, -e Environment enroll capability (default: false)
--hostname value, --host value Environment host to be updated
--logging value, -l value Logging interval in seconds (default: 0)
--config value, -c value Config interval in seconds (default: 0)
--query value, -q value Query interval in seconds (default: 0)
--help, -h show help
Add scheduled query to environment
$ ./osctrl-cli environment add-scheduled-query -h
NAME:
osctrl-cli environment add-scheduled-query - Add a new query to the osquery schedule for an environment
USAGE:
osctrl-cli environment add-scheduled-query [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be updated
--query value, -q value Query to be added to the schedule
--query-name value, -Q value Query name to be idenfified in the schedule
--interval value, -i value Query interval in seconds (default: 0)
--platform value, -p value Restrict this query to a given platform
--version value, -v value Only run on osquery versions greater than or equal-to this version
--help, -h show help
Remove scheduled query from environment
$ ./osctrl-cli environment remove-scheduled-query -h
NAME:
osctrl-cli environment remove-scheduled-query - Remove query from the osquery schedule for an environment
USAGE:
osctrl-cli environment remove-scheduled-query [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be updated
--query-name value, -q value Query to be removed from the schedule
--help, -h show help
Add osquery option to environment
$ ./osctrl-cli environment add-osquery-option -h
NAME:
osctrl-cli environment add-osquery-option - Add or change an osquery option to the configuration
USAGE:
osctrl-cli environment add-osquery-option [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be updated
--option value, -o value Option name to be added
--type value, -t value Option type for the value (string, int, bool)
--string-value value, -s value String value for the option
--int-value value, -i value Integer value for the option (default: 0)
--bool-value, -b Boolean value for the option (default: false)
--help, -h show help
Remove osquery option from environment
$ ./osctrl-cli environment remove-osquery-option -h
NAME:
osctrl-cli environment remove-osquery-option - Remove an option for the osquery configuration
USAGE:
osctrl-cli environment remove-osquery-option [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be updated
--option value, -o value Option name to be added
--help, -h show help
Add query pack to environment
$ ./osctrl-cli environment add-new-pack -h
NAME:
osctrl-cli environment add-new-pack - Add a new query pack to the osquery configuration
USAGE:
osctrl-cli environment add-new-pack [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be updated
--pack value, -p value Pack name to be added
--platform value, -P value Restrict this pack to a given platform
--version value, -v value Only run on osquery versions greater than or equal-to this version
--shard value, -s value Restrict this query to a percentage (1-100) of target hosts (default: 0)
--help, -h show help
Add local query pack to environment
$ ./osctrl-cli environment add-local-pack -h
NAME:
osctrl-cli environment add-local-pack - Add a new local query pack to the osquery configuration
USAGE:
osctrl-cli environment add-local-pack [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be updated
--pack value, -p value Pack name to be added
--pack-path value, -P value Local full path to load the query pack within osquery
--help, -h show help
Remove query pack from environment
$ ./osctrl-cli environment remove-pack -h
NAME:
osctrl-cli environment remove-pack - Remove query pack from the osquery configuration
USAGE:
osctrl-cli environment remove-pack [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be updated
--pack value, -p value Pack name to be removed
--help, -h show help
Add query to pack in environment
$ ./osctrl-cli environment add-query-to-pack -h
NAME:
osctrl-cli environment add-query-to-pack - Add a new query to the given query pack
USAGE:
osctrl-cli environment add-query-to-pack [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be updated
--pack value, -p value Environment to be updated
--query value, -q value Query to be added to the pack
--query-name value, -Q value Query name to be added to the pack
--interval value, -i value Query interval in seconds (default: 0)
--platform value, -P value Restrict this query to a given platform
--version value, -v value Only run on osquery versions greater than or equal-to this version
--help, -h show help
Remove query from pack in environment
$ ./osctrl-cli environment remove-query-from-pack -h
NAME:
osctrl-cli environment remove-query-from-pack - Remove query from the given query pack
USAGE:
osctrl-cli environment remove-query-from-pack [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be updated
--pack value, -p value Pack name to be updated
--query-name value, -q value Query name to be removed
--help, -h show help
Delete environment
$ ./osctrl-cli environment delete -h
NAME:
osctrl-cli environment delete - Delete an existing TLS environment
USAGE:
osctrl-cli environment delete [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be deleted
--help, -h show help
Show environment
$ ./osctrl-cli environment show -h
NAME:
osctrl-cli environment show - Show a TLS environment
USAGE:
osctrl-cli environment show [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be displayed
--help, -h show help
Show environment flags
$ ./osctrl-cli environment show-flags -h
NAME:
osctrl-cli environment show-flags - Show the flags for a TLS environment
USAGE:
osctrl-cli environment show-flags [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be displayed
--help, -h show help
Re-generate and update environment flags
$ ./osctrl-cli environment gen-flags -h
NAME:
osctrl-cli environment gen-flags - Generate and save the flags for a TLS environment
USAGE:
osctrl-cli environment gen-flags [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be displayed
--help, -h show help
List environments
$ ./osctrl-cli environment list -h
NAME:
osctrl-cli environment list - List all existing TLS environments
USAGE:
osctrl-cli environment list [command options] [arguments...]
OPTIONS:
--help, -h show help
Quick-add to environment
$ ./osctrl-cli environment quick-add -h
NAME:
osctrl-cli environment quick-add - Generates one-liner for quick adding nodes to environment
USAGE:
osctrl-cli environment quick-add [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be used
--target value, -t value Type of one-liner (default: "sh")
--insecure, -i Generate insecure one-liner (default: false)
--help, -h show help
Flags
$ ./osctrl-cli environment flags -h
NAME:
osctrl-cli environment flags - Generates the flags to run nodes in an environment
USAGE:
osctrl-cli environment flags [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be used
--certificate value, --crt value Certificate path to be used
--secret value, -s value Secret file path to be used
--help, -h show help
Secret
$ ./osctrl-cli environment secret -h
NAME:
osctrl-cli environment secret - Output the secret to enroll nodes in an environment
USAGE:
osctrl-cli environment secret [command options] [arguments...]
OPTIONS:
--name value, -n value Environment name to be used
--help, -h show help