centrifuge-cli 0.9.1
A command line utility for interacting with the Centrifuge Firmware Analysis Platform's REST API.
Requires Python: >=3.9,<4.0
Keywords: firmware,security,centrifuge

centrifuge-cli: The official Python CLI for Centrifuge
=======================================================

Centrifuge is an automated firmware analysis platform. It allows users to upload
their firmware images to be analyzed for various security issues. This utility
gives users the ability to interact and automate tasks via the Centrifuge
RESTful API.

Features
--------

- Upload firmware
- Delete firmware reports
- Query firmware analysis results
- Search for firmware uploads

Quick Start
-----------

Check your Python version (must be 3.6 or later):

.. code-block:: bash

    $ python --version

To install the Centrifuge CLI, simply:

.. code-block:: bash

    $ pip install centrifuge-cli

Configure your environment:

.. code-block:: bash

    $ export CENTRIFUGE_APIKEY=xxxx
    $ export CENTRIFUGE_URL=https://centrifuge.refirmlabs.com # change this if you're single tenant or on-premise

To query the list of available reports:

.. code-block:: bash

    $ centrifuge reports list

Under the hood the Centrifuge CLI is using python Pandas data frames to report
the results to the user. Since the API is json, which has hierarchical structure
to it, we have chosen to flatten all the results into a column/row format for
viewing inside of a terminal or for importing into spreadsheets, etc. However
the cli can also output CSV, and the original json results. For example:

CSV:

.. code-block:: bash

    $ centrifuge --outfmt=csv reports list

JSON:

.. code-block:: bash

    $ centrifuge --outfmt=json reports list

When generating the human-readable Pandas output or when generating CSV you have
the option of choosing which columns you wish to export. For example, to display
only the original filename and model number of the firmware that was uploaded: 

.. code-block:: bash

    $ centrifuge -foriginalFilename -fdevice reports list


Uploading Firmware
------------------
Uploading firmware to centrifuge is quite simple. All you need to do is supply
make/model/version and the file you want to upload:

.. code-block:: bash

    $ centrifuge upload --make=Linksys --model=E1200 --version=1.0.04 /path/to/FW_E1200_v1.0.04.001_US_20120307.bin

Searching Through Firmware Uploads
----------------------------------

You can search through the uploaded firmware for keywords in username, filename, make, model, etc:

.. code-block:: bash

    $ centrifuge reports search "Linksys"

Querying Report Results
------------------------

All the following commands require access to what we refer to as a "UFID" or
Upload File ID. This ID can be seen through the web interface, its also the last
part of the URL when viewing a report, it is also the ``id`` field when running
the ``centrifuge reports list`` command above. It should also be noted that all of
these commands also support the ``--outfmt`` argument so you can export to CSV and
to JSON. However be aware that these arguments are positional in nature, you
must supply the ``--outfmt`` argument between ``centrifuge`` and ``report`` on the
command line or it will not be accepted. 

You can see the available commands by viewing the help output:

.. code-block:: bash

  $ centrifuge report --help
  Usage: centrifuge report [OPTIONS] COMMAND [ARGS]...
  
  Options:
    --ufid ID  Centrifuge report ID  [required]
    --help     Show this message and exit.

  Commands:
    binary-hardening
    certificates
    check-policy
    code-emulated
    code-static
    code-summary
    crypto              deprecated (use certificates, public-keys, and...
    delete
    guardian
    info
    passhash
    private-keys
    public-keys
    sbom
    security-checklist

Get basic information about the report (User, Make, Model, Version, filename, etc):

.. code-block:: bash

    $ centrifuge report --ufid=<REPORT_ID> info

Get Guardian Results:

.. code-block:: bash

    $ centrifuge report --ufid=<REPORT_ID> guardian

Get Password Hashes:

.. code-block:: bash

    $ centrifuge report --ufid=<REPORT_ID> passhash

Get Certificates:

.. code-block:: bash

    $ centrifuge report --ufid=<REPORT_ID> certificates

Get Public Keys:

.. code-block:: bash

    $ centrifuge report --ufid=<REPORT_ID> public-keys

Get Private Keys:

.. code-block:: bash

    $ centrifuge report --ufid=<REPORT_ID> private-keys

Get SBOM Results:

.. code-block:: bash

    $ centrifuge report --ufid=<REPORT_ID> sbom

Get Security Checklist Results:

.. code-block:: bash

    $ centrifuge report --ufid=<REPORT_ID> security-checklist

Get Legacy Crypto Results (firmware uploaded before September 30th 2019). Refer to 
``certificates``, ``public-key``, and ``private-key`` now.

.. code-block:: bash

    $ centrifuge report --ufid=<REPORT_ID> crypto


The code analysis section is a little bit more complicated, since the data is
more structured. To understand how to access this data you need to understand
that when we process a firmware we must extract it first, each time we extract a
filesystem or file container those groups of files are given an ``extraction ID``
or ``EXID``. To get code analysis results for an individual file you must know the
``EXID`` and the file's ``PATH`` within that EXID. Luckily there is a ``code-summary``
command which will give you the data you need to find into the ``code-static`` and
``code-emulated`` commands.
 
Get a Summary of the Code Analysis:

.. code-block:: bash

    $ centrifuge report --ufid=<REPORT_ID> code-summary

When looking at the results above from the ``code-summary`` command you need to
record the ``exid`` and ``path`` (*NOT* ``fullPath``), to feed into the next two commands. 

Get static code analysis results:

.. code-block:: bash

    $ centrifuge report --ufid=<REPORT_ID> code-static --exid=<EXID> --path=<PATH>


Get emulated code analysis results:

.. code-block:: bash

    $ centrifuge report --ufid=<REPORT_ID> code-emulated --exid=<EXID> --path=<PATH>


Deleting Firmware Uploads
-------------------------

Deleting a previously uploaded firmware is an unrecoverable action. Unlike the
web interface the command line interface will not prompt you if you are sure.
So use this command carefully. 

To delete a firmware:

.. code-block:: bash

    $ centrifuge report --ufid=<REPORT_ID> delete


Checking Against a Policy YAML
------------------------------

You can check that the results of a firmware analysis are within compliance criteria
defined in a yaml file. Example usage:

.. code-block:: bash

    $ centrifuge report --ufid=<REPORT_ID> check-policy --policy-yaml=<PATH TO YAML>



More information on this feature can be found in the `Policy Documentation`_.

.. _Policy Documentation: docs/POLICY.md

Gathering Upload Statistics
---------------------------

For deployments that support multiple organizations or business units we have the ability
to gather useful statistics for the uploaded firmware based on organization. One command 
will simply give you the total number of firmware that each organization uploaded, the other
command will give more detailed information about each upload.

To summarize multiple organizations you need to be an Administrator. If these commands are
run by a non-admin, instead of summarizing multiple organizations it will summarize the users
within that organization.

To get upload count statistics:

.. code-block:: bash

    $ centrifuge reports stats-summary

To get detailed upload statistics:

.. code-block:: bash

    $ centrifuge reports stats-detailed

Listing Centrifuge Supported Component Detectors
------------------------------------------------

Centrifuge uses binary heuristic detection to identify 3rd party components in firmware,
and also maps known vulnerabilities (CVEs) to those components. New components and CVEs
are added regularly to Centrifuge.

To get a list of the supported components and a count of CVEs for each component:

.. code-block:: bash

    $ centrifuge supported-components