Chaitin CLI

# Probes / scanners
chaitin-cli veinmind agent scanner-list --offset 0 --page-size 20 -o json
chaitin-cli veinmind agent scanner-list --state 2 --host-ip <ip> -o json

# Image and container inventory
chaitin-cli veinmind img list --offset 0 --page-size 20 --risk 5 -o json
chaitin-cli veinmind img base-info --id <image-list-id> -o json
chaitin-cli veinmind container list --offset 0 --page-size 20 --state 3 --risk 4 -o json
chaitin-cli veinmind container get --id <container-list-id> -o json

# Kubernetes and host inventory
chaitin-cli veinmind cluster cluster-list --offset 0 --page-size 20 --status 1 -o json
chaitin-cli veinmind cluster pod-list --cluster-id <cluster-id> --offset 0 --page-size 20 -o json
chaitin-cli veinmind host list --offset 0 --page-size 20 --name <host-name> -o json

# Software, web site, and web framework assets
chaitin-cli veinmind app agg-list --offset 0 --page-size 20 --name nginx -o json
chaitin-cli veinmind website list --offset 0 --page-size 20 --container-name <container-name> -o json
chaitin-cli veinmind web-framework list --offset 0 --page-size 20 --name spring -o json

# Baseline metadata and events
chaitin-cli veinmind baseline meta -o json
chaitin-cli veinmind baseline events --set-id <set-id> --item-id <item-id> --offset 0 --page-size 20 -o json

# Risk events
chaitin-cli veinmind risk real-time-event-list -o json
chaitin-cli veinmind risk container-webshell-list --offset 0 --page-size 20 --risk 5 --manage-status 1 -o json
chaitin-cli veinmind risk container-malicious-file-list --offset 0 --page-size 20 --risk 5 -o json
chaitin-cli veinmind risk container-revshell-event-list --offset 0 --page-size 20 --risk 4 -o json
chaitin-cli veinmind risk event-info --event-type 8 --id <event-id> -o json

# Inspect the request shape before changing event status
chaitin-cli --dry-run veinmind risk batch-tag-events --body-file /tmp/veinmind-event-status.json -v -o json

# Inspect the request shape before container / Pod response actions
chaitin-cli --dry-run veinmind risk container-op --body-file /tmp/veinmind-container-op.json -v -o json

safeline-ce:
  url: https://your-safeline-ce-server:9443
  api_key: YOUR_API_KEY

SAFELINE_CE_URL=https://your-safeline-ce-server:9443
SAFELINE_CE_API_KEY=YOUR_API_KEY

chaitin-cli safeline-ce stat overview        # Aggregated stats: QPS, access, intercept counts

chaitin-cli safeline-ce site list            # List all web services
chaitin-cli safeline-ce site create          # Create a web service
chaitin-cli safeline-ce site update          # Update a web service
chaitin-cli safeline-ce site delete          # Delete a web service

chaitin-cli safeline-ce rule list            # List all custom rules
chaitin-cli safeline-ce rule create          # Create a custom rule
chaitin-cli safeline-ce rule update          # Update a custom rule
chaitin-cli safeline-ce rule delete          # Delete a custom rule
chaitin-cli safeline-ce rule switch          # Enable or disable a custom rule

chaitin-cli safeline-ce ipgroup list         # List all IP groups
chaitin-cli safeline-ce ipgroup get          # Get IP group details
chaitin-cli safeline-ce ipgroup create       # Create an IP group
chaitin-cli safeline-ce ipgroup update       # Update an IP group
chaitin-cli safeline-ce ipgroup delete       # Delete an IP group
chaitin-cli safeline-ce ipgroup append       # Add IPs to an IP group

chaitin-cli safeline-ce log attack list      # List attack logs
chaitin-cli safeline-ce log attack get       # Get attack log detail by ID
chaitin-cli safeline-ce log rule list        # List rule-triggered attack logs
chaitin-cli safeline-ce log rule get         # Get rule-triggered attack log detail
chaitin-cli safeline-ce log audit list       # Get audit logs

chaitin-cli safeline-ce skynet get           # Get enhanced rule configuration
chaitin-cli safeline-ce skynet update        # Update enhanced rule configuration
chaitin-cli safeline-ce skynet switch get    # Get global enable status of enhanced rules
chaitin-cli safeline-ce skynet switch set    # Enable or disable enhanced rules globally

chaitin-cli safeline-ce module get           # Get global semantics mode
chaitin-cli safeline-ce module update        # Update global semantics mode

chaitin-cli safeline-ce cert info            # Get system info
chaitin-cli safeline-ce cert get             # Get license info
chaitin-cli safeline-ce cert update          # Update management certificate

chaitin-cli ddr device list --accept application/json --accept-language zh --content-type application/json --if-none-match '' --x-cs-header-crypt none --x-cs-header-debug false --x-cs-header-timezone Asia/Shanghai -o json --search PC-000006 --limit 20 --page 1

{
  "file_size_lower_measure": "MB",
  "file_size_lower": 0,
  "file_size_upper_measure": "MB",
  "file_size_upper": 100,
  "name": "2222-1",
  "description": "3222",
  "scope": "common",
  "include": [
    {
      "name": "PC-000341",
      "id": "62515059-0700-46a8-8441-bb75413e75de",
      "type": "device",
      "expand": {
        "ip": "192.168.96.247",
        "code": "PC-000341",
        "username": "orange@orangedeMacBook-Pro",
        "os_icon": ["macOS"],
        "status": "activated",
        "conn_status": "online",
        "agent_version": "3.9.100",
        "tags": []
      }
    }
  ],
  "frequency": "immediately",
  "worktime_point": [
    {"begin": "00:00", "end": "23:59", "week": 1},
    {"begin": "00:00", "end": "23:59", "week": 2},
    {"begin": "00:00", "end": "23:59", "week": 3},
    {"begin": "00:00", "end": "23:59", "week": 4},
    {"begin": "00:00", "end": "23:59", "week": 5},
    {"begin": "00:00", "end": "23:59", "week": 6},
    {"begin": "00:00", "end": "23:59", "week": 7}
  ],
  "scan_mode": "custom",
  "dirs_scan_options": {
    "Windows": [{"path": "C:\\Users"}, {"path": "D:\\"}, {"path": "E:\\"}],
    "macOS": [{"path": "/tmp/123"}],
    "Linux": [{"path": "/home"}, {"path": "/data"}],
    "Kylin": [{"path": "/home"}, {"path": "/data"}],
    "UOS": [{"path": "/home"}, {"path": "/data"}]
  },
  "scan_all_das": true,
  "expand": {"web": {"file_size_operator": "lt", "file_size_num": 100, "file_size_unit": "MB"}},
  "file_scan_mode": "speed",
  "advanced_option": false,
  "binding_config": {
    "source": "file_scan",
    "include": {"device_ids": ["62515059-0700-46a8-8441-bb75413e75de"]},
    "exclude": {}
  },
  "file_exclude_ids": [],
  "file_include_ids": [],
  "custom_whitelist": [],
  "notification_config": [],
  "governance_id": null
}

chaitin-cli ddr device filescantask --body "$(cat /tmp/ddr-filescantask.json)"

chaitin-cli ddr device filescantask list --body '{"page": 1, "limit": 1, "search": ""}' -o json

chaitin-cli ddr disposal approvalinstance list --page 1 --limit 10 --search "" -o json

chaitin-cli ddr policylog channel list --page 1 --limit 20 --search "" -o json

chaitin-cli ddr policylog softwarenetwork list --page 1 --limit 20 --search "" -o json

./bin/chaitin-cli ddr device status-action --device-id <device uuid> --operation uninstall

chaitin-cli ddr device filescantask list  # 终端扫描任务列表
chaitin-cli ddr device filescantask get --task-id <task id> # 终端扫描任务结果详情
chaitin-cli ddr device filescantask instance-device-list --task-id=<task_id> --instance-id=<instance_id> # 拉取扫描设备列表
chaitin-cli ddr device filescantask instance-results-list --task-id=<task_id> --instance-id=<instance_id> # 拉取命中结果列表
chaitin-cli ddr device filescantask remove --task-id=<task_id> # 删除资产扫描任务

chaitin-cli ddr system channeldefgroup list  # 获取渠道列表

chaitin-cli ddr policy list # 外发管控策略列表
chaitin-cli ddr policy channel get --policy-id <policy_id> # 外发管控策略详情


chaitin-cli ddr policy channel --body='{"mode":"quick","name":"<name>","policy_group_ids":["<policy_group_id>"],"description":"222","risk_level":3,"scope":"common","expression_fields":[{"field":"channel","operator":"contains","value":["<channel_id>"]},{"field":"file_size_limit_mb","operator":"gt","value":10}],"action":"approval","action_template_id":"<action_template_id>","binding_config":{"source":"channel","include":{"device_ids":["<device_id>"]},"exclude":{}}}' # 创建外发管控策略 body 内容建议创建临时文件，避免转移问题, <name> 替换为策略名称, <policy_group_id> 替换为策略组ID, <channel_id> 替换为渠道ID, <device_id> 替换为设备ID, <action_template_id> 替换为动作模板ID

{"mode":"quick","name":"<name>","policy_group_ids":["0f2ad6aa-d1cc-4a4e-a0b0-3bd749579868"],"description":"222","risk_level":3,"scope":"common","expression_fields":[{"field":"channel","operator":"contains","value":["6509b799-78e7-4ede-9af4-2c743897e6c6"]},{"field":"file_size_limit_mb","operator":"gt","value":10}],"action":"approval","action_template_id":"90144b18-e9d2-49ad-9c1d-cef0a4146ccc","binding_config":{"source":"channel","include":{"device_ids":["ebf62d82-f02b-4805-b6c3-31d1475b8061"]},"exclude":{}}}

chaitin-cli ddr softwaremanager list --page 1 --limit 50 --search "" # 软件管控-软件列表
chaitin-cli ddr softwaremanager software-hash-list --software-hash=<software-hash> --limit=10 --page=1 --search= --body='{"is_pirated":false,"use_default_query":false,"search":"","queries":[]}' # 软件管控-安装详情 <software-hash> 取 软件管控-软件列表 里的 total_view_digest 字段

chaitin-cli ddr system channeldefgroup landing-list -o json # 落盘管控源列表
chaitin-cli ddr policy landing list # 落盘管控列表
chaitin-cli ddr policy landing action --uid <policy_id> --body '{"operation":"activate"}' # 启用落盘管控策略
chaitin-cli ddr policy landing action --uid <policy_id> --body '{"operation":"deactivate"}' # 停用落盘管控策略
chaitin-cli ddr policy landing get --uid <policy_id> # 落盘管控详情
chaitin-cli ddr policy landing remove --uid <policy_id> # 删除落盘管控策略
chaitin-cli ddr policy landing --body-file /tmp/ddr-policy-landing.json # 创建落盘管控策略

{"name":"test_langding","scope":"common","expression_fields":[{"field":"channel","operator":"contains","value":["6509b799-78e7-4ede-9af4-2c743897e6c6"]}],"action":"notify","category":"landing","policy_group_ids":[null],"binding_config":{"source":"landing","include":{"device_ids":["0578ae3e-6369-4cc4-bad6-ff48f1cf6ceb"]},"exclude":{}}}

chaitin-cli ddr system channeldefgroup email-list -o json # 邮件管控源列表
chaitin-cli ddr policy email list -o json # 邮件管控策略列表
chaitin-cli ddr policy email get --uid <policy_id> -o json # 邮件管控策略详情
chaitin-cli ddr policy email action --uid <policy_id> --body '{"operation":"activate"}' # 启用邮件管控策略
chaitin-cli ddr policy email action --uid <policy_id> --body '{"operation":"deactivate"}' # 停用邮件管控策略
chaitin-cli ddr policy email remove --uid <policy_id> # 删除邮件管控策略
chaitin-cli ddr policy email --body-file /tmp/ddr-policy-email.json # 创建邮件管控策略
chaitin-cli ddr policy email entitywhitelist-list -o json # 邮件管控实体白名单列表
chaitin-cli ddr policylog email timelinelist --body '{"time_range":{"begin":"2023-11-14 10:55:38","end":"2023-11-14 11:55:38"},"search":"","queries":[]}' -o json # 邮件管控时间线
chaitin-cli ddr policylog email stafflist --body '{"time_range":{"begin":"2023-11-14 10:55:38","end":"2023-11-14 11:55:38"},"search":"","queries":[]}' -o json # 邮件管控员工列表

{"name":"邮件策略","description":"策略描述","scope":"global","binding_config":{"source":"email","include":{},"exclude":{}},"action":"notify","expression":"N/A","expression_relation":"all","expression_fields":[{"field":"channel","operator":"contains","value":["all_channels"]}]}

chaitin-cli ddr policy codecontrol list --page 1 --page-size 20 --search "" -o json # 代码管控策略列表
chaitin-cli ddr policy codecontrol get --policy-id <policy_id> -o json # 代码管控策略详情
chaitin-cli ddr policy codecontrol action --policy-id <policy_id> --body '{"operation":"activate"}' # 启用代码管控策略
chaitin-cli ddr policy codecontrol action --policy-id <policy_id> --body '{"operation":"deactivate"}' # 停用代码管控策略
chaitin-cli ddr policy codecontrol remove --policy-id <policy_id> # 删除代码管控策略
chaitin-cli ddr policy codecontrol create --body-file /tmp/ddr-policy-codecontrol.json # 创建代码管控策略
chaitin-cli ddr policy codecontrol update --policy-id <policy_id> --body-file /tmp/ddr-policy-codecontrol.json # 更新代码管控策略
chaitin-cli ddr policy codecontrol configwhitelist-list -o json # 代码管控配置白名单列表
chaitin-cli ddr policy codecontrol controlwhitelist-list -o json # 代码管控管控白名单列表
chaitin-cli ddr policy codecontrol entitywhitelist-list -o json # 代码管控实体白名单列表
chaitin-cli ddr policylog code timelinelist --body '{"time_range":{"begin":"2023-11-14 10:55:38","end":"2023-11-14 11:55:38"},"search":"","queries":[]}' -o json # 代码管控时间线
chaitin-cli ddr policylog code stafflist --body '{"time_range":{"begin":"2023-11-14 10:55:38","end":"2023-11-14 11:55:38"},"search":"","queries":[]}' -o json # 代码管控员工列表
chaitin-cli ddr policylog code download --body '{"time_range":{"begin":"2023-11-14 10:55:38","end":"2023-11-14 11:55:38"},"search":"","queries":[]}' # 代码管控导出

{"name":"代码管控策略","description":"策略描述","scope":"global","period_category":"permanent","period_options":{"period_value":["2023-01-01 00:00:00","2023-01-01 00:00:00"]},"binding_config":{"include":{"device_ids":[],"device_tag_ids":[],"staff_ids":[],"staff_tag_ids":[],"dept_ids":[]},"exclude":{},"source":"code_control"},"control_action":{"category":"upload","expression_fields":{"git":{"left":"repository_url","operator":"contains","value":["github.com/example"]},"svn":{"left":"repository_url","operator":"contains","value":["svn.example.com"]}}},"action":"notify","action_template_id":"<action_template_id>"}

chaitin-cli ddr policy clipboard --body-file /tmp/ddr-policy-clipboard.json # 创建剪贴板管控策略
chaitin-cli ddr policylog clipboard list --page 1 --limit 20 --search "" --body '{"time_range":{"begin":"2024-09-23T06:36:00Z","end":"2024-11-22T06:36:59Z"},"search":"","queries":[]}' -o json # 剪贴板管控日志列表
chaitin-cli ddr policylog clipboard timelinelist --body '{"time_range":{"begin":"2024-09-23T06:36:00Z","end":"2024-11-22T06:36:59Z"},"search":"","queries":[]}' -o json # 剪贴板管控时间线
chaitin-cli ddr policylog clipboard stafflist --body '{"time_range":{"begin":"2024-09-23T06:36:00Z","end":"2024-11-22T06:36:59Z"},"search":"","queries":[]}' -o json # 剪贴板管控员工列表
chaitin-cli ddr clipboardbehavior timelinelist --body '{"time_range":{"begin":"2024-09-23T06:36:00Z","end":"2024-11-22T06:36:59Z"},"search":"","queries":[]}' -o json # 剪贴板行为时间线
chaitin-cli ddr clipboardbehavior stafflist --body '{"time_range":{"begin":"2024-09-23T06:36:00Z","end":"2024-11-22T06:36:59Z"},"search":"","queries":[]}' -o json # 剪贴板行为员工列表

{"name":"剪贴板策略","period_category":"permanent","scope":"common","family":"Windows","control_category":"copy","expression_fields":[{"field":"source_process","operator":"contains","value":["example.exe"]}],"action":"notify","binding_config":{"source":"clipboard","include":{"device_ids":["<device_id>"]},"exclude":{}}}

chaitin-cli ddr policy webpost-control list --page 1 --limit 20 --search "" -o json # 网页管控策略列表
chaitin-cli ddr policy webpost-control get --policy-id <policy_id> -o json # 网页管控策略详情
chaitin-cli ddr policy webpost-control action --policy-id <policy_id> --body '{"operation":"activate"}' # 启用网页管控策略
chaitin-cli ddr policy webpost-control action --policy-id <policy_id> --body '{"operation":"deactivate"}' # 停用网页管控策略
chaitin-cli ddr policy webpost-control remove --policy-id <policy_id> # 删除网页管控策略
chaitin-cli ddr policy webpost-control create --body-file /tmp/ddr-policy-webpost-control.json # 创建网页管控策略
chaitin-cli ddr policy webpost-control update --policy-id <policy_id> --body-file /tmp/ddr-policy-webpost-control.json # 更新网页管控策略
chaitin-cli ddr policy webpost-control whitelist-list -o json # 网页管控管控白名单列表
chaitin-cli ddr policy webpost-control entitywhitelist-list -o json # 网页管控实体白名单列表

{"name":"网页管控策略","description":"策略描述","scope":"global","period_category":"permanent","period_options":{"period_hours_value":[{"begin":"00:00","end":"23:59","week":1},{"begin":"00:00","end":"23:59","week":2},{"begin":"00:00","end":"23:59","week":3},{"begin":"00:00","end":"23:59","week":4},{"begin":"00:00","end":"23:59","week":5},{"begin":"00:00","end":"23:59","week":6},{"begin":"00:00","end":"23:59","week":7}]},"binding_config":{"include":{"device_ids":[],"device_tag_ids":[],"staff_ids":[],"staff_tag_ids":[],"dept_ids":[]},"exclude":{},"source":"webpost_control"},"control_action":{"expression_fields":[{"left":"content","operator":"contains","value":["secret"]}]},"action":"notify","action_template_id":"<action_template_id>","checked_urls_options":{"left":"url","operator":"contains","value":["example.com"]},"detect_position":"form_internal"}