Command line

signal live [options]

Survey the running system.

Yes

signal help

Every command and option.

No

signal version

The version.

No

signal license

The license.

No

signal list [-json]

The modules, each with the parameters a profile may give it.

No

signal rules [-m module] [-rules dir]

The rules a run would use: ID, module, severity, kind, origin, title.

No

signal rules -check [-rules dir]

Check every rule: it loads, names its evidence, explains itself and passes its tests.

No

signal rules -pack -rules dir

Write a compressed .pack beside each rule file.

No

signal profile -check <file|encoded>

Check a scoping profile against this build.

No

signal profile -encode <file>

Print a profile as the one-line argument for -profile.

No

signal push -push url [...] [file|folder ...]

Send runs to Signal Console with no new survey: the outbox's (elevated), or run files.

For the outbox

signal update [-from url]

Say whether a newer version exists (it never downloads or replaces anything).

No

-all

Run every module.

-m names

A comma-separated list of modules to run.

-profile p

The scoping profile: a file, or the encoded one-line form. See Scoping profiles.

-rules dir

Also run the pattern rules in dir (*.json or *.pack). A file with a problem is warned about and left out.

-shadow which

Also read the system drive's existing shadow copies: newest, all, or one copy's ID. See Reading shadow copies.

-o file|folder

Write the run to a file, or into a folder (a path ending in \, an existing folder, a network share) as <host>-<run id>.json. Default: the screen, unless -push is given.

-push url

Also send the run to Signal Console at url.

-push-key-file f

The file holding the case's push key. Or set SIGNAL_PUSH_KEY.

-push-key k

The key itself - warned about on every run: process auditing records the command line.

-push-wait dur

How long a push keeps trying (default 10m). A run still not accepted waits in the outbox.

-compact

Single-line JSON (pushes are always compact).

-workers n

Event log render threads (default: every CPU but one, 1 to 8).

-parallel n

Modules run in parallel (default: half the CPUs, 2 to 8).

-timeout dur

A time limit per module, per log pass and per reading of the host's state (default: none - a late run is better than an incomplete one). A step that reaches it stops, and the run reports what was not read.

-v

Print every step to the screen. Without it, only warnings and errors.