@knowttl/artium-axi 0.0.11 → 0.0.12

package/README.md

@@ -37,7 +37,7 @@ Agents keep a command-line interface with TOON discovery rather than implementin
 ### Supported pinned tools
 | Tool | Managed access |
 | --- | --- |
-| Falcon | API client; optional guarded RTR read-only commands |
+| Falcon | API client; see [supported capabilities](#safety) |
 | Vectra | Token or OAuth; optional allow-listed writes |
 | Azure | Application identity and resource-token broker |
 | Microsoft Graph | Application identity; optional allow-listed writes |
@@ -160,9 +160,11 @@ Artium's authenticated setup fetches managed skills; a standalone skill installe
 All tools start disabled; write access defaults to off.
 Administrator capability alone grants no tool access; upstream permissions remain an additional boundary.
 
+Falcon investigation reads include detection lineage, process details and trees, existing sandbox reports, FileVantage changes and device-control policy details.
+
 | Tool | Write capability and unlock |
 | --- | --- |
-| Falcon | Optional guarded RTR execution from the standard read-only command allowlist, with profile narrowing. Host changes, scripts and file transfers remain unavailable. See [Falcon execution setup](docs/runbook.md#falcon-rtr-execution). |
+| Falcon | Separate, off-by-default capabilities for guarded RTR execution and bounded MalQuery exact/fuzzy literal search. RTR retains the standard read-only command allowlist and profile narrowing. Host changes, scripts, hunt and file transfers remain unavailable. See [Falcon execution setup](docs/runbook.md#falcon-rtr-execution). |
 | LDAP | Fixed read-only. |
 | Azure | Reviewed resource mutations; administrator `allowWrites: true` plus native command gates. |
 | Graph, Vectra | Native mutations only with administrator `writes.allowWrites: true` and an explicit operations allow-list, plus native gates. |

package/bin/artium-axi.mjs

@@ -20081,7 +20081,11 @@ var nativeSettingsSchemas = {
     allowWrites: external_exports.boolean(),
     operations: external_exports.array(external_exports.string().min(1).max(256)).min(1).max(64)
   }).optional() }),
-  "falcon-axi": external_exports.strictObject({ allowWrites: external_exports.boolean().optional(), rtr: falconRtrSettingsSchema.optional() }),
+  "falcon-axi": external_exports.strictObject({
+    allowWrites: external_exports.boolean().optional(),
+    rtr: falconRtrSettingsSchema.optional(),
+    writes: external_exports.strictObject({ allowWrites: external_exports.boolean(), operations: external_exports.array(external_exports.enum(["rtr run", "malquery search"])).min(1).max(2) }).optional()
+  }),
   "vectra-axi": external_exports.strictObject({ writes: external_exports.strictObject({
     allowWrites: external_exports.boolean(),
     operations: external_exports.array(external_exports.string().min(1).refine((value) => value.trim().length > 0)).min(1)
@@ -20627,7 +20631,7 @@ import { resolve } from "node:path";
 // package.json
 var package_default = {
   name: "artium-axi",
-  version: "0.0.11",
+  version: "0.0.12",
   private: true,
   license: "MIT",
   type: "module",
@@ -21041,17 +21045,17 @@ var falcon_axi_default = {
   generatedBy: "scripts/falcon-inventory.mjs",
   tool: "falcon-axi",
   repository: "https://github.com/knowttl/falcon-axi.git",
-  tag: "v0.6.0",
-  commit: "84017f66e72757a8468992c793b3c1095fe6baa3",
-  version: "0.6.0",
+  tag: "v0.7.0",
+  commit: "5b860e4899ab2c0961fe2937e04983fe483bc98f",
+  version: "0.7.0",
   distribution: {
-    filename: "falcon_axi-0.6.0-py3-none-any.whl",
-    sha256: "88bacab2be710432807678f6c710fc5f8d00eb5b1d44680f3807d64398b23781",
-    provenance: "https://pypi.org/integrity/falcon-axi/0.6.0/falcon_axi-0.6.0-py3-none-any.whl/provenance"
+    filename: "falcon_axi-0.7.0-py3-none-any.whl",
+    sha256: "553c37002b9ec499b2aedce4161d7144d104c6b2de7ac78b6b9b5417e4486b7c",
+    provenance: "https://pypi.org/integrity/falcon-axi/0.7.0/falcon_axi-0.7.0-py3-none-any.whl/provenance"
   },
   parser: {
     path: "falcon_axi/cli.py",
-    sha256: "d8b94b90440d7c538847a7da5dc8b3daa12fbaee09a400144c70539261ae7ec6",
+    sha256: "ef29404b26da085b96ace7ba1f708e928eb40c7aa99e071807d5003a3421b0cd",
     aliases: {},
     shortFlags: {},
     repeats: "last value wins",
@@ -21240,6 +21244,20 @@ var falcon_axi_default = {
       },
       input: "No file or raw URL input; cursors and queries remain native values"
     },
+    {
+      command: "host usb",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        since: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
     {
       command: "account list",
       flags: {
@@ -21902,6 +21920,151 @@ var falcon_axi_default = {
       },
       input: "No file or raw URL input; cursors and queries remain native values"
     },
+    {
+      command: "process show",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        full: "boolean"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "process tree",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        cursor: "value",
+        full: "boolean"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "sandbox list",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        sha256: "value",
+        filter: "value",
+        limit: "value",
+        cursor: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "sandbox show",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "file-change list",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        filter: "value",
+        limit: "value",
+        cursor: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "file-change show",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "malquery show",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "malquery quota",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "malquery search",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        string: "value",
+        hex: "value",
+        fuzzy: "boolean",
+        limit: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
+    {
+      command: "malquery status",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        limit: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
     {
       command: "host-group list",
       flags: {
@@ -21968,6 +22131,20 @@ var falcon_axi_default = {
       },
       input: "No file or raw URL input; cursors and queries remain native values"
     },
+    {
+      command: "policy show",
+      flags: {
+        help: "boolean",
+        region: "value",
+        "allow-unknown-origin": "boolean",
+        "member-cid": "value",
+        "no-member-cid": "boolean",
+        config: "value",
+        profile: "value",
+        type: "value"
+      },
+      input: "No file or raw URL input; cursors and queries remain native values"
+    },
     {
       command: "cloud-asset list",
       flags: {
@@ -22533,7 +22710,7 @@ var falcon_axi_default = {
     temporaryFiles: [
       "falcon-axi/config.json"
     ],
-    nativeWrites: "RTR read-only command execution requires host permission, profile opt-in and exact confirmation"
+    nativeWrites: "RTR requires host permission, profile opt-in and exact confirmation; MalQuery exact/fuzzy search requires a separate host capability and MalQuery:write; native read-only guards remain enforced"
   },
   healthRead: [
     "auth",
@@ -22565,6 +22742,10 @@ var falcon_axi_default = {
       "identity",
       "search",
       "ioc",
+      "process",
+      "sandbox",
+      "file-change",
+      "malquery",
       "host-group",
       "policy",
       "cloud-asset",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knowttl/artium-axi",
-  "version": "0.0.11",
+  "version": "0.0.12",
   "description": "Client CLI and embedded skill for the Artium managed tools server.",
   "license": "MIT",
   "type": "module",