diff --git a/doc/cli/sensor-management.md b/doc/cli/sensor-management.md index 2c757c68..c0068fcb 100644 --- a/doc/cli/sensor-management.md +++ b/doc/cli/sensor-management.md @@ -46,7 +46,7 @@ limacharlie endpoint-policy unseal --sid SENSOR_ID ## task ```bash -limacharlie task send --sid SENSOR_ID --command os_processes +limacharlie task send --sid SENSOR_ID --task os_processes limacharlie task request --sid SENSOR_ID --command os_processes # Wait for response limacharlie task reliable-send --sid SENSOR_ID --command os_processes limacharlie task reliable-list --sid SENSOR_ID diff --git a/limacharlie/commands/task.py b/limacharlie/commands/task.py index f3fe6704..7cdef337 100644 --- a/limacharlie/commands/task.py +++ b/limacharlie/commands/task.py @@ -78,6 +78,8 @@ def group() -> None: File system: dir_list - List a directory + dir_find - Find files by size, mtime or hash (bounded) + file_grep -p - Search file contents for a literal (bounded) file_get - Retrieve a file as artifact file_del - Delete a file file_hash - Get hash of a file @@ -98,7 +100,8 @@ def group() -> None: Scanning: yara_scan - YARA scan a file or directory - artifact_get - Collect an artifact (file/log) + artifact_get --file - Collect one file as an artifact + artifact_get --root-dir

- Collect many files as artifacts (bounded) System info: os_version - Get OS version info @@ -106,6 +109,16 @@ def group() -> None: os_autoruns - List autorun entries os_users - List local user accounts (Win) history_dump - Dump recent telemetry + container_list - List containers and images (Linux only) + +The commands marked (bounded) stop at whichever budget is reached first +and report that in the reply via SCAN_IS_TRUNCATED and +SCAN_STOPPED_REASON, so an empty result is not necessarily a clean host. +Widen with --depth, --limit, --max-seconds and --max-files-scanned. + +This list is not exhaustive. The task string is parsed by the backend, +not by this CLI, so the full and current set of commands and flags is +documented at https://docs.limacharlie.io/8-reference/endpoint-commands. This command does not wait for a response. To see results, use 'limacharlie task request' (synchronous) or 'limacharlie stream events'. diff --git a/limacharlie/help_topics.py b/limacharlie/help_topics.py index 389b3f1b..c83fd817 100644 --- a/limacharlie/help_topics.py +++ b/limacharlie/help_topics.py @@ -715,8 +715,9 @@ # Send investigative tasks limacharlie task send --sid --task os_processes limacharlie task send --sid --task os_services -limacharlie task send --sid --task dir_list --args '{"rootDir":"C:\\\\Users"}' -limacharlie task send --sid --task file_hash --args '{"filePath":"C:\\\\suspect.exe"}' +limacharlie task send --sid --task 'dir_list "C:\\\\Users" "*.exe"' +limacharlie task send --sid --task 'file_hash "C:\\\\suspect.exe"' +limacharlie task send --sid --task 'file_grep "C:\\\\Users" -p "" --no-content' # Search for IOCs limacharlie ioc search --type file_hash --value