eyeInspect Content Distributor v1.0.0 Commands

• Sensor Query Commands
• Engine Query Commands
• Distribution Commands
• Distribution Configuration Commands

• Distribution Commands
• Distribution Configuration Commands

• Distribution Commands

help

Exits the shell

--help or -h (this is an optional argument, it displays the help options for cc list)

eyeinspect:> cc list
Command Center address=<CC_IP_Address>, hostname=<command_center_hostname>, version=<command_center_version>, username=admin, status=Connected

eyeinspect:>cc list --refresh
*** Checking connectivity status of Command Centers ***
Successfully connected to Command Center at <CC_IP_Address>
*** Connectivity status of Command Centers checked ***
 
Command Center address=<CC_IP_Address>, hostname=<command_center_hostname>, version=<command_center_version>, username=admin, status=Connected

Confirmation message:

• Do you confirm that the configuration of Command Center with ip $ip will be deleted? Y/n

Output:

• Configuration of Command Center with ip $ip has been deleted.
• Configuration of Command Center with ip $ip does not exist.

eyeinspect:> cc delete --address <CC_IP_Address>
? Do you confirm that the configuration of Command Center with address <CC_IP_Address> will be deleted? true
Configuration of Command Center with address <CC_IP_Address> has been deleted.

--address: Command Center address

--username: Command Center username

--port: Command Center port [Default: HTTPS(443)] [Optional]

Password input:

? Enter password for $username ********

Output:

Configuration of Command Center with ip $ip is added

eyeinspect :> cc add --address <CC_IP_Address> --username cdm-cli
Enter password for cdm- cli ********
Configuration of Command Center with address <CC_IP_Address> is added.

cc change-password

Password input:

? Enter password for $username ********

Output:

Password for Command Center with ip $ip is updated.

Example:

eyeinspect:> cc change-password --address <CC_IP_Address>
? Enter password for cdm-cli ********
Password for Command Center with address <CC_IP_Address> is updated.

? Select content type to distribute:(List of supported content types.)

? Select a content file to be distributed:(List of content files based on the selected type)

? Select Command Centers:(List of Command Centers added to CLI tool)

? Input task template name(Default value will be selected content file name without extension)

eyeinspect:> template create
? Select content type to distribute: SD_SCRIPT
? Select content file to be distributed: <file_name.zip>
? Select Command Centers: <CC_IP_Address>
? Input task template name: <task_template_name>
The content distribution task template is saved to the file <file_name.json>.
The sensor list can be modified and the distribution task can be initiated by calling ‘distribute from-template <file_name.json>‘

The list of content distribution task template files:

$template-filename-1

$template-filename-2

The sensor list can be modified and the distribution task can be initiated by calling `distribute from-template <template-file>

eyeinspect:> template list
The list of content distribution task template files:
<file_name.json>
The sensor list can be modified and the distribution task can be initiated by calling 'distribute from-template <template_file>'

--address: Command Center address

--sensorAddress: Sensor address connected to given Command Center

Sensor id=$id, name=$name, address=$address, version=$sensorVersion, type=$type, state=$state

Sensor Engine id=$id, name=$name, type=$type, state=Active/Paused

Example

eyeinspect:> engine list --address <engine_address> --sensorAddress <sensor_address>
Sensor id=<sensor_id>, name=<sensor_name>, address=<sensor_address>, version=<sensor_version>, type=PASSIVE, state=Active
        Sensor Engine id=<engine_ID>, name=<file_name>, type=SDSCRIPT, state=Active
        Sensor Engine id=<engine_ID>, name=<file_name>, type=SDSCRIPT, state=Active

Output:

• No engines are found with i-like name $engineILikeName
• # engines are found with i-like name $engineILikeName Sensor Address=$sensorAddress / Sensor Engine id=$id, name=$name, type=$type, state=Active/Paused

Example

eyeinspect:> engine search threat
1 engines are found with i-like name threat
<engine_name> Sensor Address=<sensor_address> / Sensor Engine id=<engine_ID>, name=<file_name>, type=SDSCRIPT, state=Paused

--address: Command Center address

--sensorAddress: Sensor address connected to given Command Center

--engineId: Engine identifier

--sensorId: Sensor identifier (Optional except in bundled configurations - see note above table)

Example

eyeinspect:> engine backup --address <engine_address> --sensorAddress <sensor_address> --engineld <engine_ID>
Engine backed up to file <file_name.profile>

--address: Command Center address

--sensorAddress: Sensor address connected to given Command Center

--fileName: Filename of .profile file

--sensorId: Sensor identifier (Optional except in bundled configurations - see note above table)

Example

eyeinspect:> engine add --address <engine_address> --sensorAddress <sensor_address> --fileName "/home/silentdefense/base/export/engine/<file_name.profile>"
Engine imported: Sensor Engine id=<engine_ID>, name=<file_name>, type=SDSCRIPT, state=Paused

--address: Command Center address

--sensorAddress: Sensor address connected to given Command Center

--engineId: Engine identifier

--sensorId: Sensor identifier (Optional except in bundled configurations - see note above table)

Example

eyeinspect:> engine delete --address <engine_address> --sensorAddress <sensor_address> --engineId <engine_ID>
Engine deleted: Sensor Engine id=<engine_ID>, name=<file_name>, type=SDSCRIPT, state=Active

--address: Command Center address

--sensorAddress: Sensor address connected to given Command Center

--engineId: Engine identifier

--sensorId: Sensor identifier (Optional except in bundled configurations - see note above table )

Example

eyeinspect:> engine start --address <engine_address> --sensorAddress <sensor_address> --engineId <engine_ID>
Engine started: Sensor Engine id=<engine_ID>, name=<file_name>, type=SDSCRIPT, state=Active

--address: Command Center address

--sensorAddress: Sensor address connected to given Command Center

--engineId: Engine identifier

--sensorId: Sensor identifier (Optional except in bundled configurations - see note above table)

Example

eyeinspect:> engine pause --address <engine_address> --sensorAddress <sensor_address> --engineId <engine_ID>
Engine paused: Sensor Engine id=<engine_ID>, name=<file_name>, type=SDSCRIPT, state=Paused

eyeinspect:> sensor list --address <sensor_address>
Sensor id=<sensor_ID>, name=<sensor name>, address=<sensor_address>, version=<sensor_version>, type=PASSIVE, state=Active

? Select content type to distribute:(List of supported content types.)

? Select a content file to be distributed:(List of content files based on the selected type.)

? Select Command Centers:(List of Command Centers added to CLI tool)

? Given content will be distributed to selected Command Centers and older content will be removed from the Command Centers. Do you confirm?(Ask for confirmation. Positive confirmation input: Y/n)

Positive confirmation:

Negative confirmation:

Content distribution task can be initiated by executing the command distribute with-params $taskType $contentFilePath ${selectedCommandCenterIPs.joinToString(separator = ",")}

Example:

eyeinspect:> distribute
? Select content type to distribute: CVE_IOC_BUNDLE
? Select content file to be distributed: <file_name.zip>
? Select Command Centers: <CC_IP_Address>
? Given content will be distributed to all sensors connected to selected Command Centers. Do you confirm? true
File successfully distributed to all selected Command Centers.
To know more about the unsuccessful distribution and other details check: <file_name.csv>

--taskType: Distribution task type. Available values: [CVE_IOC_BUNDLE, SD_SCRIPT]

--fileName: File name of the content.

--selectedCommandCenterIPs: Selected comma-separated Command Center IP addresses

CVE_IOC_BUNDLE:

File distribution was successful for {} out of {} selected Command Centers.

For any unsuccessful distributions, a template file ({template-file}) has been created, allowing you to retry the distribution process using the distribute from-template {template-file} command.

Refer to the log file for more details: {csv-log-file}

SD_SCRIPT:

File distribution was successful for {} out of {} selected Command Centers.

Details of failed distributions per Command Center:

Command Center [{address}]: Distribution to (all)/({} out of {}) sensor(s) has failed.

For any unsuccessful distributions, a template file ({template-file}) has been created, allowing you to retry the distribution process using the distribute from-template {template-file} command.

Refer to the log file for more details: {csv-log-file}

Example:

eyeinspect:> distribute with-params --taskType CVE_IOC_BUNDLE --fileName <file_name.zip> --selectedCommandCenterIPs <CC_IP_Address>
File successfully distributed to all selected Command Centers.
To know more about the unsuccessful distribution and other details check: <file_name.csv>

Example:

eyeinspect:> distribute from-template <file_name.json>
File successfully distributed to all selected Command Centers.
To know more about the unsuccessful distribution and other details check: <file_name.csv>