powerpipe detection
List, view, and run powerpipe detections.
Usage
Sub-Commands
| Command | Description |
|---|---|
| list | List detections from the current mod and its direct dependents. |
| run | Run a detection from the current mod or its direct dependents. |
| show | Show details of a detection from the current mod or its direct dependents. |
powerpipe detection list
List detections from the current mod and its direct dependents.
Examples
List detections:
List all detections in JSON format:
List detections using settings from a workspace:
powerpipe detection show
Show details of a detection from the current mod or its direct dependents.
Examples
Show details of a single detection in the current mod:
Show details of a single detection in a direct dependency mod: [[not yet?]]
Show details of a detection in JSON format:
Show details of a detection using settings from a workspace:
powerpipe detection run
Run a detection from the current mod or its direct dependents.
Arguments
Usage: powerpipe detection run [flags] [detection]
| Flag | Description |
|---|---|
| --arg stringArray | Specify the value of a detection argument. |
| --database string | Turbot Pipes workspace database. DEPRECATED: See documentation for the new syntax. |
| --detection-timeout int | Set the detection execution timeout. |
| --export strings | Export output to file. Supported format: pps (snapshot). |
| -h, --help | Help for detection. |
| --input | Enable interactive prompts. (default: true) |
| --max-parallel int | The maximum number of concurrent database connections to open. (default: 10) |
| --mod-install | Specify whether to install mod dependencies before running the detection. (default: true) |
| --mod-location string | Sets the workspace working directory. If not specified, the workspace directory will be set to the current working directory. (default: /home/jon/tailpipe-mod-github-detections) |
| --output output | Output format: snapshot, pps, none. (default: pps) |
| --pipes-host string | Turbot Pipes host. (default: pipes.turbot.com) |
| --pipes-token string | Turbot Pipes authentication token. |
| --progress | Display detection execution progress when a detection name argument is passed. (default: true) |
| --pull pull | Update strategy: full, latest, development, minimal. (default: minimal) |
| --query-timeout int | The query timeout in seconds. (default: 300) |
| --share | Create snapshot in Turbot Pipes with anyone_with_link visibility. |
| --snapshot | Create snapshot in Turbot Pipes with the default (workspace) visibility. |
| --snapshot-location string | The location to write snapshots: either a local file path or a Turbot Pipes workspace. |
| --snapshot-tag stringArray | Specify tags to set on the snapshot. |
| --snapshot-title string | The title to give a snapshot. |
| --var stringArray | Specify the value of a variable. |
| --var-file strings | Specify a .ppvar file containing variable values. |
Examples
Run a detection and output the snapshot data:
Run a detection and output the snapshot data to a file: