eiq-platform command line#
Danger
Changes you make using this tool are irreversible.
Tip
To gain root privileges, run sudo -i
.
Requirements: Root-level terminal access to EclecticIQ Intelligence Center instance.
Run all commands here as root.
Before you start#
Before you start, activate EclecticIQ Intelligence Center Python virtual environment:
source /opt/eclecticiq-platform-backend/bin/activate
General Usage#
Run:
eiq-platform --help
to display help text.eiq-platform <command> --help
to display help text for<command>
.
Usage: eiq-platform [OPTIONS] COMMAND [ARGS]...
Umbrella command for administrative tasks for the EclecticIQ platform.
All functionality is available as subcommands, e.g.
eiq-platform database upgrade
All commands provide a `--help` flag for compact usage information. Refer to
the documentation for detailed instructions.
Options:
--help Show this message and exit.
Commands:
blob Blob related commands.
create-fake-stix-packages This script generates fake STIX packages.
database Database (PostgreSQL) related commands.
diagnose Diagnostic commands.
entity Entity related commands.
extensions Extensions related commands.
ingestion Ingestion related commands.
list-commands List all commands.
oauth OAuth related commands.
observable Observable related commands.
outgoing-feed Outgoing Feed related commands.
purge-incoming-feed Delete all data related to an incoming feed.
run-script Execute a script.
saml SAML related commands.
search Search (Elasticsearch) related commands.
shell Launch an interactive Python shell.
stix STIX related commands.
user User related commands.
Create EclecticIQ Intelligence Center administrator account with CLI#
You can create an EclecticIQ Intelligence Center user account with admin
privileges with eiq-platform user create
.
Usage
Usage: eiq-platform user create [OPTIONS]
Create a new user.
When the user name and password are not provided, this commands works
interactively.
Options:
--name TEXT
--password TEXT
--help Show this message and exit.
Delete incoming feed with CLI#
For more information about deleting incoming feeds, see Delete incoming feed content and configuration.
Usage
Usage: eiq-platform purge-incoming-feed [OPTIONS]
Delete all data related to an incoming feed.
Either an incoming feed ID must be provided, for example:
eiq-platform purge-incoming-feed --incoming-feed-id=3
Or provide a source UUID, for example:
--source-id="54cce073-7a04-49d7-9def-28b39438db37"
Options:
-l, --list Print all available incoming feeds
-i, --incoming-feed-id INTEGER ID of the feed to be purged
--source-id UUID UUID of the source to be purged
--help Show this message and exit.
Tip
Enter root mode with sudo -i
To delete an incoming feed using the command line, run as root:
Activate virtual environment:
source /opt/eclecticiq-platform-backend/bin/activate
List existing incoming feeds:
eiq-platform purge-incoming-feed --list
Example output:
This command removes all data related to an incoming feed. That includes all downloaded packages, entities, and observables. Available incoming feeds: ID Source ID Entity Count Feed Name ---- ------------------------------------ -------------- ---------------------------------- 1 0aff8e51-4c4c-4849-9340-b02b1798bfca 0 EclecticIQ Open Sources Feed 2 66d33b8c-bbd6-4281-bf6b-d9818874ee52 0 EclecticIQ Commercial Sources Feed 3 0b7c8b6a-7de5-4f80-ba57-498c75d4f05a 62 TAXII Stand Samples 4 af53c91c-7515-422b-b88a-4c52d2fd956f 258 AlienVault 5 645cfe07-c304-4317-92db-6ebdb52ef942 1 Delete me
Delete the feed:
# To delete the feed "Delete me" using ID eiq-platform purge-incoming-feed --incoming-feed-id=5 # To delete using Source ID eiq-platform purge-incoming-feed --source-id=645cfe07-c304-4317-92db-6ebdb52ef942
You will be prompted twice:
'<Feed Name>' has 1 entities, are you sure you want to delete all? [y/N]:
y to continue.
N to abort.
Do you want to delete the incoming feed configuration? [y/N]:
y to remove both data and feed configuration. Behaves like Delete and purge for incoming feeds.
N to remove only data downloaded and ingested through this feed. Behaves like Delete for incoming feeds.
Once done, the tool prints details of the delete tasks being executed:
{"event": "task.sent", "level": "info", "logger": "eiq.platform.taskrunner.signals", "run": "UUID('b7c94c87-7e06-494e-94bb-d3260fa5869c')", "task_type": "eiq.utilities.delete_incoming_feed", "timestamp": "2023-02-14T13:35:35.967486Z"}
{"event": "Queued background task to delete incoming feed. See log of task worker 'utilities-priority' for purging details.", "level": "info", "logger": "eiq.platform.purging", "timestamp": "2023-02-14T13:35:35.968006Z"}