npm package: @netbobr/cli
Description: Pipe-friendly CLI for netbobr firewall rule risk analysis
Latest version: 1.0.4

# @netbobr/cli

Pipe-friendly CLI for firewall rule risk analysis. Validates flows against 6 compliance frameworks (PCI-DSS, CIS Controls, NIST 800-53, NIS2, DORA, MITRE ATT&CK), produces risk scores, and returns meaningful exit codes for pipeline gating.

## Install

```bash
npm install -g @netbobr/cli
```

Or run directly with npx (zero install):

```bash
npx @netbobr/cli analyze ...
```

## Usage

### Inline flags

```bash
netbobr analyze --src 10.0.0.0/8 --dst 203.0.113.5 --proto tcp --port 22
```

### File input

```bash
netbobr analyze firewall-rules.csv --fail-on high
```

### Stdin pipe

```bash
cat rules.json | netbobr analyze - --output json
```

### Cloud formats

Auto-detect or specify the cloud input format:

```bash
# Terraform plan
terraform show -json tfplan | netbobr analyze - --cloud-format tf-plan --fail-on high

# AWS Security Groups
netbobr analyze sgs.json --cloud-format aws-sg --output sarif

# Kubernetes NetworkPolicy
netbobr analyze netpol.yaml --cloud-format k8s-netpol

# Azure NSG
netbobr analyze nsg.json --cloud-format azure-nsg

# Auto-detect
netbobr analyze cloud-export.json --cloud-format auto
```

Supported formats: `aws-sg`, `azure-nsg`, `gcp-fw`, `tf-plan`, `k8s-netpol`, `auto`.

## Output Formats

| Format | Flag | Use Case |
|--------|------|----------|
| JSON | `--output json` | Machine parsing, custom integrations |
| Table | `--output table` | Human-readable terminal output (default for TTY) |
| CSV | `--output csv` | Spreadsheet import, data analysis |
| SARIF | `--output sarif` | GitHub Code Scanning, VS Code |
| PDF | `--output pdf` | Compliance reports (requires `--output-file`) |

JSON is the default when output is piped. Table is the default for interactive terminals.

## Exit Codes

| Exit Code | Severity | Meaning |
|-----------|----------|---------|
| 0 | Low / None | All flows are low risk or clean |
| 1 | Medium | At least one medium-severity finding |
| 2 | High | At least one high-severity finding |
| 3 | Critical | At least one critical-severity finding |

Use `--fail-on <severity>` to set a custom threshold:

```bash
netbobr analyze rules.csv --fail-on high       # fail on high or critical
netbobr analyze rules.csv --fail-on critical    # fail only on critical
netbobr analyze rules.csv --fail-on low         # fail on any finding
```

## Configuration

Load a browser-exported netbobr session to apply custom rules, zones, risk weights, and disabled rules:

```bash
netbobr analyze rules.csv --config netbobr-session.json
```

Export your configuration from the [netbobr web app](https://netbobr.com/app/) using **Session Control > Save**.

## CI/CD Integration

### GitHub Actions

```yaml
- run: npx @netbobr/cli analyze firewall-rules.csv --fail-on high

# With SARIF upload to Code Scanning:
- run: npx @netbobr/cli analyze firewall-rules.csv --output sarif > results.sarif
  continue-on-error: true
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif
  if: always()
```

### Azure DevOps

```yaml
- script: npx @netbobr/cli analyze firewall-rules.csv --fail-on high
  displayName: 'Validate firewall rules'
```

### GitLab CI

```yaml
firewall-validation:
  image: node:20
  script:
    - npx @netbobr/cli analyze firewall-rules.csv --fail-on high
```

See the [full CI/CD documentation](https://netbobr.com/docs/ci-cd/) for detailed platform guides including Jenkins, SARIF integration, PDF artifacts, and severity gating.

## Flags Reference

| Flag | Description |
|------|-------------|
| `--src <ip>` | Source IP/CIDR for inline analysis |
| `--dst <ip>` | Destination IP/CIDR for inline analysis |
| `--proto <protocol>` | Protocol (tcp, udp, icmp, any) |
| `--port <port>` | Port, range, or list (e.g. `80,443,8000-9000`) |
| `--output <format>` | Output format: json, table, csv, sarif, pdf |
| `--output-file <path>` | Output file path (required for PDF) |
| `--config <path>` | Path to netbobr session JSON |
| `--fail-on <severity>` | Exit code threshold: low, medium, high, critical |
| `--frameworks <list>` | Comma-separated frameworks to enable (e.g. `pci,nist,mitre`) |
| `--cloud-format [format]` | Cloud input format (or `auto` to detect) |
| `--quiet` | Suppress non-essential output |

## License

MIT