From 585e48d5056d7c9dc94ccc9dbf760c453df16461 Mon Sep 17 00:00:00 2001 From: Maxime Lamothe-Brassard Date: Tue, 1 Sep 2026 20:57:52 -0700 Subject: [PATCH] task: document the new sensor taskings, and fix two broken examples The CLI does not parse or validate the task string -- it forwards it to the backend verbatim -- so dir_find, file_grep, container_list and artifact_get --root-dir already work today. This is documentation only. Add them to the 'task send' command menu, which also feeds --ai-help via the explain registry, and note the budget convention: a bounded search stops at the first budget reached and says so in SCAN_IS_TRUNCATED and SCAN_STOPPED_REASON, so an empty result is not necessarily a clean host. Point the reader at the backend reference for the full flag set rather than inlining ~15 flags per command, since this menu has never carried flags and the backend is the authority on them. Two pre-existing bugs in the same lines, both verified against the actual Click options: - The incident-response cheatsheet told users to pass --args to 'task send', which accepts only --sid, --task and --investigation-id. Both examples errored out. Rewritten as task strings, matching the form the reference documentation uses. - doc/cli/sensor-management.md used 'task send --command'. 'send' takes --task; --command belongs to 'request' and 'reliable-send'. Verified: 4005 passed, 5 skipped. --- doc/cli/sensor-management.md | 2 +- limacharlie/commands/task.py | 15 ++++++++++++++- limacharlie/help_topics.py | 5 +++-- 3 files changed, 18 insertions(+), 4 deletions(-) diff --git a/doc/cli/sensor-management.md b/doc/cli/sensor-management.md index 2c757c68..c0068fcb 100644 --- a/doc/cli/sensor-management.md +++ b/doc/cli/sensor-management.md @@ -46,7 +46,7 @@ limacharlie endpoint-policy unseal --sid SENSOR_ID ## task ```bash -limacharlie task send --sid SENSOR_ID --command os_processes +limacharlie task send --sid SENSOR_ID --task os_processes limacharlie task request --sid SENSOR_ID --command os_processes # Wait for response limacharlie task reliable-send --sid SENSOR_ID --command os_processes limacharlie task reliable-list --sid SENSOR_ID diff --git a/limacharlie/commands/task.py b/limacharlie/commands/task.py index f3fe6704..7cdef337 100644 --- a/limacharlie/commands/task.py +++ b/limacharlie/commands/task.py @@ -78,6 +78,8 @@ def group() -> None: File system: dir_list - List a directory + dir_find - Find files by size, mtime or hash (bounded) + file_grep -p - Search file contents for a literal (bounded) file_get - Retrieve a file as artifact file_del - Delete a file file_hash - Get hash of a file @@ -98,7 +100,8 @@ def group() -> None: Scanning: yara_scan - YARA scan a file or directory - artifact_get - Collect an artifact (file/log) + artifact_get --file - Collect one file as an artifact + artifact_get --root-dir

- Collect many files as artifacts (bounded) System info: os_version - Get OS version info @@ -106,6 +109,16 @@ def group() -> None: os_autoruns - List autorun entries os_users - List local user accounts (Win) history_dump - Dump recent telemetry + container_list - List containers and images (Linux only) + +The commands marked (bounded) stop at whichever budget is reached first +and report that in the reply via SCAN_IS_TRUNCATED and +SCAN_STOPPED_REASON, so an empty result is not necessarily a clean host. +Widen with --depth, --limit, --max-seconds and --max-files-scanned. + +This list is not exhaustive. The task string is parsed by the backend, +not by this CLI, so the full and current set of commands and flags is +documented at https://docs.limacharlie.io/8-reference/endpoint-commands. This command does not wait for a response. To see results, use 'limacharlie task request' (synchronous) or 'limacharlie stream events'. diff --git a/limacharlie/help_topics.py b/limacharlie/help_topics.py index 389b3f1b..c83fd817 100644 --- a/limacharlie/help_topics.py +++ b/limacharlie/help_topics.py @@ -715,8 +715,9 @@ # Send investigative tasks limacharlie task send --sid --task os_processes limacharlie task send --sid --task os_services -limacharlie task send --sid --task dir_list --args '{"rootDir":"C:\\\\Users"}' -limacharlie task send --sid --task file_hash --args '{"filePath":"C:\\\\suspect.exe"}' +limacharlie task send --sid --task 'dir_list "C:\\\\Users" "*.exe"' +limacharlie task send --sid --task 'file_hash "C:\\\\suspect.exe"' +limacharlie task send --sid --task 'file_grep "C:\\\\Users" -p "" --no-content' # Search for IOCs limacharlie ioc search --type file_hash --value