@sentriflow/cli 0.1.9 → 0.2.1

package/README.md

@@ -37,6 +37,15 @@ sentriflow --list-vendors
 
 # List active rules
 sentriflow --list-rules
+
+# List rules by category
+sentriflow --list-rules --category authentication
+
+# List all categories
+sentriflow --list-categories
+
+# Read from stdin
+cat router.conf | sentriflow -
 ```
 
 ## Usage
@@ -47,7 +56,7 @@ Usage: sentriflow [options] [file]
 SentriFlow Network Configuration Compliance Checker
 
 Arguments:
-  file                          Path to the configuration file
+  file                          Path to the configuration file (use - for stdin)
 
 Options:
   -V, --version                 output the version number
@@ -80,10 +89,20 @@ Supported vendors: `cisco-ios`, `juniper-junos`, `palo-alto`, `fortinet`, `arist
 | `--no-config` | Ignore config file |
 | `-d, --disable <ids>` | Comma-separated rule IDs to disable |
 | `--list-rules` | List all active rules and exit |
+| `--list-categories` | List all rule categories with counts |
+| `--category <name>` | Filter `--list-rules` by category |
+| `--list-format <fmt>` | Format for `--list-rules`: `table` (default), `json`, `csv` |
 | `-p, --rule-pack <path>` | Rule pack file to load |
 | `--json-rules <path...>` | Path(s) to JSON rules file(s) |
 | `-r, --rules <path>` | Additional rules file (legacy) |
 
+### IP Extraction
+
+| Option | Description |
+|--------|-------------|
+| `--extract-ips` | Extract and display all IP addresses/subnets from configuration |
+| `--copy-ips` | Copy extracted IPs to clipboard (requires xclip/pbcopy) |
+
 ### Encrypted Rule Packs
 
 | Option | Description |
@@ -92,6 +111,46 @@ Supported vendors: `cisco-ios`, `juniper-junos`, `palo-alto`, `fortinet`, `arist
 | `--license-key <key>` | License key (or set `SENTRIFLOW_LICENSE_KEY` env var) |
 | `--strict-packs` | Fail if encrypted pack cannot be loaded |
 
+### Extended Encrypted Packs (GRX2)
+
+Extended GRX2 packs (.grx2) embed wrapped encryption keys, enabling offline scanning without network access.
+
+| Option | Description |
+|--------|-------------|
+| `--grx2-pack <path...>` | Path(s) to extended encrypted rule pack(s) (.grx2) |
+| `--strict-grx2` | Fail immediately if any GRX2 pack cannot be loaded |
+| `--show-machine-id` | Display the current machine ID (for license binding support) |
+
+**Environment Variable:**
+- `SENTRIFLOW_LICENSE_KEY` - License key for decrypting packs
+
+**Offline Usage:**
+
+GRX2 packs contain embedded wrapped keys, allowing complete offline operation:
+
+```bash
+# Scan with portable pack (no network required)
+SENTRIFLOW_LICENSE_KEY=ey... sentriflow --grx2-pack ./enterprise-rules.grx2 router.conf
+
+# Scan with multiple packs
+sentriflow --grx2-pack pack1.grx2 pack2.grx2 --license-key ey... configs/
+
+# Strict mode: fail on pack load errors
+sentriflow --grx2-pack rules.grx2 --strict-grx2 router.conf
+```
+
+**Machine-Bound vs Portable Packs:**
+
+- **Portable packs**: Work on any machine with a valid license key
+- **Machine-bound packs**: Tied to a specific machine ID for additional security
+
+Use `--show-machine-id` to display your machine ID when requesting machine-bound packs:
+
+```bash
+sentriflow --show-machine-id
+# Output: Machine ID: a1b2c3d4...
+```
+
 ### Directory Scanning
 
 | Option | Description |
@@ -125,7 +184,11 @@ Supported vendors: `cisco-ios`, `juniper-junos`, `palo-alto`, `fortinet`, `arist
       "passed": false,
       "message": "Telnet is enabled - use SSH instead",
       "line": 12,
-      "column": 1
+      "column": 1,
+      "category": "authentication",
+      "tags": [
+        { "type": "security", "label": "plaintext-protocol" }
+      ]
     }
   ]
 }
@@ -159,6 +222,38 @@ Produces SARIF 2.1.0 compliant output for integration with GitHub Code Scanning,
 sentriflow router.conf -f sarif > results.sarif
 ```
 
+SARIF output includes rule categories and tags in the `properties` block:
+
+```json
+{
+  "rules": [{
+    "id": "SEC-001",
+    "properties": {
+      "category": "authentication",
+      "tags": ["security:plaintext-protocol"]
+    }
+  }]
+}
+```
+
+## Rule Categories
+
+List all available categories:
+
+```bash
+sentriflow --list-categories
+```
+
+Filter rules by category:
+
+```bash
+# List only authentication rules
+sentriflow --list-rules --category authentication
+
+# Output as JSON
+sentriflow --list-rules --category encryption --list-format json
+```
+
 ## CI/CD Integration
 
 ### GitHub Actions