Package: corelight-client
ContentsOverviewLicenseInstallationAccess and AuthenticationUsageGlobal OptionsConfiguration FileOverviewThis tool provides a command-line client for theCorelight Sensor, aBroappliance engineered from the ground up by Bro’s creators to transform
network traffic into high-fidelity data for your analytics pipeline.
Using the command-line client, you can configure and control a
Corelight Sensor remotely through its comprehensive RESTful API. See
the Corelight Sensor documentation for an extended version of this
client overview.Version:1.5.11Home:http://www.corelight.comGitHub:https://github.com/corelight/corelight-clientAuthor:Corelight, Inc.<info@corelight.com>LicenseThis client is open-source under a BSD license. SeeCOPYINGfor
details.InstallationThe command-line client needs Python >= 3.4 with therequestsmodule installed as its main dependency.The easiest way to install the client is through the Python Package
Index:# pip3 install corelight-clientAlternatively, you can install the latest version from GitHub:# git clone https://github.com/corelight/corelight-client
# cd corelight-client
# python3 setup.py installIf everything is installed correctly,--helpwill give you a usage
message:# corelight-client --help
Usage: corelight-client [<global options>] <command> <subcommand> [<options>]
          [--ssl-ca-cert SSL_CA_CERT] [--ssl-no-verify-certificate]
          [--ssl-no-verify-hostname] [--cache CACHE]
[...]Note that initially,--helpwill not yet show you any further
commands to use. Proceed to the next section to let the client connect
to your device.Access and AuthenticationYou need to enable access to the Corelight API through the device’s
configuration interface. You also need to set passwords for the API
usersadmin(for unlimited access) andmonitor(for read-only
access). See the Corelight Sensor documentation for more information.Next, you need to tell thecorelight-clientthe network address of
your Corelight Sensor. You have three choices for doing that:Add-b<address>to the command-line.Create a configuration file~/.corelight-client.rcwith the contentdevice=<address>.Set the environment variableCORELIGHT_DEVICE=<address>.If that’s all set up,corelight-client--helpwill now ask you for a
username and password, and then show you the full list of commands
that the device API enables the client to offer. If you confirm saving
the credentials, the client will store them in~/.corelight-client/credentialsfor future reuse. You can also specify
authentication information through theConfiguration Fileor asGlobal Options.UsageThe client offers the API’s functionality through a set of commands of
the format<command> <subcommand> [options]. By adding--helpto any command, you get a description of all its functionality and
options.If the--helpoutput lists a command’s option as being of typefile, the client requires you to specify the path to a file to
send. In addition, you can prefix any option’s value withfile://to read its content from a file instead of giving it on the
command-line itself.(Note: The--helpoutput will contain the list of commands only if
the client can connect, and authenticate, to the device.)Global OptionsThecorelight-clientsupports the following global command line
options. The--deviceand--fleetoptions should be used
mutually exclusively from each other. All other options apply to all
requests:--asyncDoes not wait for asynchronous commands to complete before exiting.--deviceSpecifies the network address of a Corelight Sensor device.--fleetSpecifies the network address of a Corelight Fleet Manager.--uidSpecifies the UID of a Corelight Sensor managed through the
specified Corelight Fleet Manager.--cache=<file>Sets a custom file for caching Corelight Sensor meta data.--debugEnables debugging output showing HTTP requests and replies.--passwordSpecifies the password for authentication.--mfaSpecifies the 2FA verification code for authentication with the
specifed Corelight Fleet Manager. Use ‘-’ to ask the user.--ssl-ca-certSpecifies a file containing a custom SSL CA certificate for
validating the device’s authenticity.--ssl-no-verify-certificateInstructs the client to accept any Corelight Sensor SSL certificate.--ssl-no-verify-hostnameInstructs the client to accept the Corelight Sensor’s SSL certificate
even if it does not match its hostname.--socketInstructs the client to use a unix domain socket for sending requests.--userSpecifies the user name for authentication.--versionDisplays the version of thecorelight-clientand exits.Configuration FileThecorelight-clientlooks for a configuration file~/.corelight-client.rc.
The file must consist of lines<key>=<value>. Comments starting
with#are ignored.corelight-clientsupport the following keys:deviceThe network address of a Corelight Sensor device.fleetThe network address of a Corelight Fleet Manager.uidThe UID of a Corelight Sensor managed through the specified Corelight Fleet Manager.userThe user name for authentication.passwordThe password for authentication.mfaThe 2FA verification code for authentication with a Corelight
Fleet Manager. Use ‘-’ to ask the user.ssl-ca-certA file containing a custom SSL CA certificate for validating the device’s
authenticity.ssl-no-verify-certificateIf set tofalse, the client will accept any Corelight Sensor’s SSL
certificate.ssl-no-verify-hostnameIf set tofalse, the client will accept the Corelight Sensor’s SSL
certificate even if it does not match its hostname.socketA unix domain socket to use for sending requests.