-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathcli-map-v.html
More file actions
52 lines (52 loc) · 17.3 KB
/
Copy pathcli-map-v.html
File metadata and controls
52 lines (52 loc) · 17.3 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
<!doctype html>
<html>
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<meta http-equiv="X-UA-Compatible" content="ie=edge" />
<title>Markmap</title>
<style>
* {
margin: 0;
padding: 0;
}
html {
font-family: ui-sans-serif, system-ui, sans-serif, 'Apple Color Emoji',
'Segoe UI Emoji', 'Segoe UI Symbol', 'Noto Color Emoji';
}
#mindmap {
display: block;
width: 100vw;
height: 100vh;
}
.markmap-dark {
background: #27272a;
color: white;
}
</style>
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/markmap-toolbar@0.18.12/dist/style.css">
</head>
<body>
<svg id="mindmap"></svg>
<script src="https://cdn.jsdelivr.net/npm/d3@7.9.0/dist/d3.min.js"></script><script src="https://cdn.jsdelivr.net/npm/markmap-view@0.18.12/dist/browser/index.js"></script><script src="https://cdn.jsdelivr.net/npm/markmap-toolbar@0.18.12/dist/index.js"></script><script>((r) => {
setTimeout(r);
})(() => {
const { markmap, mm } = window;
const toolbar = new markmap.Toolbar();
toolbar.attach(mm);
const el = toolbar.render();
el.setAttribute("style", "position:absolute;bottom:20px;right:20px");
document.body.append(el);
})</script><script>((getMarkmap, getOptions, root2, jsonOptions) => {
const markmap = getMarkmap();
window.mm = markmap.Markmap.create(
"svg#mindmap",
(getOptions || markmap.deriveOptions)(jsonOptions),
root2
);
if (window.matchMedia("(prefers-color-scheme: dark)").matches) {
document.documentElement.classList.add("markmap-dark");
}
})(() => window.markmap,null,{"content":"twsla CLI","children":[{"content":"Global Flags","children":[{"content":"<code>--config</code>: config file (default $HOME/.twsla.yaml)","children":[],"payload":{"tag":"li","lines":"3,4"}},{"content":"<code>-d, --datastore</code>: Bbolt Log DB (default "./twsla.db")","children":[],"payload":{"tag":"li","lines":"4,5"}},{"content":"<code>-t, --timeRange</code>: Time range","children":[],"payload":{"tag":"li","lines":"5,6"}},{"content":"<code>-f, --filter</code>: Simple filter","children":[],"payload":{"tag":"li","lines":"6,7"}},{"content":"<code>-r, --regex</code>: Regexp filter","children":[],"payload":{"tag":"li","lines":"7,8"}},{"content":"<code>-v, --not</code>: Invert regexp filter","children":[],"payload":{"tag":"li","lines":"8,9"}},{"content":"<code>--sixel</code>: show chart by sixel","children":[],"payload":{"tag":"li","lines":"9,11"}}],"payload":{"tag":"h2","lines":"2,3"}},{"content":"Commands","children":[{"content":"ai","children":[{"content":"<code>ai <filter>...</code>: AI-powered log analysis","children":[],"payload":{"tag":"li","lines":"14,15"}},{"content":"Flags","children":[{"content":"<code>--aiProvider</code>: AI provider (ollama|gemini|openai|claude)","children":[],"payload":{"tag":"li","lines":"16,17"}},{"content":"<code>--aiBaseURL</code>: AI base URL","children":[],"payload":{"tag":"li","lines":"17,18"}},{"content":"<code>--aiModel</code>: LLM Model name","children":[],"payload":{"tag":"li","lines":"18,19"}},{"content":"<code>--aiErrorLevels</code>: Words included in the error level log (default "error,fatal,fail,crit,alert")","children":[],"payload":{"tag":"li","lines":"19,20"}},{"content":"<code>--aiWarnLevels</code>: Words included in the warning level log (default "warn")","children":[],"payload":{"tag":"li","lines":"20,21"}},{"content":"<code>--aiTopNError</code>: Number of error log patterns to be analyzed by AI (default 10)","children":[],"payload":{"tag":"li","lines":"21,22"}},{"content":"<code>--aiSampleSize</code>: Number of sample log to be analyzed by AI (default 50)","children":[],"payload":{"tag":"li","lines":"22,23"}},{"content":"<code>--aiLang</code>: Language of the response","children":[],"payload":{"tag":"li","lines":"23,25"}}],"payload":{"tag":"li","lines":"15,25"}}],"payload":{"tag":"h3","lines":"13,14"}},{"content":"anomaly","children":[{"content":"<code>anomaly</code>: Anomaly log detection","children":[],"payload":{"tag":"li","lines":"26,27"}},{"content":"Flags","children":[{"content":"<code>-m, --mode</code>: Detection modes (tfidf|sql|os|dir|walu|number) (default "tfidf")","children":[],"payload":{"tag":"li","lines":"28,29"}},{"content":"<code>-e, --extract</code>: Extract pattern","children":[],"payload":{"tag":"li","lines":"29,31"}}],"payload":{"tag":"li","lines":"27,31"}}],"payload":{"tag":"h3","lines":"25,26"}},{"content":"count","children":[{"content":"<code>count</code>: Count log","children":[],"payload":{"tag":"li","lines":"32,33"}},{"content":"Flags","children":[{"content":"<code>-i, --interval</code>: Specify the aggregation interval in seconds.","children":[],"payload":{"tag":"li","lines":"34,35"}},{"content":"<code>-p, --pos</code>: Specify variable location (default 1)","children":[],"payload":{"tag":"li","lines":"35,36"}},{"content":"<code>--delay</code>: Delay filter","children":[],"payload":{"tag":"li","lines":"36,37"}},{"content":"<code>-e, --extract</code>: Extract pattern or mode (json,grok,word,normalize)","children":[],"payload":{"tag":"li","lines":"37,38"}},{"content":"<code>-n, --name</code>: Name of key","children":[],"payload":{"tag":"li","lines":"38,39"}},{"content":"<code>-x, --grokPat</code>: grok pattern","children":[],"payload":{"tag":"li","lines":"39,40"}},{"content":"<code>-g, --grok</code>: grok pattern definitions","children":[],"payload":{"tag":"li","lines":"40,41"}},{"content":"<code>--geoip</code>: geo IP database file","children":[],"payload":{"tag":"li","lines":"41,42"}},{"content":"<code>--ip</code>: IP info mode (host|domain|loc|country)","children":[],"payload":{"tag":"li","lines":"42,43"}},{"content":"<code>-q, --timePos</code>: Specify second time stamp position","children":[],"payload":{"tag":"li","lines":"43,44"}},{"content":"<code>--utc</code>: Force UTC","children":[],"payload":{"tag":"li","lines":"44,46"}}],"payload":{"tag":"li","lines":"33,46"}}],"payload":{"tag":"h3","lines":"31,32"}},{"content":"delay","children":[{"content":"<code>delay</code>: Search for delays in the access log","children":[],"payload":{"tag":"li","lines":"47,48"}},{"content":"Flags","children":[{"content":"<code>-q, --timePos</code>: Specify second time stamp position","children":[],"payload":{"tag":"li","lines":"49,50"}},{"content":"<code>--utc</code>: Force UTC","children":[],"payload":{"tag":"li","lines":"50,52"}}],"payload":{"tag":"li","lines":"48,52"}}],"payload":{"tag":"h3","lines":"46,47"}},{"content":"email","children":[{"content":"<code>email [search|count]</code>: Search or count email logs","children":[],"payload":{"tag":"li","lines":"53,54"}},{"content":"Flags","children":[{"content":"<code>--emailCountBy</code>: Count by field (default "time")","children":[],"payload":{"tag":"li","lines":"55,56"}},{"content":"<code>--checkSPF</code>: Check SPF","children":[],"payload":{"tag":"li","lines":"56,58"}}],"payload":{"tag":"li","lines":"54,58"}}],"payload":{"tag":"h3","lines":"52,53"}},{"content":"extract","children":[{"content":"<code>extract</code>: Extract data from log","children":[],"payload":{"tag":"li","lines":"59,60"}},{"content":"Flags","children":[{"content":"<code>-e, --extract</code>: Extract pattern","children":[],"payload":{"tag":"li","lines":"61,62"}},{"content":"<code>-p, --pos</code>: Specify variable location (default 1)","children":[],"payload":{"tag":"li","lines":"62,63"}},{"content":"<code>-n, --name</code>: Name of value","children":[],"payload":{"tag":"li","lines":"63,64"}},{"content":"<code>-x, --grokPat</code>: grok pattern","children":[],"payload":{"tag":"li","lines":"64,65"}},{"content":"<code>-g, --grok</code>: grok pattern definitions","children":[],"payload":{"tag":"li","lines":"65,66"}},{"content":"<code>--geoip</code>: geo IP database file","children":[],"payload":{"tag":"li","lines":"66,67"}},{"content":"<code>--ip</code>: IP info mode (host|domain|loc|country)","children":[],"payload":{"tag":"li","lines":"67,69"}}],"payload":{"tag":"li","lines":"60,69"}}],"payload":{"tag":"h3","lines":"58,59"}},{"content":"heatmap","children":[{"content":"<code>heatmap</code>: Command to tally log counts by day of the week and time of day","children":[],"payload":{"tag":"li","lines":"70,71"}},{"content":"Flags","children":[{"content":"<code>-w, --week</code>: Week mode","children":[],"payload":{"tag":"li","lines":"72,74"}}],"payload":{"tag":"li","lines":"71,74"}}],"payload":{"tag":"h3","lines":"69,70"}},{"content":"import","children":[{"content":"<code>import</code>: Import log from source (file | dir | scp | ssh | twsnmp | imap | pop3)","children":[],"payload":{"tag":"li","lines":"75,76"}},{"content":"Flags","children":[{"content":"<code>--utc</code>: Force UTC","children":[],"payload":{"tag":"li","lines":"77,78"}},{"content":"<code>-b, --size</code>: Batch Size (default 10000)","children":[],"payload":{"tag":"li","lines":"78,79"}},{"content":"<code>--noDelta</code>: Disable delta check","children":[],"payload":{"tag":"li","lines":"79,80"}},{"content":"<code>--api</code>: TWSNMP FC API Mode","children":[],"payload":{"tag":"li","lines":"80,81"}},{"content":"<code>--tls</code>: TWSNMP FC API TLS","children":[],"payload":{"tag":"li","lines":"81,82"}},{"content":"<code>--skip</code>: TWSNMP FC API skip verify certificate (default true)","children":[],"payload":{"tag":"li","lines":"82,83"}},{"content":"<code>--noTS</code>: Import no time stamp file","children":[],"payload":{"tag":"li","lines":"83,84"}},{"content":"<code>-s, --source</code>: Log source","children":[],"payload":{"tag":"li","lines":"84,85"}},{"content":"<code>-c, --command</code>: SSH Command","children":[],"payload":{"tag":"li","lines":"85,86"}},{"content":"<code>-k, --key</code>: SSH Key","children":[],"payload":{"tag":"li","lines":"86,87"}},{"content":"<code>-p, --filePat</code>: File name pattern","children":[],"payload":{"tag":"li","lines":"87,88"}},{"content":"<code>-l, --logType</code>: TWSNNP FC log type (default "syslog")","children":[],"payload":{"tag":"li","lines":"88,89"}},{"content":"<code>--imapFolder</code>: List IMAP folder names","children":[],"payload":{"tag":"li","lines":"89,90"}},{"content":"<code>--emailTLS</code>: IMAP use start TLS","children":[],"payload":{"tag":"li","lines":"90,91"}},{"content":"<code>--emailUser</code>: IMAP or POP3 user name","children":[],"payload":{"tag":"li","lines":"91,92"}},{"content":"<code>--emailPassword</code>: IMAP or POP3 password","children":[],"payload":{"tag":"li","lines":"92,94"}}],"payload":{"tag":"li","lines":"76,94"}}],"payload":{"tag":"h3","lines":"74,75"}},{"content":"mcp","children":[{"content":"<code>mcp</code>: MCP server for AI agent","children":[],"payload":{"tag":"li","lines":"95,96"}},{"content":"Flags","children":[{"content":"<code>--transport</code>: MCP server transport (stdio/sse/stream) (default "stdio")","children":[],"payload":{"tag":"li","lines":"97,98"}},{"content":"<code>--endpoint</code>: MCP server endpoint (default "127.0.0.1:8085")","children":[],"payload":{"tag":"li","lines":"98,99"}},{"content":"<code>--clients</code>: IP address of MCP client to be allowed to connect","children":[],"payload":{"tag":"li","lines":"99,100"}},{"content":"<code>--geoip</code>: geo IP database file","children":[],"payload":{"tag":"li","lines":"100,102"}}],"payload":{"tag":"li","lines":"96,102"}}],"payload":{"tag":"h3","lines":"94,95"}},{"content":"relation","children":[{"content":"<code>relation <data1> <data2>...</code>: Relation Analysis","children":[{"content":"data entry: ip | mac | email | url | regex/<pattern>/<color>","children":[],"payload":{"tag":"li","lines":"104,106"}}],"payload":{"tag":"li","lines":"103,106"}}],"payload":{"tag":"h3","lines":"102,103"}},{"content":"search","children":[{"content":"<code>search [simple filter...]</code>: Search logs","children":[],"payload":{"tag":"li","lines":"107,108"}},{"content":"Flags","children":[{"content":"<code>-c, --color</code>: Color mode","children":[],"payload":{"tag":"li","lines":"109,110"}},{"content":"<code>-w, --wrap</code>: Wrap or scroll x","children":[],"payload":{"tag":"li","lines":"110,112"}}],"payload":{"tag":"li","lines":"108,112"}}],"payload":{"tag":"h3","lines":"106,107"}},{"content":"sigma","children":[{"content":"<code>sigma</code>: Detect threats using SIGMA rules","children":[],"payload":{"tag":"li","lines":"113,114"}},{"content":"Flags","children":[{"content":"<code>-s, --rules</code>: Sigma rules path","children":[],"payload":{"tag":"li","lines":"115,116"}},{"content":"<code>--strict</code>: Strict rule check","children":[],"payload":{"tag":"li","lines":"116,117"}},{"content":"<code>-c, --sigmaConfig</code>: config path","children":[],"payload":{"tag":"li","lines":"117,118"}},{"content":"<code>-x, --grokPat</code>: grok pattern if empty json mode","children":[],"payload":{"tag":"li","lines":"118,119"}},{"content":"<code>-g, --grok</code>: grok definitions","children":[],"payload":{"tag":"li","lines":"119,121"}}],"payload":{"tag":"li","lines":"114,121"}}],"payload":{"tag":"h3","lines":"112,113"}},{"content":"tfidf","children":[{"content":"<code>tfidf</code>: Log analysis using TF-IDF","children":[],"payload":{"tag":"li","lines":"122,123"}},{"content":"Flags","children":[{"content":"<code>-l, --limit</code>: Similarity threshold between logs (default 0.5)","children":[],"payload":{"tag":"li","lines":"124,125"}},{"content":"<code>-c, --count</code>: Number of threshold crossings to exclude","children":[],"payload":{"tag":"li","lines":"125,126"}},{"content":"<code>-n, --top</code>: Top N","children":[],"payload":{"tag":"li","lines":"126,128"}}],"payload":{"tag":"li","lines":"123,128"}}],"payload":{"tag":"h3","lines":"121,122"}},{"content":"time","children":[{"content":"<code>time</code>: Time analysis","children":[],"payload":{"tag":"li","lines":"129,131"}}],"payload":{"tag":"h3","lines":"128,129"}},{"content":"twlogeye","children":[{"content":"<code>twlogeye</code>: Import notify, logs and report from twlogeye","children":[],"payload":{"tag":"li","lines":"132,133"}},{"content":"Arguments","children":[{"content":"target: notify | logs | report","children":[],"payload":{"tag":"li","lines":"134,135"}},{"content":"sub target: syslog | trap | netflow | winevent | otel | mqtt | monitor | anomaly","children":[],"payload":{"tag":"li","lines":"135,136"}}],"payload":{"tag":"li","lines":"133,136"}},{"content":"Flags","children":[{"content":"<code>--apiServer</code>: twlogeye api server IP address","children":[],"payload":{"tag":"li","lines":"137,138"}},{"content":"<code>--apiPort</code>: twlogeye api port number (default 8081)","children":[],"payload":{"tag":"li","lines":"138,139"}},{"content":"<code>--ca</code>: CA Cert file path","children":[],"payload":{"tag":"li","lines":"139,140"}},{"content":"<code>--cert</code>: Client cert file path","children":[],"payload":{"tag":"li","lines":"140,141"}},{"content":"<code>--key</code>: Client key file path","children":[],"payload":{"tag":"li","lines":"141,142"}},{"content":"<code>--filter</code>: Log search text","children":[],"payload":{"tag":"li","lines":"142,143"}},{"content":"<code>--level</code>: Notify level","children":[],"payload":{"tag":"li","lines":"143,144"}},{"content":"<code>--anomaly</code>: Anomaly report type (default "monitor")","children":[],"payload":{"tag":"li","lines":"144,146"}}],"payload":{"tag":"li","lines":"136,146"}}],"payload":{"tag":"h3","lines":"131,132"}},{"content":"twsnmp","children":[{"content":"<code>twsnmp [target]</code>: Get information and logs from TWSNMP FC","children":[],"payload":{"tag":"li","lines":"147,148"}},{"content":"Arguments","children":[{"content":"target: node | polling | eventlog | syslog | trap | netflow | ipfix | sflow | sflowCounter | arplog | pollingLog","children":[],"payload":{"tag":"li","lines":"149,150"}}],"payload":{"tag":"li","lines":"148,150"}},{"content":"Flags","children":[{"content":"<code>--jsonOut</code>: output json format","children":[],"payload":{"tag":"li","lines":"151,152"}},{"content":"<code>--checkCert</code>: TWSNMP FC API verify certificate","children":[],"payload":{"tag":"li","lines":"152,153"}},{"content":"<code>--twsnmp</code>: TWSNMP FC URL (default "http://localhost:8080")","children":[],"payload":{"tag":"li","lines":"153,155"}}],"payload":{"tag":"li","lines":"150,155"}}],"payload":{"tag":"h3","lines":"146,147"}},{"content":"update","children":[{"content":"<code>update</code>: Update twsla to the latest or specified version from GitHub releases.","children":[],"payload":{"tag":"li","lines":"156,157"}},{"content":"Flags","children":[{"content":"<code>-c, --check</code>: Check for updates only","children":[],"payload":{"tag":"li","lines":"158,159"}},{"content":"<code>--version</code>: Update to specified version","children":[],"payload":{"tag":"li","lines":"159,160"}},{"content":"<code>-y, --yes</code>: Update without confirmation","children":[],"payload":{"tag":"li","lines":"160,162"}}],"payload":{"tag":"li","lines":"157,162"}}],"payload":{"tag":"h3","lines":"155,156"}},{"content":"version","children":[{"content":"<code>version</code>: Show twsla version","children":[],"payload":{"tag":"li","lines":"163,164"}},{"content":"Flags","children":[{"content":"<code>--color</code>: Version color","children":[],"payload":{"tag":"li","lines":"165,166"}}],"payload":{"tag":"li","lines":"164,166"}}],"payload":{"tag":"h3","lines":"162,163"}}],"payload":{"tag":"h2","lines":"11,12"}}],"payload":{"tag":"h1","lines":"0,1"}},null)</script>
</body>
</html>