@knowttl/artium-axi 0.0.23 → 0.0.24

package/README.md

@@ -167,6 +167,7 @@ All tools start disabled; write access defaults to off.
 Administrator capability alone grants no tool access; upstream permissions remain an additional boundary.
 
 Microsoft Graph defaults to the `entra` pack.
+Device relationship reads use `artium-axi mg-axi entra device owners <device-object-id>` or `artium-axi mg-axi entra device users <device-object-id>` for registered owners or users, with collection pagination flags from authenticated command help.
 Administrators can opt in to nine mailbox read commands with `enabledPacks: ["entra", "mail"]`; `security` can be enabled alongside `mail`.
 Mail supports folder list/show, message list/show with search, filters and conversations, attachment metadata, mailbox settings, inbox rule list/show and master category list.
 Hosted mail requires a `mode=application` credential profile; delegated profiles cannot enable the mail pack or execute mail commands.
@@ -212,6 +213,9 @@ Rejected searches preserve redacted server diagnostics, completed searches inclu
 
 Vectra `host show` and `entity show --type host`, plus the matching raw host reads, retain every returned API field under `host`, separate from CLI metadata.
 Use `--full` on host/entity detail commands for complete returned text; secret redaction still applies, and upstream omissions cannot be restored.
+QUX collection reads support bounded `--all` traversal and opaque `--cursor` continuation with the original filters.
+Detection and host IDs must be positive integers, including detection-list host and ID-range filters.
+Detection `--fields` can include triage, assignment and filtering metadata; the [reviewed Vectra inventory](tools/inventories/vectra-axi.json) owns the field names and pagination budgets.
 
 Vectra supports selected QUX/RUX writes for detection close/open and mark-fixed, host/account close, key assets, tags, notes (including bulk notes), assignments and outcomes, triage labels and rules, groups and membership, proxies, threat feeds, internal-network settings, syslog/Kafka, notification destinations and Match, subject to deployment support in the [reviewed inventory](tools/inventories/vectra-axi.json).
 User, role, API-client and credential administration remains blocked.

package/bin/artium-axi.mjs

@@ -19790,10 +19790,10 @@ var gh_axi_default = {
     manifestSha256: "dbe3acffeb40dfcca73ce33f60f807bbba8cd5cec6a470b2c7f255b50e02e184"
   },
   gh: {
-    version: "2.101.0",
-    url: "https://github.com/cli/cli/releases/download/v2.101.0/gh_2.101.0_linux_amd64.tar.gz",
-    sha256: "9bca2d1c16825f109907a23307628a2f0698fbf99662b73a5cf0b020293072b8",
-    checksums: "https://github.com/cli/cli/releases/download/v2.101.0/gh_2.101.0_checksums.txt"
+    version: "2.103.3",
+    url: "https://github.com/cli/cli/releases/download/v2.103.3/gh_2.103.3_linux_amd64.tar.gz",
+    sha256: "4c806978ffce1cec70853302a56d70ac6da4f19bae7adca4e1a8ab00633dd91d",
+    checksums: "https://github.com/cli/cli/releases/download/v2.103.3/gh_2.103.3_checksums.txt"
   },
   sources: [
     {
@@ -22056,7 +22056,7 @@ import { resolve } from "node:path";
 // package.json
 var package_default = {
   name: "artium-axi",
-  version: "0.0.23",
+  version: "0.0.24",
   private: true,
   license: "MIT",
   type: "module",
@@ -22544,13 +22544,13 @@ var falcon_axi_default = {
   generatedBy: "scripts/falcon-inventory.mjs",
   tool: "falcon-axi",
   repository: "https://github.com/knowttl/falcon-axi.git",
-  tag: "v0.8.0",
-  commit: "4ba25f373a5c4df46506bdd0d306fa3ef205d965",
-  version: "0.8.0",
+  tag: "v0.8.1",
+  commit: "2b28223d20f211fbb54df4a96afa141808ce9809",
+  version: "0.8.1",
   distribution: {
-    filename: "falcon_axi-0.8.0-py3-none-any.whl",
-    sha256: "8aad289fd58847cb6555f46b8e930c5904d6afda34a7b2e6965cdd60c8df06a4",
-    provenance: "https://pypi.org/integrity/falcon-axi/0.8.0/falcon_axi-0.8.0-py3-none-any.whl/provenance"
+    filename: "falcon_axi-0.8.1-py3-none-any.whl",
+    sha256: "b234b9ea39519adba70073e8b4371cab59513124ea2beda7597c11d4cf1b152b",
+    provenance: "https://pypi.org/integrity/falcon-axi/0.8.1/falcon_axi-0.8.1-py3-none-any.whl/provenance"
   },
   skillSha256: "5d5fd1cd57ff1da68e37448c93fce57236f76448ec9a10984c01ea7300c6a8e0",
   parser: {
@@ -24281,11 +24281,11 @@ var falcon_axi_default = {
 var vectra_axi_default = {
   generatedBy: "scripts/upstream-inventory.mjs",
   tool: "vectra-axi",
-  version: "0.1.10",
-  integrity: "sha512-X7yttDlwpQJW/j0eNox5vLf7nWlFejXjtaq90N7ezJ+ACNqEFspODrwQ/mYqbXFnqjpIugQnhSGcnaI8YNMeLw==",
+  version: "0.1.11",
+  integrity: "sha512-BlbZkUhkqqGaJBX+7skqE22ZAurhqqOIO/LF0zwi1t9Y8vwAz8Ju0BBahfmPYWPnQijrxZ69e/a8B3yDV69XnA==",
   parserEvidence: "Installed pinned catalogue exports, provisional until adapter acceptance",
-  packageManifestSha256: "3f4d4e3ec1b37690087e3c8850ffd5390574e6686cafbd723fb01f83b775ea97",
-  skillSha256: "58978bfd2468e9fac8d17644df1de46768572b1cd9a719a9eec64cdcb547ff9c",
+  packageManifestSha256: "6b4f5e6de7d416c9bfa568f8391c0d8b47952f4ef856d19fd091ef950c57490c",
+  skillSha256: "a60ef2e69a9e569e3884800e57edcfecc262c3f5211a3ee9c84748f60c35cece",
   environment: [
     {
       name: "VECTRA_AXI_CONFIG",
@@ -24541,15 +24541,15 @@ var vectra_axi_default = {
         "--state <state>": "Filter by server-side detection state",
         "--detection-type <type>": "Filter by server-side detection type",
         "--detection-category <category>": "Filter by server-side detection category",
-        "--host-id <id>": "Filter by server-side host ID (non-negative integer); find it with host list --name <text>, then detection list --host-id <id>",
+        "--host-id <id>": "Filter by server-side host ID (positive integer); find it with host list --name <text>, then detection list --host-id <id>",
         "--tags <tags>": "Filter by server-side tags",
         "--certainty-gte <score>": "Filter by server-side minimum certainty",
         "--threat-gte <score>": "Filter by server-side minimum threat",
         "--ordering <ordering>": "Server-side result ordering",
-        "--min-id <id>": "Server-side minimum detection ID (non-negative integer)",
-        "--max-id <id>": "Server-side maximum detection ID (non-negative integer)",
+        "--min-id <id>": "Server-side minimum detection ID (positive integer)",
+        "--max-id <id>": "Server-side maximum detection ID (positive integer)",
         "--limit <rows>": "Row window for this read; default 100",
-        "--fields <list>": "Comma-separated detection fields, including first_timestamp,last_timestamp,src_ip,src_host,summary,grouped_details; default id,detection_type,state,threat,certainty",
+        "--fields <list>": "Comma-separated detection fields, including first_timestamp,last_timestamp,src_ip,src_host,summary,grouped_details,is_triaged,triage_rule_id,triage_category,assigned_to,assigned_date,filtered_by_rule,filtered_by_user,filtered_by_ai,is_marked_custom; default id,detection_type,state,threat,certainty",
         "--all": "Traverse pages within 10 requests, 8 MiB, 60 seconds and 10000 rows; cannot combine with --limit",
         "--cursor <cursor>": "Resume a capped list with its original filters"
       },
@@ -24585,7 +24585,7 @@ var vectra_axi_default = {
     },
     source: {
       path: "dist/src/catalogue.js",
-      sha256: "02e2443a4b6d6aef9faae51e0c4418c0c565ac5b0f73969a34a4c33a110bfabf"
+      sha256: "f918b36346a7cae2b164c89263275e4571b9d6bd07688019a789c7e0463434b2"
     }
   },
   flags: [
@@ -31058,11 +31058,11 @@ var az_axi_default = {
 var mg_axi_default = {
   generatedBy: "scripts/upstream-inventory.mjs",
   tool: "mg-axi",
-  version: "0.1.16",
-  integrity: "sha512-tTVeROr9DiRA/QQE/OTxfQeAZ+ZZpdgp1Y8nsPJQMs69AJ/ozbrFim//lae/r4kaV4Z9k+TUSblg+eSKTQqbjw==",
+  version: "0.1.17",
+  integrity: "sha512-pbMFGVz3VYwYlAsoIc0h8XcsjFZBV+NyDJFu5CO0Wl/Z02GabXoD9Z/UJtBFvXIcvnX5zPdonITBjmdc352SCg==",
   parserEvidence: "Installed pinned catalogue exports",
-  packageManifestSha256: "eecaf8767ac5067212273b8a98370c5a826fd11937215c1d3a0a2d27270d68b3",
-  skillSha256: "5389d7ceaae9a1c1995bc8377464c02df44eff5878659075b711b1530b396b7f",
+  packageManifestSha256: "e76e43e35fe944b949eaccffa53e2e381e64ee0b0222d9a80f87926111c7e5f3",
+  skillSha256: "325769d3237f5481626d934fb89be2a48f9b74f84a34ec96a3d5f264d48fcf86",
   environment: [
     {
       name: "MG_AXI_CONFIG"
@@ -31255,11 +31255,11 @@ var mg_axi_default = {
     sources: [
       {
         path: "dist/catalogue.js",
-        sha256: "59e7ffdac99c5e407e37324ca5af8919e969e5c028ac8b1a1db996cf797d08f2"
+        sha256: "cb5ceac3c11aa79697cb0b51bf416d70e3a5b3382058b102de128ea147dbe318"
       },
       {
         path: "dist/cli.js",
-        sha256: "e02109aef50bad0da2c6d1780c62486b421963c1b237e3365a6b525d6de3de0f"
+        sha256: "d11e0f6b5c5c694b0be07d7862d59bc74609cfe01c02ceee8627122bf9c1a683"
       },
       {
         path: "dist/profiles.js",
@@ -31397,11 +31397,11 @@ var mg_axi_default = {
     parserSources: [
       {
         path: "dist/catalogue.js",
-        sha256: "59e7ffdac99c5e407e37324ca5af8919e969e5c028ac8b1a1db996cf797d08f2"
+        sha256: "cb5ceac3c11aa79697cb0b51bf416d70e3a5b3382058b102de128ea147dbe318"
       },
       {
         path: "dist/cli.js",
-        sha256: "e02109aef50bad0da2c6d1780c62486b421963c1b237e3365a6b525d6de3de0f"
+        sha256: "d11e0f6b5c5c694b0be07d7862d59bc74609cfe01c02ceee8627122bf9c1a683"
       },
       {
         path: "dist/mail-message-writes.js",
@@ -32353,6 +32353,44 @@ var mg_axi_default = {
       },
       positionalInput: false
     },
+    {
+      command: "entra device owners",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        limit: "value",
+        all: "boolean",
+        cursor: "value",
+        scopes: "value",
+        full: "boolean",
+        config: "value"
+      },
+      positionalInput: {
+        name: "id",
+        description: "Device object ID",
+        required: true
+      }
+    },
+    {
+      command: "entra device users",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        limit: "value",
+        all: "boolean",
+        cursor: "value",
+        scopes: "value",
+        full: "boolean",
+        config: "value"
+      },
+      positionalInput: {
+        name: "id",
+        description: "Device object ID",
+        required: true
+      }
+    },
     {
       command: "entra administrative-unit list",
       flags: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knowttl/artium-axi",
-  "version": "0.0.23",
+  "version": "0.0.24",
   "description": "Client CLI and embedded skill for the Artium managed tools server.",
   "license": "MIT",
   "type": "module",