@knowttl/artium-axi 0.0.10 → 0.0.12

package/README.md

@@ -37,7 +37,7 @@ Agents keep a command-line interface with TOON discovery rather than implementin
 ### Supported pinned tools
 | Tool | Managed access |
 | --- | --- |
-| Falcon | Read-only API client |
+| Falcon | API client; see [supported capabilities](#safety) |
 | Vectra | Token or OAuth; optional allow-listed writes |
 | Azure | Application identity and resource-token broker |
 | Microsoft Graph | Application identity; optional allow-listed writes |
@@ -160,9 +160,12 @@ Artium's authenticated setup fetches managed skills; a standalone skill installe
 All tools start disabled; write access defaults to off.
 Administrator capability alone grants no tool access; upstream permissions remain an additional boundary.
 
+Falcon investigation reads include detection lineage, process details and trees, existing sandbox reports, FileVantage changes and device-control policy details.
+
 | Tool | Write capability and unlock |
 | --- | --- |
-| Falcon, LDAP | Fixed read-only; Falcon's NG-SIEM search-job start/stop effects remain available regardless of any legacy saved write setting. LDAP has no writes. |
+| Falcon | Separate, off-by-default capabilities for guarded RTR execution and bounded MalQuery exact/fuzzy literal search. RTR retains the standard read-only command allowlist and profile narrowing. Host changes, scripts, hunt and file transfers remain unavailable. See [Falcon execution setup](docs/runbook.md#falcon-rtr-execution). |
+| LDAP | Fixed read-only. |
 | Azure | Reviewed resource mutations; administrator `allowWrites: true` plus native command gates. |
 | Graph, Vectra | Native mutations only with administrator `writes.allowWrites: true` and an explicit operations allow-list, plus native gates. |
 | Azure DevOps | Reviewed mutations with administrator `allowWrites: true`; raw `api` remains GET-only. |

package/bin/artium-axi.mjs

@@ -19775,7 +19775,7 @@ function errorResponse(error62, requestId) {
 var inputLimits = {
   requestBytes: 16 * 1024 * 1024,
   arguments: 64,
-  argumentBytes: 4096,
+  argumentBytes: 64 * 1024,
   stdinBytes: 512 * 1024,
   fileBytes: 1024 * 1024,
   totalFileBytes: 4 * 1024 * 1024,
@@ -20046,6 +20046,29 @@ var adminAuditRoute = {
   authorization: "administrator-and-recent-auth",
   auditEvent: null
 };
+var falconRtrSettingsSchema = external_exports.strictObject({
+  enabled: external_exports.boolean(),
+  commands: external_exports.array(external_exports.enum([
+    "cat",
+    "cd",
+    "clear",
+    "csrutil",
+    "env",
+    "eventlog",
+    "filehash",
+    "getsid",
+    "help",
+    "history",
+    "ifconfig",
+    "ipconfig",
+    "ls",
+    "mount",
+    "netstat",
+    "ps",
+    "reg query",
+    "users"
+  ])).optional()
+});
 var nativeSettingsSchemas = {
   "tenable-axi": external_exports.strictObject({ writes: external_exports.strictObject({
     allowWrites: external_exports.boolean(),
@@ -20058,7 +20081,11 @@ var nativeSettingsSchemas = {
     allowWrites: external_exports.boolean(),
     operations: external_exports.array(external_exports.string().min(1).max(256)).min(1).max(64)
   }).optional() }),
-  "falcon-axi": external_exports.strictObject({ allowWrites: external_exports.boolean().optional() }),
+  "falcon-axi": external_exports.strictObject({
+    allowWrites: external_exports.boolean().optional(),
+    rtr: falconRtrSettingsSchema.optional(),
+    writes: external_exports.strictObject({ allowWrites: external_exports.boolean(), operations: external_exports.array(external_exports.enum(["rtr run", "malquery search"])).min(1).max(2) }).optional()
+  }),
   "vectra-axi": external_exports.strictObject({ writes: external_exports.strictObject({
     allowWrites: external_exports.boolean(),
     operations: external_exports.array(external_exports.string().min(1).refine((value) => value.trim().length > 0)).min(1)
@@ -20604,7 +20631,7 @@ import { resolve } from "node:path";
 // package.json
 var package_default = {
   name: "artium-axi",
-  version: "0.0.10",
+  version: "0.0.12",
   private: true,
   license: "MIT",
   type: "module",
@@ -21018,12 +21045,17 @@ var falcon_axi_default = {
   generatedBy: "scripts/falcon-inventory.mjs",
   tool: "falcon-axi",
   repository: "https://github.com/knowttl/falcon-axi.git",
-  tag: "v0.5.1",
-  commit: "b595b500681eee476ddeb2d8d459bb9f8ad2125f",
-  version: "0.5.1",
+  tag: "v0.7.0",
+  commit: "5b860e4899ab2c0961fe2937e04983fe483bc98f",
+  version: "0.7.0",
+  distribution: {
+    filename: "falcon_axi-0.7.0-py3-none-any.whl",
+    sha256: "553c37002b9ec499b2aedce4161d7144d104c6b2de7ac78b6b9b5417e4486b7c",
+    provenance: "https://pypi.org/integrity/falcon-axi/0.7.0/falcon_axi-0.7.0-py3-none-any.whl/provenance"
+  },
   parser: {
     path: "falcon_axi/cli.py",
-    sha256: "2f7ee1d6601dafb63e5e40cc3b1fe28b295f67f7da2f9e23e747cca644caa09d",
+    sha256: "ef29404b26da085b96ace7ba1f708e928eb40c7aa99e071807d5003a3421b0cd",
     aliases: {},
     shortFlags: {},
     repeats: "last value wins",
@@ -21134,6 +21166,20 @@ var falcon_axi_default = {
       },
       input: "No file or raw URL input; cursors and queries remain native values"
     },
+    {
+      command: "detection process",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        full: "boolean"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
     {
       command: "host list",
       flags: {
@@ -21198,6 +21244,20 @@ var falcon_axi_default = {
       },
       input: "No file or raw URL input; cursors and queries remain native values"
     },
+    {
+      command: "host usb",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        since: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
     {
       command: "account list",
       flags: {
@@ -21860,6 +21920,151 @@ var falcon_axi_default = {
       },
       input: "No file or raw URL input; cursors and queries remain native values"
     },
+    {
+      command: "process show",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        full: "boolean"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "process tree",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        cursor: "value",
+        full: "boolean"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "sandbox list",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        sha256: "value",
+        filter: "value",
+        limit: "value",
+        cursor: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "sandbox show",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "file-change list",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        filter: "value",
+        limit: "value",
+        cursor: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "file-change show",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "malquery show",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "malquery quota",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "malquery search",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        string: "value",
+        hex: "value",
+        fuzzy: "boolean",
+        limit: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "malquery status",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        limit: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
     {
       command: "host-group list",
       flags: {
@@ -21926,6 +22131,20 @@ var falcon_axi_default = {
       },
       input: "No file or raw URL input; cursors and queries remain native values"
     },
+    {
+      command: "policy show",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        type: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
     {
       command: "cloud-asset list",
       flags: {
@@ -22202,6 +22421,68 @@ var falcon_axi_default = {
       },
       input: "No file or raw URL input; cursors and queries remain native values"
     },
+    {
+      command: "rtr session list",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        filter: "value",
+        limit: "value",
+        cursor: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "rtr session show",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        full: "boolean"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "rtr audit list",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        filter: "value",
+        limit: "value",
+        cursor: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "rtr run",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        command: "value",
+        execute: "boolean",
+        confirm: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
     {
       command: "auth status",
       flags: {
@@ -22398,6 +22679,10 @@ var falcon_axi_default = {
       name: "FALCON_AXI_READ_ONLY",
       disposition: "injected"
     },
+    {
+      name: "FALCON_AXI_WRITE_LOG",
+      disposition: "injected"
+    },
     {
       name: "FALCON_AXI_MEMBER_CID",
       disposition: "never injected"
@@ -22417,17 +22702,15 @@ var falcon_axi_default = {
     {
       name: "FALCON_AXI_PROFILE",
       disposition: "never injected"
-    },
-    {
-      name: "FALCON_AXI_WRITE_LOG",
-      disposition: "never injected"
     }
   ],
   requirements: {
     runtime: "python",
-    timeoutMs: 6e4,
-    temporaryFiles: [],
-    nativeWrites: "read-only upstream design"
+    timeoutMs: 65e3,
+    temporaryFiles: [
+      "falcon-axi/config.json"
+    ],
+    nativeWrites: "RTR requires host permission, profile opt-in and exact confirmation; MalQuery exact/fuzzy search requires a separate host capability and MalQuery:write; native read-only guards remain enforced"
   },
   healthRead: [
     "auth",
@@ -22459,6 +22742,10 @@ var falcon_axi_default = {
       "identity",
       "search",
       "ioc",
+      "process",
+      "sandbox",
+      "file-change",
+      "malquery",
       "host-group",
       "policy",
       "cloud-asset",
@@ -22471,6 +22758,7 @@ var falcon_axi_default = {
       "ioa",
       "correlation-rule",
       "case",
+      "rtr",
       "auth",
       "scopes",
       "sensor-usage",
@@ -38622,8 +38910,8 @@ var awx_axi_default = {
 var tenable_axi_default = {
   generatedBy: "scripts/tenable-inventory.mjs",
   tool: "tenable-axi",
-  version: "0.1.0",
-  integrity: "sha512-nw1HLOmUZdeo/x1po1uOmFQhZsg0rP1eMGrcwLj+Pd2UkdwKodAQjDCjgBdl5DNLIqaafkUEV6mPMJmkFLQpzw==",
+  version: "0.1.1",
+  integrity: "sha512-ukWwVny4DeEBLqqWJhaM0au4Z5dvQTsDKoE2NhROIE3p114WUz2tT5dOfWL8MaalVrmU/zSMhk+S29sUocR3xg==",
   parserEvidence: "Published command catalogue, mutation registry and reviewed native parsers and transport gates",
   sources: [
     {
@@ -38660,7 +38948,7 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/exposure.js",
-      sha256: "0278853a917eb583c721c69d10c5e466aed9d18c8d910f20991dcfe33faac738"
+      sha256: "5e93b01dc54368627f1f7c1ac4a96579af2f4beae7c2b10189ba190cf5cc9af6"
     },
     {
       path: "dist/src/hook-install.js",
@@ -38668,19 +38956,19 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/inventory-catalogue.js",
-      sha256: "2a4b4338917af9060b6859eaa2cfc94cc5ccb936bf96f744b51755d4d92d98a7"
+      sha256: "ccd42834a43aabffbd90e7326926660e9cff788997ab836cb2eb858fc36f1119"
     },
     {
       path: "dist/src/inventory-export-catalogue.js",
-      sha256: "a85ef57098bdec74dccd587b7065ebb4c84b3902043fc87c8aedd878d74b375f"
+      sha256: "cf07efc8540e83fcda3f79df4a5ec6c75e081e1557a52e6e178a24ee7d393905"
     },
     {
       path: "dist/src/inventory-export.js",
-      sha256: "5422b59008eecad8476d8c0ce5f287188a2f1ad4fcfe763450ac187423d7d0f2"
+      sha256: "176bd2aef67901383e29f5984867d104fdb8278a40d13d1281aa459ea44a8f9c"
     },
     {
       path: "dist/src/inventory.js",
-      sha256: "12ad8effb2728fea7791e5f62716d079484b377c56f8b9cdb83d500842258b7d"
+      sha256: "83bd3b19b1ad54785fdf107b57a66ffc882141706337bb886108b67f75565bb1"
     },
     {
       path: "dist/src/inventory/schema.js",
@@ -38692,11 +38980,11 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/platform-tag-catalogue.js",
-      sha256: "9c887c06dd1179a877696deae8873ffce5e3b3e001f2c61ae7968f883eafe314"
+      sha256: "9efb6f39618f2508e7e3cf58e1f50ce0c994351d5e8d69463c8caad8ecf020d7"
     },
     {
       path: "dist/src/platform-tag.js",
-      sha256: "ff31eb9a454ba20d2e378403fd4cb29b097e8de4b8b241b3af13197598a66972"
+      sha256: "89933fd5ed557037afab537d147348cad8131684cd8422f20ee4fb5846707a18"
     },
     {
       path: "dist/src/private-file.js",
@@ -38724,7 +39012,7 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/transport-core.js",
-      sha256: "db13c1c33aa1716bc8a32e3ebc6459421c64f078ea4641f248e552c5b74a621d"
+      sha256: "3419fbee2b091109495216c4da4f68fdaa1779449f9eee29a9ec429b0d306195"
     },
     {
       path: "dist/src/transport.js",
@@ -39190,7 +39478,7 @@ var tenable_axi_default = {
         full: "Full output; default false",
         help: "Show help",
         "body-file": "Optional strict query/filters JSON file, '-' for stdin; maximum 1 MiB",
-        properties: "Comma-separated property names",
+        properties: "Comma-separated names from asset properties; id maps to asset_id",
         "use-readable-name": "true|false; API default true",
         "max-chunk-file-size": "5242880-104857600 bytes; API default 20971520",
         sort: "property:asc|desc",
@@ -39281,7 +39569,7 @@ var tenable_axi_default = {
         full: "Full output; default false",
         help: "Show help",
         "body-file": "Optional strict query/filters JSON file, '-' for stdin; maximum 1 MiB",
-        properties: "Comma-separated property names",
+        properties: "Comma-separated names from finding properties; id maps to finding_id",
         "use-readable-name": "true|false; API default true",
         "max-chunk-file-size": "5242880-104857600 bytes; API default 20971520",
         sort: "property:asc|desc",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knowttl/artium-axi",
-  "version": "0.0.10",
+  "version": "0.0.12",
   "description": "Client CLI and embedded skill for the Artium managed tools server.",
   "license": "MIT",
   "type": "module",