Examples of Incident Response CLI available commands

Various commands and command arguments are available to the base system Incident Response CLI.

Global command arguments

Use command arguments to set options for any CLI commands.

--help

Provides help information for the specified command, which includes the description, supported arguments, and examples. For more information, see Get help with Incident Response CLI.

$ lightstep --help
--debug

provides debug logging output when executing a command. For more information, see Get help with Incident Response CLI.

lightstep alert create --desc ‘VPN Service breakdown’ --priority 1 --source ‘VPN Client’ --debug
--profile
Specifies the named profile to use for a command. For more information, see Configure and manage your Incident Response CLI connection profiles.
$ lightstep configure profile set --profile <profilename>
--output

Specifies the output format to use for a command. The Incident Response CLI supports the following output formats.

  • json: The output is formatted as JSON. This is the default.
    
{
   "default": {
      "appversion": "1.0.8",
      "host": "https://myinstance.airapp.lightstep.com",
      "hostversion": "Paris",
      "loginmethod": "basic",
      "output": "json",
      "username": "admin"
   },
   "user1": {
      "appversion": "1.0.8",
      "host": "https://otherinstance.airapp.lightstep.com",
      "hostversion": "Paris",
      "loginmethod": "basic",
      "output": "yaml",
      "username": "admin"
   }
}
  • yaml: The output is formatted as YAML. Use YAML to handle the output with services and tools that emit or consume YAML-formatted strings. 
    default:
   appversion: 1.0.8
   host: https://myinstance.airapp.lightstep.com
   hostversion: Paris
   loginmethod: basic
   output: json
   username: admin
user1:
   appversion: 1.0.8
   host: https://otherinstance.airapp.lightstep.com
   hostversion: Paris
   loginmethod: basic
   output: yaml
   username: admin
  • text: The output is formatted as multiple lines of tab-separated string values. Use this output with traditional UNIX text tools such as grep, sed, and awk, and the text processing performed by PowerShell.
    default   https://myinstance.airapp.lightstep.com   Paris   1.0.8   basic   admin   json 
user1   https://otherinstance.airapp.lightstep.com   Paris   1.0.8   basic   admin   yaml
  • table: The output is formatted as a table which presents the information in a human-readable format.
    NAME   HOST   HOST   VERSION   APP   VERSION   LOGIN   METHOD   USERNAME   OUTPUT 
-------------------------------------------------------------------------------
default   myinstance   Paris   1.0.8   basic   admin   json 
user1   otherinstance   Paris   1.0.8   basic   admin   yaml
  • none: The CLI does not print the output to the console. Success, error, and progress messages still display.
--no-interactive
Prevents the CLI from prompting the user for argument values. If the user does not pass a value for a required argument, the system uses the default value. If no default value is defined, the system throws an error.
--no-verbose
The command executes silently without messages.​ Use this argument in automated testing scenarios.

Configure profile

Create a connection profile to connect with your instance, view connection profiles, refresh your connection and available commands, or delete profiles you no longer need. For more information about configuring your profile, see Configure and manage your Incident Response CLI connection profiles.

Set up a default profile

Create a connection profile that the Incident Response CLI uses by default. You must create a default profile to set up the CLI's initial connection with an instance.

$ lightstep configure profile set

The system prompts you for the following information:

Requested information Description
Host The host name of the instance to connect to. Supports both the full URL (https://my-instance.airapp.lightstep.com) or just the host name (my-instance).
Login method The login method to use to connect to the instance. Supports Basic, OAuth, and OAuth + MFA.
Username The user name to use to connect to the instance.
Password The password to use to connect to the instance.
Client id The client ID to use to connect to the instance when the login method is OAuth or OAuth + MFA.
Client secret The client secret to use to connect to the instance when the login method is OAuth or OAuth + MFA.
Authentication code The authentication code to use to connect to the instance when the login method is OAuth + MFA.
Default output format Specifies how to format the command results. Options are json, yaml, text, and table.
Set up a named profile
Create a named connection profile to use with specific commands. This allows you to specify a different instance or connection protocol for a specific command.
$ lightstep configure profile set [--profile profile-name]

The system prompts you for the following information:

Requested information Description
Host The host name of the instance to connect to. Supports both the full URL (https://my-instance.airapp.lightstep.com) or just the host name (my-instance).
Login method The login method to use to connect to the instance. Supports Basic, OAuth, and OAuth + MFA.
Username The user name to use to connect to the instance.
Password The password to use to connect to the instance.
Client id The client ID to use to connect to the instance when the login method is OAuth or OAuth + MFA.
Client secret The client secret to use to connect to the instance when the login method is OAuth or OAuth + MFA.
Authentication code The authentication code to use to connect to the instance when the login method is OAuth + MFA.
Default output format Specifies how to format the command results. Options are json, yaml, text, and table.
View profiles

View all connection profiles set in the configuration file, or view information about a specific profile.

$ lightstep configure profile list [--profile profile-name]
Remove a profile

Remove a named connection profile that you no longer need from the configuration file.

$ lightstep configure profile remove [--profile profile-name]
Refresh a profile

Update the available commands from the instance for the given profile. Refresh your connection after modifying any of the commands on the corresponding instance in order to keep the CLI up-to-date.

$ lightstep configure profile refresh [--profile profile-name]

Perform alert operations

Create, acknowledge, update, and list alerts in your instance using the Incident Response CLI command-line tool.

Create an alert

Create an Alert with description, priority and source.

lightstep alert create --desc 'VPN Service breakdown' --priority 1 --source 'VPN Client'

Pass in values for these arguments.

Parameter Description
desc Brief description of the alert.
priority Alert priority.
source Source for the alert.
Acknowledge or unacknowledge an alert

Acknowledge or unacknowledge an alert

lightstep alert ack --alert 'Alert0010006' 
lightstep alert ack --alert 'Alert0010008' --unack

Pass in values for these arguments.

Parameter Description
alert Alert number
unack Unacknowledge
Update an alert

Update the alert description, priority, source and work notes.

lightstep alert update --alert 'Alert0010013' --desc 'VPN Service breakdown intermittent' --priority 2 --source 'VPN Client Ind' --notes 'Changing Severity and updated other fields'

Pass in values for these arguments.

Parameter Description
alert Name of the table in which the record must be saved.
desc Brief description of the alert.
priority Field name and the associated value for each field to define in the specified record in JSON string format.
source Source for the alert.
notes Notes or comments on the alert.
Note: To see all the available commands and arguments, open your system's command-line tool and enter the command you need help with, followed by the --help argument.
The following examples display help for alert and incident related commands respectively:
$ lightstep alert --help
$ lightstep incident --help