@knowttl/artium-axi 0.0.10 → 0.0.11

package/README.md

@@ -37,7 +37,7 @@ Agents keep a command-line interface with TOON discovery rather than implementin
 ### Supported pinned tools
 | Tool | Managed access |
 | --- | --- |
-| Falcon | Read-only API client |
+| Falcon | API client; optional guarded RTR read-only commands |
 | Vectra | Token or OAuth; optional allow-listed writes |
 | Azure | Application identity and resource-token broker |
 | Microsoft Graph | Application identity; optional allow-listed writes |
@@ -162,7 +162,8 @@ Administrator capability alone grants no tool access; upstream permissions remai
 
 | Tool | Write capability and unlock |
 | --- | --- |
-| Falcon, LDAP | Fixed read-only; Falcon's NG-SIEM search-job start/stop effects remain available regardless of any legacy saved write setting. LDAP has no writes. |
+| Falcon | Optional guarded RTR execution from the standard read-only command allowlist, with profile narrowing. Host changes, scripts and file transfers remain unavailable. See [Falcon execution setup](docs/runbook.md#falcon-rtr-execution). |
+| LDAP | Fixed read-only. |
 | Azure | Reviewed resource mutations; administrator `allowWrites: true` plus native command gates. |
 | Graph, Vectra | Native mutations only with administrator `writes.allowWrites: true` and an explicit operations allow-list, plus native gates. |
 | Azure DevOps | Reviewed mutations with administrator `allowWrites: true`; raw `api` remains GET-only. |

package/bin/artium-axi.mjs

@@ -19775,7 +19775,7 @@ function errorResponse(error62, requestId) {
 var inputLimits = {
   requestBytes: 16 * 1024 * 1024,
   arguments: 64,
-  argumentBytes: 4096,
+  argumentBytes: 64 * 1024,
   stdinBytes: 512 * 1024,
   fileBytes: 1024 * 1024,
   totalFileBytes: 4 * 1024 * 1024,
@@ -20046,6 +20046,29 @@ var adminAuditRoute = {
   authorization: "administrator-and-recent-auth",
   auditEvent: null
 };
+var falconRtrSettingsSchema = external_exports.strictObject({
+  enabled: external_exports.boolean(),
+  commands: external_exports.array(external_exports.enum([
+    "cat",
+    "cd",
+    "clear",
+    "csrutil",
+    "env",
+    "eventlog",
+    "filehash",
+    "getsid",
+    "help",
+    "history",
+    "ifconfig",
+    "ipconfig",
+    "ls",
+    "mount",
+    "netstat",
+    "ps",
+    "reg query",
+    "users"
+  ])).optional()
+});
 var nativeSettingsSchemas = {
   "tenable-axi": external_exports.strictObject({ writes: external_exports.strictObject({
     allowWrites: external_exports.boolean(),
@@ -20058,7 +20081,7 @@ var nativeSettingsSchemas = {
     allowWrites: external_exports.boolean(),
     operations: external_exports.array(external_exports.string().min(1).max(256)).min(1).max(64)
   }).optional() }),
-  "falcon-axi": external_exports.strictObject({ allowWrites: external_exports.boolean().optional() }),
+  "falcon-axi": external_exports.strictObject({ allowWrites: external_exports.boolean().optional(), rtr: falconRtrSettingsSchema.optional() }),
   "vectra-axi": external_exports.strictObject({ writes: external_exports.strictObject({
     allowWrites: external_exports.boolean(),
     operations: external_exports.array(external_exports.string().min(1).refine((value) => value.trim().length > 0)).min(1)
@@ -20604,7 +20627,7 @@ import { resolve } from "node:path";
 // package.json
 var package_default = {
   name: "artium-axi",
-  version: "0.0.10",
+  version: "0.0.11",
   private: true,
   license: "MIT",
   type: "module",
@@ -21018,12 +21041,17 @@ var falcon_axi_default = {
   generatedBy: "scripts/falcon-inventory.mjs",
   tool: "falcon-axi",
   repository: "https://github.com/knowttl/falcon-axi.git",
-  tag: "v0.5.1",
-  commit: "b595b500681eee476ddeb2d8d459bb9f8ad2125f",
-  version: "0.5.1",
+  tag: "v0.6.0",
+  commit: "84017f66e72757a8468992c793b3c1095fe6baa3",
+  version: "0.6.0",
+  distribution: {
+    filename: "falcon_axi-0.6.0-py3-none-any.whl",
+    sha256: "88bacab2be710432807678f6c710fc5f8d00eb5b1d44680f3807d64398b23781",
+    provenance: "https://pypi.org/integrity/falcon-axi/0.6.0/falcon_axi-0.6.0-py3-none-any.whl/provenance"
+  },
   parser: {
     path: "falcon_axi/cli.py",
-    sha256: "2f7ee1d6601dafb63e5e40cc3b1fe28b295f67f7da2f9e23e747cca644caa09d",
+    sha256: "d8b94b90440d7c538847a7da5dc8b3daa12fbaee09a400144c70539261ae7ec6",
     aliases: {},
     shortFlags: {},
     repeats: "last value wins",
@@ -21134,6 +21162,20 @@ var falcon_axi_default = {
       },
       input: "No file or raw URL input; cursors and queries remain native values"
     },
+    {
+      command: "detection process",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        full: "boolean"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
     {
       command: "host list",
       flags: {
@@ -22202,6 +22244,68 @@ var falcon_axi_default = {
       },
       input: "No file or raw URL input; cursors and queries remain native values"
     },
+    {
+      command: "rtr session list",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        filter: "value",
+        limit: "value",
+        cursor: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "rtr session show",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        full: "boolean"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "rtr audit list",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        filter: "value",
+        limit: "value",
+        cursor: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "rtr run",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        command: "value",
+        execute: "boolean",
+        confirm: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
     {
       command: "auth status",
       flags: {
@@ -22398,6 +22502,10 @@ var falcon_axi_default = {
       name: "FALCON_AXI_READ_ONLY",
       disposition: "injected"
     },
+    {
+      name: "FALCON_AXI_WRITE_LOG",
+      disposition: "injected"
+    },
     {
       name: "FALCON_AXI_MEMBER_CID",
       disposition: "never injected"
@@ -22417,17 +22525,15 @@ var falcon_axi_default = {
     {
       name: "FALCON_AXI_PROFILE",
       disposition: "never injected"
-    },
-    {
-      name: "FALCON_AXI_WRITE_LOG",
-      disposition: "never injected"
     }
   ],
   requirements: {
     runtime: "python",
-    timeoutMs: 6e4,
-    temporaryFiles: [],
-    nativeWrites: "read-only upstream design"
+    timeoutMs: 65e3,
+    temporaryFiles: [
+      "falcon-axi/config.json"
+    ],
+    nativeWrites: "RTR read-only command execution requires host permission, profile opt-in and exact confirmation"
   },
   healthRead: [
     "auth",
@@ -22471,6 +22577,7 @@ var falcon_axi_default = {
       "ioa",
       "correlation-rule",
       "case",
+      "rtr",
       "auth",
       "scopes",
       "sensor-usage",
@@ -38622,8 +38729,8 @@ var awx_axi_default = {
 var tenable_axi_default = {
   generatedBy: "scripts/tenable-inventory.mjs",
   tool: "tenable-axi",
-  version: "0.1.0",
-  integrity: "sha512-nw1HLOmUZdeo/x1po1uOmFQhZsg0rP1eMGrcwLj+Pd2UkdwKodAQjDCjgBdl5DNLIqaafkUEV6mPMJmkFLQpzw==",
+  version: "0.1.1",
+  integrity: "sha512-ukWwVny4DeEBLqqWJhaM0au4Z5dvQTsDKoE2NhROIE3p114WUz2tT5dOfWL8MaalVrmU/zSMhk+S29sUocR3xg==",
   parserEvidence: "Published command catalogue, mutation registry and reviewed native parsers and transport gates",
   sources: [
     {
@@ -38660,7 +38767,7 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/exposure.js",
-      sha256: "0278853a917eb583c721c69d10c5e466aed9d18c8d910f20991dcfe33faac738"
+      sha256: "5e93b01dc54368627f1f7c1ac4a96579af2f4beae7c2b10189ba190cf5cc9af6"
     },
     {
       path: "dist/src/hook-install.js",
@@ -38668,19 +38775,19 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/inventory-catalogue.js",
-      sha256: "2a4b4338917af9060b6859eaa2cfc94cc5ccb936bf96f744b51755d4d92d98a7"
+      sha256: "ccd42834a43aabffbd90e7326926660e9cff788997ab836cb2eb858fc36f1119"
     },
     {
       path: "dist/src/inventory-export-catalogue.js",
-      sha256: "a85ef57098bdec74dccd587b7065ebb4c84b3902043fc87c8aedd878d74b375f"
+      sha256: "cf07efc8540e83fcda3f79df4a5ec6c75e081e1557a52e6e178a24ee7d393905"
     },
     {
       path: "dist/src/inventory-export.js",
-      sha256: "5422b59008eecad8476d8c0ce5f287188a2f1ad4fcfe763450ac187423d7d0f2"
+      sha256: "176bd2aef67901383e29f5984867d104fdb8278a40d13d1281aa459ea44a8f9c"
     },
     {
       path: "dist/src/inventory.js",
-      sha256: "12ad8effb2728fea7791e5f62716d079484b377c56f8b9cdb83d500842258b7d"
+      sha256: "83bd3b19b1ad54785fdf107b57a66ffc882141706337bb886108b67f75565bb1"
     },
     {
       path: "dist/src/inventory/schema.js",
@@ -38692,11 +38799,11 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/platform-tag-catalogue.js",
-      sha256: "9c887c06dd1179a877696deae8873ffce5e3b3e001f2c61ae7968f883eafe314"
+      sha256: "9efb6f39618f2508e7e3cf58e1f50ce0c994351d5e8d69463c8caad8ecf020d7"
     },
     {
       path: "dist/src/platform-tag.js",
-      sha256: "ff31eb9a454ba20d2e378403fd4cb29b097e8de4b8b241b3af13197598a66972"
+      sha256: "89933fd5ed557037afab537d147348cad8131684cd8422f20ee4fb5846707a18"
     },
     {
       path: "dist/src/private-file.js",
@@ -38724,7 +38831,7 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/transport-core.js",
-      sha256: "db13c1c33aa1716bc8a32e3ebc6459421c64f078ea4641f248e552c5b74a621d"
+      sha256: "3419fbee2b091109495216c4da4f68fdaa1779449f9eee29a9ec429b0d306195"
     },
     {
       path: "dist/src/transport.js",
@@ -39190,7 +39297,7 @@ var tenable_axi_default = {
         full: "Full output; default false",
         help: "Show help",
         "body-file": "Optional strict query/filters JSON file, '-' for stdin; maximum 1 MiB",
-        properties: "Comma-separated property names",
+        properties: "Comma-separated names from asset properties; id maps to asset_id",
         "use-readable-name": "true|false; API default true",
         "max-chunk-file-size": "5242880-104857600 bytes; API default 20971520",
         sort: "property:asc|desc",
@@ -39281,7 +39388,7 @@ var tenable_axi_default = {
         full: "Full output; default false",
         help: "Show help",
         "body-file": "Optional strict query/filters JSON file, '-' for stdin; maximum 1 MiB",
-        properties: "Comma-separated property names",
+        properties: "Comma-separated names from finding properties; id maps to finding_id",
         "use-readable-name": "true|false; API default true",
         "max-chunk-file-size": "5242880-104857600 bytes; API default 20971520",
         sort: "property:asc|desc",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knowttl/artium-axi",
-  "version": "0.0.10",
+  "version": "0.0.11",
   "description": "Client CLI and embedded skill for the Artium managed tools server.",
   "license": "MIT",
   "type": "module",