Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 19 additions & 15 deletions docs/cado/discovery-import/cado-host/cli.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ sidebar_position: 7

## Usage
```bash
cado-host [-h] [--verbose] [--version] {version,capture,upload} ...
cado-host [-h] [--verbose] [--version] {capture,upload,clean} ...
```

### Options
Expand All @@ -28,13 +28,13 @@ Capture and triage files based on chosen configuration.
- `-c {default,light,max}, --collection_mode {default,light,max}`
Selects the collection mode which changes how Cado Host will search for files:
- `default`
Searches and collects the default set files of files as outlined [here](/cado/discovery-import/cado-host/artifacts).
Searches and collects the default set files of files as outlined [here](/cado/discovery-import/cado-host/artifacts). This is the default option.
- `light`
Searches and collects files smaller than 10MB.
- `max`
Searches and collects a larger set of files regardless of size. This will slow capture down significantly.

- `-a [ADDITIONAL_FILES ...], --additional_files [ADDITIONAL_FILES ...]`
- `-a [FILE ...], --additional_files [FILE ...]`
List multiple files or folders to collect, separated by spaces.

:::tip
Expand All @@ -44,21 +44,26 @@ Capture and triage files based on chosen configuration.
```
:::

- `-ap ADDITIONAL_FILES_PATH, --additional_files_path ADDITIONAL_FILES_PATH`
- `-ap PATH, --additional_files_path PATH`
Path to a local file containing a list of files or folders to collect, one per line.

- `--only_additional_files`
Only collect files and folders specified in `--additional_files`.

- `--groups [GROUPS ...]`
- `--groups [GROUP ...]`
Collect a specific group of files. Use `--list_groups` to see available groups. If no groups are specified, all groups will be collected.

- `--list_groups`
List all available groups of files that can be collected.

- `-o OUTPUT_PATH, --output_path OUTPUT_PATH`
- `-o PATH, --output_path PATH`
Path where Cado Host will save the collection.

- `--skip_scan`
Skip scanning for extra files against known signatures.

- `--root_path PATH`
The path where Cado Host will start its file search from.

#### Kubernetes Specific Options

Expand All @@ -72,16 +77,11 @@ Capture and triage files based on chosen configuration.
**Note:** This should only be used when you are sure that the `sysadmin` profile is available. See the [Kubernetes docs](/cado/discovery-import/kubernetes#root-access) for more information.
:::


#### Windows Specific Options

- `--dd DRIVE, --default_drive DRIVE`
Specifies the default drive on a Windows system.

- `--include_memory`
Acquires process memory, this can be slow on Windows systems as it will acquire process memory regardless of size.


#### Linux Specific Options

- `--skip_memory`
Expand All @@ -97,13 +97,14 @@ Upload an existing Cado Host capture file, or other files. **This will clean up
When using `cado-host upload` to upload single files to the platform, please use `--no_cleanup` to ensure Cado Host doesn't delete the file after upload.
:::

#### Arguments
- `PATH`
Path of the file to upload and import into the Platform.

#### Options
- `--presigned_data PRESIGNED_DATA`
- `--presigned_data DATA`
Encoded upload credentials generated by the platform.

- `--capture_path CAPTURE_PATH`
Path of the file to upload and import into the Platform.

- `--no_cleanup`
Disable self-cleanup after triage upload.

Expand All @@ -113,3 +114,6 @@ When using `cado-host upload` to upload single files to the platform, please use
:::warning
**Note:** This should only be used as a last resort, useful when proxies in enterprise deployments require the use of a custom self-signed certificate.
:::

### `clean`
Cleans up previous runs and logs to free up disk space. Searches temporary folders and the current folder.