-
Notifications
You must be signed in to change notification settings - Fork 353
1. CLI Usage
Gabe Stocco edited this page Dec 12, 2023
·
10 revisions
Install the .NET SDK and then run dotnet tool install --global Microsoft.CST.ApplicationInspector.CLI.
The tool does not automatically update, but you can update to the latest version of AppInspector with dotnet tool update --global Microsoft.CST.ApplicationInspector.CLI.
Download an Application Inspector release from the GitHub releases. These releases are platform specific and don't require a .NET SDK install.
> AppInspector <command> <options>
ApplicationInspector.CLI 1.6.22+a4d4df45d0
c Microsoft Corporation. All rights reserved.
analyze Inspect source directory/file/compressed file (.tgz|zip)
against defined characteristics
tagdiff Compares unique tag values between two source paths
exporttags Export the list of tags associated with the specified rules.
Does not scan source code.
verifyrules Verify custom rules syntax is valid
packrules Combine multiple rule files into one file for ease in
distribution
help Display more information on a specific command.
version Display version information.
For help with an individual command run appinspector <command> --help. To see a list of available commands run appinspector --help.
Usage: AppInspector analyze [arguments] [options]
Arguments:
-s, --source-path Required. Source file or directory to
inspect, comma separated
-f, --output-file-format (Default: html) Output format
[html|json|text]
-e, --text-format (Default:
Tag:%T,Rule:%N,Ruleid:%R,Confidence:%X
,File:%F,Sourcetype:%t,Line:%L,Sample:
%m) Match text format specifiers
-N, --no-show-progress Disable progress information.
-C, --context-lines Number of lines of context on each
side to include in excerpt (up to a
maximum of 100 * NumLines characters
on each side). 0 to skip exerpt. -1 to
not extract samples or excerpts
(implied by -t). When outputting sarif
use -1 for no snippets, all other
values ignored.
-t, --tags-only Only get tags (no detailed match
data). Ignored if output format is
sarif.
-n, --no-file-metadata Don't collect metadata about each
individual file.
-A, --allow-all-tags-in-build-files Allow all tags (not just Metadata
tags) in files of type Build.
-M, --max-num-matches-per-tag If non-zero, and TagsOnly is not set,
will ignore rules based on if all of
their tags have been found the set
value number of times.
--base-path If set, when outputting sarif, will
have paths made relative to the
provided path.
--repository-uri If set, when outputting sarif, include
this information.
--commit-hash If set, when outputting sarif, include
this information.
--disable-custom-rule-validation By default when providing custom rules
they are validated. When set,
validation will be skipped.
-i, --ignore-default-rules (Default: false) Exclude default rules
bundled with application
-F, --file-timeout (Default: 60000) Maximum amount of
time in milliseconds to allow for
processing each file. 0 is infinity.
Default: 60000.
-p, --processing-timeout (Default: 0) Maximum amount of time in
milliseconds to allow for processing.
When NoShowProgress is set this
includes enumeration time. 0 is
infinity. Default: 0.
--enumeration-timeout (Default: 0) Maximum amount of time in
milliseconds to allow for enumerating.
0 is infinity. Default: 0.
--disable-archive-crawling Disable Archive Enumeration.
-S, --single-threaded Disables parallel processing. May be
helpful for debugging with higher
verbosity.
-g, --exclusion-globs (Default: **/bin/** **/obj/**
**/.vs/** **/.git/**) Exclude source
files that match glob patterns.
Example: "**/.git/**,*Tests*". Use
"none" to disable.
-u, --scan-unknown-filetypes Scan files of unknown types.
-c, --confidence-filters (Default: High Medium) Output only
matches with specified confidence
<value>,<value>. Default: Medium,High.
[High|Medium|Low]
--severity-filters (Default: Critical Important Moderate
BestPractice ManualReview) Output only
matches with specified severity
<value>,<value>. Default: All are
enabled.
[Critical|Important|Moderate|BestPract
ice|ManualReview]
-r, --custom-rules-path Custom rules file or directory path
--custom-languages-path Replace the default languages set with
a custom languages.json.
--custom-comments-path Replace the default comment
specification set with a custom
comments.json.
--disable-require-unique-ids Allow rules with duplicate IDs.
--success-error-code-with-no-matches When processing is apparently
successful but there are no matches
return a success error code - useful
for CI.
--require-must-match When validating, require rules to have
MustMatch self-tests.
--require-must-not-match When validating, require rules to have
MustNotMatch self-tests.
-o, --output-file-path Output file path
-x, --console-verbosity (Default: Information) Console
verbosity
[Verbose|Debug|Information|Warning|Err
or|Fatal]
--disable-console (Default: false) Disable console
output of logging messages.
-v, --log-file-level (Default: Error) Log file level
[Verbose|Debug|Information|Warning|Err
or|Fatal]
-l, --log-file-path Log file path. If not set, will not
log to file.
--help Display this help screen.
--version Display version information.
Scan a project directory, with output sent to "output.html" (default behavior includes launching default browser to this file)
AppInspector analyze -s /home/user/myproject
AppInspector analyze -s /home/user/myproject -r /home/user/myrules -i
AppInspector analyze -s /home/user/myproject -f json
AppInspector analyze -s /home/user/myproject -f sarif
Use to analyze and report on differences in tags (features) between two project or project versions e.g. v1, v2 to see what changed
Usage: AppInspector tagdiff [arguments] [options]
Arguments:
--src1 Required. Source 1 to compare (commaa
separated)
--src2 Required. Source 2 to compare (commaa
separated)
-t, --test-type (Default: Equality) Type of test to
run [Equality|Inequality]
--disable-custom-rule-validation By default when providing custom rules
they are validated. When set,
validation will be skipped.
-i, --ignore-default-rules (Default: false) Exclude default rules
bundled with application
-F, --file-timeout (Default: 60000) Maximum amount of
time in milliseconds to allow for
processing each file. 0 is infinity.
Default: 60000.
-p, --processing-timeout (Default: 0) Maximum amount of time in
milliseconds to allow for processing.
When NoShowProgress is set this
includes enumeration time. 0 is
infinity. Default: 0.
--enumeration-timeout (Default: 0) Maximum amount of time in
milliseconds to allow for enumerating.
0 is infinity. Default: 0.
--disable-archive-crawling Disable Archive Enumeration.
-S, --single-threaded Disables parallel processing. May be
helpful for debugging with higher
verbosity.
-g, --exclusion-globs (Default: **/bin/** **/obj/**
**/.vs/** **/.git/**) Exclude source
files that match glob patterns.
Example: "**/.git/**,*Tests*". Use
"none" to disable.
-u, --scan-unknown-filetypes Scan files of unknown types.
-c, --confidence-filters (Default: High Medium) Output only
matches with specified confidence
<value>,<value>. Default: Medium,High.
[High|Medium|Low]
--severity-filters (Default: Critical Important Moderate
BestPractice ManualReview) Output only
matches with specified severity
<value>,<value>. Default: All are
enabled.
[Critical|Important|Moderate|BestPract
ice|ManualReview]
-r, --custom-rules-path Custom rules file or directory path
--custom-languages-path Replace the default languages set with
a custom languages.json.
--custom-comments-path Replace the default comment
specification set with a custom
comments.json.
--disable-require-unique-ids Allow rules with duplicate IDs.
--success-error-code-with-no-matches When processing is apparently
successful but there are no matches
return a success error code - useful
for CI.
--require-must-match When validating, require rules to have
MustMatch self-tests.
--require-must-not-match When validating, require rules to have
MustNotMatch self-tests.
-o, --output-file-path Output file path
-f, --output-file-format (Default: text) Output format
[json|text]
-x, --console-verbosity (Default: Information) Console
verbosity
[Verbose|Debug|Information|Warning|Err
or|Fatal]
--disable-console (Default: false) Disable console
output of logging messages.
-v, --log-file-level (Default: Error) Log file level
[Verbose|Debug|Information|Warning|Err
or|Fatal]
-l, --log-file-path Log file path. If not set, will not
log to file.
--help Display this help screen.
--version Display version information.
AppInspector tagdiff --src1 /home/user/project1 --src2 /home/user/project2
AppInspector tagdiff --src1 /home/user/project1 --src2 /home/user/project2 -t equality
AppInspector tagdiff --src1 /home/user/project1 --src2 /home/user/project2 -t inequality
Simple export of the ruleset tags representing what features are supported for detection
Usage: AppInspector exporttags [arguments] [options]
Arguments:
-r, --custom-rules-path Custom rules file or directory path
-i, --ignore-default-rules (Default: false) Exclude default rules bundled
with application
-o, --output-file-path Output file path
-f, --output-file-format (Default: text) Output format [json|text]
-x, --console-verbosity (Default: Information) Console verbosity
[Verbose|Debug|Information|Warning|Error|Fatal]
--disable-console (Default: false) Disable console output of
logging messages.
-v, --log-file-level (Default: Error) Log file level
[Verbose|Debug|Information|Warning|Error|Fatal]
-l, --log-file-path Log file path. If not set, will not log to file.
--help Display this help screen.
--version Display version information.
AppInspector exporttags
AppInspector exporttags -o /home/user/myproject/exportags.txt
AppInspector exporttags -r /home/user/myproject/customrules -o /hom/user/myproject/exportags.txt
Verify a custom ruleset is compatible and error free for use with Application Inspector. Note the default ruleset is already verified as part of the Build process and does not normally require a separate verification.
Usage: AppInspector verifyrules [arguments]
Arguments:
-d, --verify-default-rules (Default: false) Verify the rules
embedded in the binary.
-r, --custom-rules-path Custom rules file or directory path
--custom-languages-path Replace the default languages set with
a custom languages.json.
--custom-comments-path Replace the default comment
specification set with a custom
comments.json.
--disable-require-unique-ids Allow rules with duplicate IDs.
--success-error-code-with-no-matches When processing is apparently
successful but there are no matches
return a success error code - useful
for CI.
--require-must-match When validating, require rules to have
MustMatch self-tests.
--require-must-not-match When validating, require rules to have
MustNotMatch self-tests.
-o, --output-file-path Output file path
-f, --output-file-format (Default: text) Output format
[json|text]
-x, --console-verbosity (Default: Information) Console
verbosity
[Verbose|Debug|Information|Warning|Err
or|Fatal]
--disable-console (Default: false) Disable console
output of logging messages.
-v, --log-file-level (Default: Error) Log file level
[Verbose|Debug|Information|Warning|Err
or|Fatal]
-l, --log-file-path Log file path. If not set, will not
log to file.
--help Display this help screen.
--version Display version information.
AppInspector verifyrules -r /home/user/mycustomrules
Condense multiple rule files into one for ease in distribution with Application Inspector
Usage: AppInspector packrules [arguments]
Arguments:
-e, --pack-embedded-rules Pack the rules that are embedded in
the application inspector binary.
-r, --custom-rules-path Custom rules file or directory path
--custom-languages-path Replace the default languages set with
a custom languages.json.
--custom-comments-path Replace the default comment
specification set with a custom
comments.json.
--disable-require-unique-ids Allow rules with duplicate IDs.
--success-error-code-with-no-matches When processing is apparently
successful but there are no matches
return a success error code - useful
for CI.
--require-must-match When validating, require rules to have
MustMatch self-tests.
--require-must-not-match When validating, require rules to have
MustNotMatch self-tests.
-o, --output-file-path Output file path
-f, --output-file-format (Default: text) Output format
[json|text]
-x, --console-verbosity (Default: Information) Console
verbosity
[Verbose|Debug|Information|Warning|Err
or|Fatal]
--disable-console (Default: false) Disable console
output of logging messages.
-v, --log-file-level (Default: Error) Log file level
[Verbose|Debug|Information|Warning|Err
or|Fatal]
-l, --log-file-path Log file path. If not set, will not
log to file.
--help Display this help screen.
--version Display version information.
AppInspector packrules -d -o /home/user/myproject/defaultrules.json
AppInspector packrules -r /home/user/myproject/customrules -o /home/user/mypackedcustomrules.json