Package: zanshincli
Zanshin CLIThis Python package provides a command-line utility to interact with theAPI of the Zanshin SaaS
servicefromTenchi
Security.Is it based on the Zanshin Python SDK available onGithubandPyPI.If you are a Zanshin customer and have any questions regarding the use
of the service, its API or this command-line utility, please get in
touch via e-mail at support {at} tenchisecurity {dot} com or via the
support widget on theZanshin
Portal.InstallationWe recommend the CLI is installed usingpipx, using the command:pipxinstallzanshincliWhen a new version is available, you can upgrade it with:pipxupgradezanshincliConfiguration FileThe way the SDK and CLI handles credentials is by using a configuration
file in the format created by the PythonRawConfigParserclass.The file is located at~/.tenchi/config, where~is thecurrent
user’s home
directory.Each section is treated as a configuration profile, and the SDK and CLI
will look for a section calleddefaultif another is not explicitly
selected.These are the supported options:api_key(required) which contains the Zanshin API key obtained at
theZanshin web
portal.user_agent(optional) allows you to override the default
user-agent header used by the SDK when making API requests.api_url(optional) directs the SDK and CLI to use a different API
endpoint than the default
(https://api.zanshin.tenchisecurity.com).You can populate the file with thezanshin initcommand of the CLI
tool. This is what a minimal configuration file would look like:[default]api_key=abcdefghijklmnopqrstuvxyzUsing the CLI UtilityThis package installs a command-line utility calledzanshinbuilt
with the greatTyperpackage.You can obtain help by using the--helpoption.Keep in mind that when options are present that expect multiple values,
these need to be provided as multiple options. For example if you wanted
to list an organization’s alerts filtering by the OPEN and RISK_ACCEPTED
states, this is the command you would use:$zanshinorganizationalertsd48edaa6-871a-4082-a196-4daab372d4a1--stateOPEN--stateRISK_ACCEPTEDCommand ReferencezanshinCommand-line utility to interact with the Zanshin SaaS service offered
by Tenchi Security
(https://tenchisecurity.com), go tohttps://github.com/tenchi-security/zanshin-clifor license, source code and documentationUsage:$zanshin[OPTIONS]COMMAND[ARGS]...Options:--profileTEXT: Configuration file section to read API keyand
configuration from [default: default]--format[json|table|csv|html]: Output format to use for list
operations [default: json]--verbose/--no-verbose: Print more information to stderr
[default: True]--debug/--no-debug: Enable debug logging in the SDK [default:
False]--install-completion: Install completion for the current shell.--show-completion: Show completion for the current shell, to copy
it or customize the installation.--help: Show this message and exit.Commands:account: Operations on user the API key owner has…alert: Operations on alerts the API key owner has…init: Update settings on configuration file.organization: Operations on organizations the API key owner…summary: Operations on summaries the API key owner has…version: Display the program and Python versions in…zanshin accountOperations on user the API key owner has direct access toUsage:$zanshinaccount[OPTIONS]COMMAND[ARGS]...Options:--help: Show this message and exit.Commands:api_key: Operations on API keys from account the API…invites: Operations on invites from account the API…me: Returns the details of the user account that…zanshin account api_keyOperations on API keys from account the API key owner has direct access
toUsage:$zanshinaccountapi_key[OPTIONS]COMMAND[ARGS]...Options:--help: Show this message and exit.Commands:create: Creates a new API key for the current logged…delete: Deletes a given API key by its id, it will…list: Iterates over the API keys of current logged…zanshin account api_key createCreates a new API key for the current logged user, API Keys can be used
to interact with the zanshin api directly a behalf of that user.Usage:$zanshinaccountapi_keycreate[OPTIONS]NAMEArguments:NAME: Name of the new API key [required]Options:--help: Show this message and exit.zanshin account api_key deleteDeletes a given API key by its id, it will only work if the informed ID
belongs to the current logged user.Usage:$zanshinaccountapi_keydelete[OPTIONS]API_KEY_IDArguments:API_KEY_ID: UUID of the invite to delete [required]Options:--help: Show this message and exit.zanshin account api_key listIterates over the API keys of current logged user.Usage:$zanshinaccountapi_keylist[OPTIONS]Options:--help: Show this message and exit.zanshin account invitesOperations on invites from account the API key owner has direct access
toUsage:$zanshinaccountinvites[OPTIONS]COMMAND[ARGS]...Options:--help: Show this message and exit.Commands:accept: Accepts an invitation with the informed ID,…get: Gets a specific invitation details, it only…list: Iterates over the invites of current logged…zanshin account invites acceptAccepts an invitation with the informed ID, it only works if the user
accepting the invitation is the user that received the invitation.Usage:$zanshinaccountinvitesaccept[OPTIONS]INVITE_IDArguments:INVITE_ID: UUID of the invite [required]Options:--help: Show this message and exit.zanshin account invites getGets a specific invitation details, it only works if the invitation was
made for the current logged user.Usage:$zanshinaccountinvitesget[OPTIONS]INVITE_IDArguments:INVITE_ID: UUID of the invite [required]Options:--help: Show this message and exit.zanshin account invites listIterates over the invites of current logged user.Usage:$zanshinaccountinviteslist[OPTIONS]Options:--help: Show this message and exit.zanshin account meReturns the details of the user account that owns the API key used by
this Connection instance as perUsage:$zanshinaccountme[OPTIONS]Options:--help: Show this message and exit.zanshin alertOperations on alerts the API key owner has direct access toUsage:$zanshinalert[OPTIONS]COMMAND[ARGS]...Options:--help: Show this message and exit.Commands:get: Returns details about a specified alertlist: List alerts from a given organization, with…list_following: List following alerts from a given…list_grouped: List grouped alerts from a given…list_grouped_following: List grouped following alerts from a
given…list_history: List alerts from a given organization, with…list_history_following: List alerts from a given organization,
with…update: Updates the alert.zanshin alert getReturns details about a specified alertUsage:$zanshinalertget[OPTIONS]ALERT_IDArguments:ALERT_ID: UUID of the alert to look up [required]Options:--list-history/--no-list-history: History of this alert.
[default: False]--list-comments/--no-list-comments: Comments of this alert.
[default: False]--help: Show this message and exit.zanshin alert listList alerts from a given organization, with optional filters by scan
target, state or severity.Usage:$zanshinalertlist[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--scan-target-idUUID: Only list alerts from the specifiedscan
targets.--states[OPEN|ACTIVE|IN_PROGRESS|RISK_ACCEPTED|MITIGATING_CONTROL|FALSE_POSITIVE|CLOSED]:
Only list alerts in the specified states. [default: OPEN,
IN_PROGRESS, RISK_ACCEPTED, MITIGATING_CONTROL, FALSE_POSITIVE]--severity[CRITICAL|HIGH|MEDIUM|LOW|INFO]: Only list alerts with
the specifiedseverities [default: CRITICAL, HIGH, MEDIUM, LOW, INFO]--language[pt-BR|en-US]: Show alert titles in the specified
language [default: en-US]--created-at-startTEXT: Date created starts at (format
YYYY-MM-DDTHH:MM:SS)--created-at-endTEXT: Date created ends at (format
YYYY-MM-DDTHH:MM:SS)--updated-at-startTEXT: Date updated starts at (format
YYYY-MM-DDTHH:MM:SS)--updated-at-endTEXT: Date updated ends at (format
YYYY-MM-DDTHH:MM:SS)--searchTEXT: Text to search for in the alerts [default: ]--sort[asc|desc]: Sort order [default: desc]--order[scanTargetId|resource|rule|severity|state|createdAt|updatedAt]:
Field to sort results on [default: severity]--help: Show this message and exit.zanshin alert list_followingList following alerts from a given organization, with optional filters
by following ids, state or severity.Usage:$zanshinalertlist_following[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--following-idsUUID: Only list alerts from the specified scan
targets.--states[OPEN|ACTIVE|IN_PROGRESS|RISK_ACCEPTED|MITIGATING_CONTROL|FALSE_POSITIVE|CLOSED]:
Only list alerts in the specified states. [default: OPEN,
IN_PROGRESS, RISK_ACCEPTED, MITIGATING_CONTROL, FALSE_POSITIVE]--severity[CRITICAL|HIGH|MEDIUM|LOW|INFO]: Only list alerts with
the specified severities [default: CRITICAL, HIGH, MEDIUM, LOW, INFO]--created-at-startTEXT: Date created starts at (format
YYYY-MM-DDTHH:MM:SS)--created-at-endTEXT: Date created ends at (format
YYYY-MM-DDTHH:MM:SS)--updated-at-startTEXT: Date updated starts at (format
YYYY-MM-DDTHH:MM:SS)--updated-at-endTEXT: Date updated ends at (format
YYYY-MM-DDTHH:MM:SS)--searchTEXT: Text to search for in the alerts [default: ]--sort[asc|desc]: Sort order [default: desc]--order[scanTargetId|resource|rule|severity|state|createdAt|updatedAt]:
Field to sort results on [default: severity]--help: Show this message and exit.zanshin alert list_groupedList grouped alerts from a given organization, with optional filters by
scan target, state or severity.Usage:$zanshinalertlist_grouped[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--scan-target-idUUID: Only list alerts from the specifiedscan
targets.--state[OPEN|ACTIVE|IN_PROGRESS|RISK_ACCEPTED|MITIGATING_CONTROL|FALSE_POSITIVE|CLOSED]:
Only list alerts in the specified states. [default: OPEN,
IN_PROGRESS, RISK_ACCEPTED, MITIGATING_CONTROL, FALSE_POSITIVE]--severity[CRITICAL|HIGH|MEDIUM|LOW|INFO]: Only list alerts with
the specifiedseverities [default: CRITICAL, HIGH, MEDIUM, LOW, INFO]--help: Show this message and exit.zanshin alert list_grouped_followingList grouped following alerts from a given organization, with optional
filters by scan target, state or severity.Usage:$zanshinalertlist_grouped_following[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--following-idsUUID: Only list alerts from thespecified scan
targets.--state[OPEN|ACTIVE|IN_PROGRESS|RISK_ACCEPTED|MITIGATING_CONTROL|FALSE_POSITIVE|CLOSED]:
Only list alerts in the specified states. [default: OPEN,
IN_PROGRESS, RISK_ACCEPTED, MITIGATING_CONTROL, FALSE_POSITIVE]--severity[CRITICAL|HIGH|MEDIUM|LOW|INFO]: Only list alerts with
the specified severities [default: CRITICAL, HIGH, MEDIUM, LOW, INFO]--help: Show this message and exit.zanshin alert list_historyList alerts from a given organization, with optional filters by scan
target, state or severity.Usage:$zanshinalertlist_history[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--scan-target-idUUID: Only list alerts from the specifiedscan
targets.--cursorTEXT: Cursor.--persist/--no-persist: Persist. [default: False]--help: Show this message and exit.zanshin alert list_history_followingList alerts from a given organization, with optional filters by scan
target, state or severity.Usage:$zanshinalertlist_history_following[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--following-idsUUID: Only list alerts from the specifiedscan
targets.--cursorTEXT: Cursor.--persist/--no-persist: Persist. [default: False]--help: Show this message and exit.zanshin alert updateUpdates the alert.Usage:$zanshinalertupdate[OPTIONS]ORGANIZATION_IDSCAN_TARGET_IDALERT_IDArguments:ORGANIZATION_ID: UUID of the organization that owns the alert
[required]SCAN_TARGET_ID: UUID of the scan target associated with the alert
[required]ALERT_ID: UUID of the alert [required]Options:--state[OPEN|IN_PROGRESS|RISK_ACCEPTED|MITIGATING_CONTROL|FALSE_POSITIVE]:
New alert state--labelsTEXT: Custom label(s) for the alert--commentTEXT: A comment when closing the alert with
RISK_ACCEPTED, FALSE_POSITIVE, MITIGATING_CONTROL--help: Show this message and exit.zanshin initUpdate settings on configuration file.Usage:$zanshininit[OPTIONS]Options:--help: Show this message and exit.zanshin organizationOperations on organizations the API key owner has direct access toUsage:$zanshinorganization[OPTIONS]COMMAND[ARGS]...Options:--help: Show this message and exit.Commands:follower: Operations on followers of organization the…following: Operations on following of organization the…get: Gets an organization given its ID.list: Lists the organizations this user has direct…member: Operations on members of organization the API…scan_target: Operations on scan targets from organizations…update: Gets an organization given its ID.zanshin organization followerOperations on followers of organization the API key owner has direct
access toUsage:$zanshinorganizationfollower[OPTIONS]COMMAND[ARGS]...Options:--help: Show this message and exit.Commands:list: Lists the followers of organization this user…request: Operations on follower requests of…stop: Stops one organization follower of another.zanshin organization follower listLists the followers of organization this user has direct access to.Usage:$zanshinorganizationfollowerlist[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--help: Show this message and exit.zanshin organization follower requestOperations on follower requests of organization the API key owner has
directaccess toUsage:$zanshinorganizationfollowerrequest[OPTIONS]COMMAND[ARGS]...Options:--help: Show this message and exit.Commands:create: Create organization follower request.delete: Delete organization follower request.get: Get organization follower request.list: Lists the follower requests of organization…zanshin organization follower request createCreate organization follower request.Usage:$zanshinorganizationfollowerrequestcreate[OPTIONS]ORGANIZATION_IDTOKENArguments:ORGANIZATION_ID: UUID of the organization [required]TOKEN: Token of the follower request [required]Options:--help: Show this message and exit.zanshin organization follower request deleteDelete organization follower request.Usage:$zanshinorganizationfollowerrequestdelete[OPTIONS]ORGANIZATION_IDTOKENArguments:ORGANIZATION_ID: UUID of the organization [required]TOKEN: Token of the follower request [required]Options:--help: Show this message and exit.zanshin organization follower request getGet organization follower request.Usage:$zanshinorganizationfollowerrequestget[OPTIONS]ORGANIZATION_IDTOKENArguments:ORGANIZATION_ID: UUID of the organization [required]TOKEN: Token of the follower request [required]Options:--help: Show this message and exit.zanshin organization follower request listLists the follower requests of organization this user has direct access
to.Usage:$zanshinorganizationfollowerrequestlist[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--help: Show this message and exit.zanshin organization follower stopStops one organization follower of another.Usage:$zanshinorganizationfollowerstop[OPTIONS]ORGANIZATION_IDORGANIZATION_FOLLOWER_IDArguments:ORGANIZATION_ID: UUID of the organization [required]ORGANIZATION_FOLLOWER_ID: UUID of the organization follower
[required]Options:--help: Show this message and exit.zanshin organization followingOperations on following of organization the API key owner has direct
access toUsage:$zanshinorganizationfollowing[OPTIONS]COMMAND[ARGS]...Options:--help: Show this message and exit.Commands:list: Lists the following of organization this user…request: Operations on following requests of…stop: Stops one organization following of another.zanshin organization following listLists the following of organization this user has direct access to.Usage:$zanshinorganizationfollowinglist[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--help: Show this message and exit.zanshin organization following requestOperations on following requests of organization the API key owner
hasdirect access toUsage:$zanshinorganizationfollowingrequest[OPTIONS]COMMAND[ARGS]...Options:--help: Show this message and exit.Commands:accept: Accepts a request to follow another…decline: Declines a request to follow another…get: Returns a request received by an organization…list: Lists the following requests of organization…zanshin organization following request acceptAccepts a request to follow another organization.Usage:$zanshinorganizationfollowingrequestaccept[OPTIONS]ORGANIZATION_IDFOLLOWING_IDArguments:ORGANIZATION_ID: UUID of the organization [required]FOLLOWING_ID: UUID of the following request [required]Options:--help: Show this message and exit.zanshin organization following request declineDeclines a request to follow another organization.Usage:$zanshinorganizationfollowingrequestdecline[OPTIONS]ORGANIZATION_IDFOLLOWING_IDArguments:ORGANIZATION_ID: UUID of the organization [required]FOLLOWING_ID: UUID of the following request [required]Options:--help: Show this message and exit.zanshin organization following request getReturns a request received by an organization to follow another.Usage:$zanshinorganizationfollowingrequestget[OPTIONS]ORGANIZATION_IDFOLLOWING_IDArguments:ORGANIZATION_ID: UUID of the organization [required]FOLLOWING_ID: UUID of the following request [required]Options:--help: Show this message and exit.zanshin organization following request listLists the following requests of organization this user has direct access
to.Usage:$zanshinorganizationfollowingrequestlist[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--help: Show this message and exit.zanshin organization following stopStops one organization following of another.Usage:$zanshinorganizationfollowingstop[OPTIONS]ORGANIZATION_IDORGANIZATION_FOLLOWING_IDArguments:ORGANIZATION_ID: UUID of the organization [required]ORGANIZATION_FOLLOWING_ID: UUID of the organization following
[required]Options:--help: Show this message and exit.zanshin organization getGets an organization given its ID.Usage:$zanshinorganizationget[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--help: Show this message and exit.zanshin organization listLists the organizations this user has direct access to as a member.Usage:$zanshinorganizationlist[OPTIONS]Options:--help: Show this message and exit.zanshin organization memberOperations on members of organization the API key owner has direct
access toUsage:$zanshinorganizationmember[OPTIONS]COMMAND[ARGS]...Options:--help: Show this message and exit.Commands:delete: Delete organization member.get: Get organization member.invite: Operations on member invites of organization…list: Lists the members of organization this user…update: Update organization member.zanshin organization member deleteDelete organization member.Usage:$zanshinorganizationmemberdelete[OPTIONS]ORGANIZATION_IDORGANIZATION_MEMBER_IDArguments:ORGANIZATION_ID: UUID of the organization [required]ORGANIZATION_MEMBER_ID: UUID of the organization member
[required]Options:--help: Show this message and exit.zanshin organization member getGet organization member.Usage:$zanshinorganizationmemberget[OPTIONS]ORGANIZATION_IDORGANIZATION_MEMBER_IDArguments:ORGANIZATION_ID: UUID of the organization [required]ORGANIZATION_MEMBER_ID: UUID of the organization member
[required]Options:--help: Show this message and exit.zanshin organization member inviteOperations on member invites of organization the API key owner has
directaccess toUsage:$zanshinorganizationmemberinvite[OPTIONS]COMMAND[ARGS]...Options:--help: Show this message and exit.Commands:create: Create organization member invite.delete: Delete organization member invite.get: Get organization member invite.list: Lists the member invites of organization this…resend: Resend organization member invitation.zanshin organization member invite createCreate organization member invite.Usage:$zanshinorganizationmemberinvitecreate[OPTIONS]ORGANIZATION_IDORGANIZATION_MEMBER_INVITE_EMAILArguments:ORGANIZATION_ID: UUID of the organization [required]ORGANIZATION_MEMBER_INVITE_EMAIL: E-mail of the organization
member [required]Options:--organization-member-invite-role[ADMIN]: Role of the
organization member [default: ADMIN]--help: Show this message and exit.zanshin organization member invite deleteDelete organization member invite.Usage:$zanshinorganizationmemberinvitedelete[OPTIONS]ORGANIZATION_IDORGANIZATION_MEMBER_INVITE_EMAILArguments:ORGANIZATION_ID: UUID of the organization [required]ORGANIZATION_MEMBER_INVITE_EMAIL: E-mail of the organization
member [required]Options:--help: Show this message and exit.zanshin organization member invite getGet organization member invite.Usage:$zanshinorganizationmemberinviteget[OPTIONS]ORGANIZATION_IDORGANIZATION_MEMBER_INVITE_EMAILArguments:ORGANIZATION_ID: UUID of the organization [required]ORGANIZATION_MEMBER_INVITE_EMAIL: E-mail of the organization
member invite [required]Options:--help: Show this message and exit.zanshin organization member invite listLists the member invites of organization this user has direct access to.Usage:$zanshinorganizationmemberinvitelist[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--help: Show this message and exit.zanshin organization member invite resendResend organization member invitation.Usage:$zanshinorganizationmemberinviteresend[OPTIONS]ORGANIZATION_IDORGANIZATION_MEMBER_INVITE_EMAILArguments:ORGANIZATION_ID: UUID of the organization [required]ORGANIZATION_MEMBER_INVITE_EMAIL: E-mail of the organization
member [required]Options:--help: Show this message and exit.zanshin organization member listLists the members of organization this user has direct access to.Usage:$zanshinorganizationmemberlist[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--help: Show this message and exit.zanshin organization member updateUpdate organization member.Usage:$zanshinorganizationmemberupdate[OPTIONS]ORGANIZATION_IDORGANIZATION_MEMBER_IDArguments:ORGANIZATION_ID: UUID of the organization [required]ORGANIZATION_MEMBER_ID: UUID of the organization member
[required]Options:--role[ADMIN]: Role of the organization member [default: ADMIN]--help: Show this message and exit.zanshin organization scan_targetOperations on scan targets from organizations the API key owner has
direct access toUsage:$zanshinorganizationscan_target[OPTIONS]COMMAND[ARGS]...Options:--help: Show this message and exit.Commands:check: Check scan target.create: Create a new scan target in organization.delete: Delete scan target of organization.get: Get scan target of organization.list: Lists the scan targets of organization this…onboard_aws: Create a new scan target in organization and…onboard_aws_organization: For each of selected accounts in AWS…scan: Operations on scan targets from organizations…update: Update scan target of organization.zanshin organization scan_target checkCheck scan target.Usage:$zanshinorganizationscan_targetcheck[OPTIONS]ORGANIZATION_IDSCAN_TARGET_IDArguments:ORGANIZATION_ID: UUID of the organization [required]SCAN_TARGET_ID: UUID of the scan target [required]Options:--help: Show this message and exit.zanshin organization scan_target createCreate a new scan target in organization.Usage:$zanshinorganizationscan_targetcreate[OPTIONS]ORGANIZATION_IDKIND:[AWS|GCP|AZURE|HUAWEI|DOMAIN|ORACLE]NAMECREDENTIAL[SCHEDULE]:[1h|6h|12h|24h|7d]Arguments:ORGANIZATION_ID: UUID of the organization [required]KIND:[AWS|GCP|AZURE|HUAWEI|DOMAIN|ORACLE]: kind of the scan
target [required]NAME: name of the scan target [required]CREDENTIAL: credential of the scan target [required][SCHEDULE]:[1h|6h|12h|24h|7d]: schedule of the scan target
[default: 24h]Options:--help: Show this message and exit.zanshin organization scan_target deleteDelete scan target of organization.Usage:$zanshinorganizationscan_targetdelete[OPTIONS]ORGANIZATION_IDSCAN_TARGET_IDArguments:ORGANIZATION_ID: UUID of the organization [required]SCAN_TARGET_ID: UUID of the scan target [required]Options:--help: Show this message and exit.zanshin organization scan_target getGet scan target of organization.Usage:$zanshinorganizationscan_targetget[OPTIONS]ORGANIZATION_IDSCAN_TARGET_IDArguments:ORGANIZATION_ID: UUID of the organization [required]SCAN_TARGET_ID: UUID of the scan target [required]Options:--help: Show this message and exit.zanshin organization scan_target listLists the scan targets of organization this user has direct access to.Usage:$zanshinorganizationscan_targetlist[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--help: Show this message and exit.zanshin organization scan_target onboard_awsCreate a new scan target in organization and perform onboard. Requires
boto3 and correct AWS IAM Privileges. Checkout the required AWS IAM
privileges herehttps://github.com/tenchi-security/zanshin-sdk-python/blob/main/zanshinsdk/docs/README.mdUsage:$zanshinorganizationscan_targetonboard_aws[OPTIONS]REGIONORGANIZATION_IDNAMECREDENTIAL[SCHEDULE]:[1h|6h|12h|24h|7d]Arguments:REGION: AWS Region to deploy CloudFormation [required]ORGANIZATION_ID: UUID of the organization [required]NAME: name of the scan target [required]CREDENTIAL: credential of the scan target [required][SCHEDULE]:[1h|6h|12h|24h|7d]: schedule of the scan target
[default: 24h]Options:--boto3-profileTEXT: Boto3 profile name to use for Onboard AWS
Account--help: Show this message and exit.zanshin organization scan_target onboard_aws_organizationFor each of selected accounts in AWS Organization, creates a new Scan
Target in informed zanshin organization and performs onboarding.
Requires boto3 and correct AWS IAM Privileges. Checkout the required AWS
IAM privileges athttps://github.com/tenchi-security/zanshin-cli/blob/main/zanshincli/docs/README.mdUsage:$zanshinorganizationscan_targetonboard_aws_organization[OPTIONS]REGIONORGANIZATION_ID[SCHEDULE]:[1h|6h|12h|24h|7d]Arguments:REGION: AWS Region to deploy CloudFormation [required]ORGANIZATION_ID: UUID of the organization [required][SCHEDULE]:[1h|6h|12h|24h|7d]: schedule of the scan target
[default: 24h]Options:--target-accounts[ALL|MASTER|MEMBERS|NONE]: choose which
accounts to onboard--exclude-accountTEXT: ID, Name, E-mail or ARN of AWS Account
not to be onboarded--boto3-profileTEXT: Boto3 profile name to use for Onboard AWS
Account--aws-role-nameTEXT: Name of AWS role that allow access from
Management Account to Member accounts [default:
OrganizationAccountAccessRole]--help: Show this message and exit.zanshin organization scan_target scanOperations on scan targets from organizations the API key owner has
direct access toUsage:$zanshinorganizationscan_targetscan[OPTIONS]COMMAND[ARGS]...Options:--help: Show this message and exit.Commands:get: Get scan of scan target.list: Lists the scan target scans of organization…start: Starts a scan on the specified scan target.stop: Stop a scan on the specified scan target.zanshin organization scan_target scan getGet scan of scan target.Usage:$zanshinorganizationscan_targetscanget[OPTIONS]ORGANIZATION_IDSCAN_TARGET_IDSCAN_IDArguments:ORGANIZATION_ID: UUID of the organization [required]SCAN_TARGET_ID: UUID of the scan target [required]SCAN_ID: UUID of the scan [required]Options:--help: Show this message and exit.zanshin organization scan_target scan listLists the scan target scans of organization this user has direct access
to.Usage:$zanshinorganizationscan_targetscanlist[OPTIONS]ORGANIZATION_IDSCAN_TARGET_IDArguments:ORGANIZATION_ID: UUID of the organization [required]SCAN_TARGET_ID: UUID of the scan target [required]Options:--help: Show this message and exit.zanshin organization scan_target scan startStarts a scan on the specified scan target.Usage:$zanshinorganizationscan_targetscanstart[OPTIONS]ORGANIZATION_IDSCAN_TARGET_IDArguments:ORGANIZATION_ID: UUID of the organization [required]SCAN_TARGET_ID: UUID of the scan target [required]Options:--force/--no-force: Whether to force running a scan target that
has state INVALID_CREDENTIAL or NEW [default: False]--help: Show this message and exit.zanshin organization scan_target scan stopStop a scan on the specified scan target.Usage:$zanshinorganizationscan_targetscanstop[OPTIONS]ORGANIZATION_IDSCAN_TARGET_IDArguments:ORGANIZATION_ID: UUID of the organization [required]SCAN_TARGET_ID: UUID of the scan target [required]Options:--help: Show this message and exit.zanshin organization scan_target updateUpdate scan target of organization.Usage:$zanshinorganizationscan_targetupdate[OPTIONS]ORGANIZATION_IDSCAN_TARGET_ID[NAME][SCHEDULE]:[1h|6h|12h|24h|7d]Arguments:ORGANIZATION_ID: UUID of the organization [required]SCAN_TARGET_ID: UUID of the scan target [required][NAME]: name of the scan target[SCHEDULE]:[1h|6h|12h|24h|7d]: schedule of the scan targetOptions:--help: Show this message and exit.zanshin organization updateGets an organization given its ID.Usage:$zanshinorganizationupdate[OPTIONS]ORGANIZATION_ID[NAME][PICTURE][EMAIL]Arguments:ORGANIZATION_ID: UUID of the organization [required][NAME]: Name of the organization[PICTURE]: Picture of the organization[EMAIL]: Contact e-mail of the organizationOptions:--help: Show this message and exit.zanshin summaryOperations on summaries the API key owner has direct access toUsage:$zanshinsummary[OPTIONS]COMMAND[ARGS]...Options:--help: Show this message and exit.Commands:alert: Gets a summary of the current state of alerts…alert_following: Gets a summary of the current state of alerts…scan: Returns summaries of scan results over a…scan_following: Returns summaries of scan results over a…zanshin summary alertGets a summary of the current state of alerts for an organization, both
in total and broken down by scan target.Usage:$zanshinsummaryalert[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--scan-target-idUUID: Only summarize alerts from the
specifiedscan targets, defaults to all.--help: Show this message and exit.zanshin summary alert_followingGets a summary of the current state of alerts for followed
organizations.Usage:$zanshinsummaryalert_following[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--following-idsUUID: Only summarize alerts from thespecified
following, defaults toall.--help: Show this message and exit.zanshin summary scanReturns summaries of scan results over a period of time, summarizing
number of alerts that changed states.Usage:$zanshinsummaryscan[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--scan-target-idsUUID: Only summarize alerts from the
specifiedscan targets, defaults to all.--daysINTEGER: Number of days to go back in time in historical
search [default: 7]--help: Show this message and exit.zanshin summary scan_followingReturns summaries of scan results over a period of time, summarizing
number of alerts that changed states.Usage:$zanshinsummaryscan_following[OPTIONS]ORGANIZATION_IDArguments:ORGANIZATION_ID: UUID of the organization [required]Options:--following-idsUUID: Only summarize alerts from thespecified
following, defaults toall.--daysINTEGER: Number of days to go back in time in
historicalsearch [default: 7]--help: Show this message and exit.zanshin versionDisplay the program and Python versions in use.Usage:$zanshinversion[OPTIONS]Options:--help: Show this message and exit.