CLI Reference¶

Complete command reference for BSOT.

Global Options¶

bsot [OPTIONS] COMMAND [ARGS]...

Option	Description
`--version`	Show version and exit
`--help`	Show help and exit

Modules¶

Module	Description
`phishing`	Email phishing analysis
`intel`	Threat intelligence & IOC enrichment
`file`	File analysis & hashing
`network`	Network security analysis
`logs`	Log parsing & analysis
`data`	Data encoding/decoding
`auth`	Authentication analysis
`system`	System analysis
`ir`	Incident response
`malware`	Malware analysis
`osint`	Open source intelligence
`report`	Reporting & case management
`config`	Configuration management
`cache`	Cache management

phishing¶

Email phishing analysis.

analyze¶

Analyze an email file.

bsot phishing analyze [OPTIONS] EMAIL_PATH

Option	Description
`--json`	Output as JSON
`--no-color`	Disable color output

extract-iocs¶

Extract IOCs from email.

bsot phishing extract-iocs [OPTIONS] EMAIL_PATH

Option	Description
`--format`	Output format: `text`, `json`, `csv`

headers¶

Analyze email headers (SPF/DKIM/DMARC).

bsot phishing headers [OPTIONS] EMAIL_PATH

ai-analyze¶

Analyze email with AI.

bsot phishing ai-analyze [OPTIONS] EMAIL_PATH

Option	Description
`--provider`	AI provider: `openai`, `anthropic`

reputation¶

Check URL/domain reputation.

bsot phishing reputation [OPTIONS] URL

intel¶

Threat intelligence and IOC enrichment.

enrich¶

Enrich a single IOC.

bsot intel enrich [OPTIONS] IOC

Option	Description
`--json`	Output as JSON

bulk¶

Bulk enrich IOCs from file.

bsot intel bulk [OPTIONS]

Option	Description
`-f, --file`	Input file with IOCs
`--progress`	Show progress bar
`--json`	Output as JSON
`-o, --output`	Output file

whois¶

WHOIS lookup.

bsot intel whois [OPTIONS] DOMAIN

geoip¶

GeoIP lookup.

bsot intel geoip [OPTIONS] IP

defang¶

Defang IOC for safe sharing.

bsot intel defang IOC

refang¶

Refang a defanged IOC.

bsot intel refang IOC

file¶

File analysis and hashing.

hash¶

Calculate file hashes.

bsot file hash [OPTIONS] FILE

Option	Description
`--all`	Calculate all hash types
`--json`	Output as JSON
`-r, --recursive`	Process directories recursively

identify¶

Identify file type.

bsot file identify [OPTIONS] FILE

strings¶

Extract strings from file.

bsot file strings [OPTIONS] FILE

Option	Description
`--min-length`	Minimum string length (default: 4)
`--category`	Filter by category

entropy¶

Calculate file entropy.

bsot file entropy [OPTIONS] FILE

metadata¶

Extract file metadata.

bsot file metadata [OPTIONS] FILE

cred-scan¶

Scan for credentials in files.

bsot file cred-scan [OPTIONS] PATH

Option	Description
`-r, --recursive`	Scan directories recursively

network¶

Network security analysis.

ssl-check¶

Check SSL/TLS certificate.

bsot network ssl-check [OPTIONS] HOST

Option	Description
`--port`	Port number (default: 443)
`--json`	Output as JSON

headers¶

Audit HTTP security headers.

bsot network headers [OPTIONS] URL

dns¶

Analyze DNS security (SPF/DKIM/DMARC).

bsot network dns [OPTIONS] DOMAIN

Option	Description
`--all`	Check all DNS security
`--spf`	Check SPF only
`--dkim`	Check DKIM only
`--dmarc`	Check DMARC only

ports¶

Scan common ports.

bsot network ports [OPTIONS] HOST

logs¶

Log parsing and analysis.

parse¶

Parse log files.

bsot logs parse [OPTIONS]

Option	Description
`-f, --file`	Input log file
`--format`	Log format: `auto`, `syslog`, `json`, `clf`, `cef`
`--limit`	Limit output lines

analyze¶

Analyze logs for attack patterns.

bsot logs analyze [OPTIONS]

Option	Description
`-f, --file`	Input log file
`--checks`	Specific checks to run
`--json`	Output as JSON
`-o, --output`	Output file

stats¶

Generate log statistics.

bsot logs stats [OPTIONS]

Option	Description
`-f, --file`	Input log file
`--top-ips`	Show top N IPs
`--by-hour`	Group by hour

data¶

Data encoding and decoding.

decode¶

Decode data.

bsot data decode [OPTIONS] [DATA]

Option	Description
`-e, --encoding`	Encoding type

Encoding types: base64, url, hex, html, unicode-escape, rot13, punycode

encode¶

Encode data.

bsot data encode [OPTIONS] [DATA]

timestamp¶

Convert timestamps.

bsot data timestamp [OPTIONS] TIMESTAMP

hash¶

Hash data.

bsot data hash [OPTIONS] DATA

regex¶

Test regex patterns.

bsot data regex [OPTIONS] PATTERN DATA

format¶

Format data (JSON, XML, HTML).

bsot data format [OPTIONS] DATA

auth¶

Authentication analysis.

password-analyze¶

Analyze password strength.

bsot auth password-analyze [OPTIONS] PASSWORD

Option	Description
`--check-breach`	Check against HIBP

jwt-decode¶

Decode and analyze JWT token.

bsot auth jwt-decode [OPTIONS] TOKEN

system¶

System analysis.

processes¶

List and analyze processes.

bsot system processes [OPTIONS]

Option	Description
`--suspicious`	Show only suspicious processes
`--json`	Output as JSON

connections¶

List network connections.

bsot system connections [OPTIONS]

ir¶

Incident response.

collect¶

Collect forensic artifacts.

bsot ir collect [OPTIONS]

Option	Description
`--profile`	Collection profile: `quick`, `standard`, `full`
`-o, --output`	Output directory

hash-tree¶

Generate hash tree for evidence integrity.

bsot ir hash-tree [OPTIONS] PATH

contain¶

Generate containment commands.

bsot ir contain [OPTIONS]

Option	Description
`--block-ip`	IP to block
`--disable-user`	User to disable
`--platform`	Target platform

cf¶

Cloudflare integration.

bsot ir cf [COMMAND]

Command	Description
`block`	Block IP
`unblock`	Unblock IP
`list`	List rules
`bulk-block`	Bulk block IPs
`test`	Test connection

malware¶

Malware analysis.

strings¶

Extract and categorize strings.

bsot malware strings [OPTIONS] FILE

pe¶

Analyze PE file.

bsot malware pe [OPTIONS] FILE

Option	Description
`--sections`	Show section details
`--imports`	Show imports
`--exports`	Show exports
`--json`	Output as JSON

yara¶

Scan with YARA rules.

bsot malware yara [OPTIONS] FILE

Option	Description
`-r, --rules`	Custom rules file

deobfuscate¶

Deobfuscate scripts.

bsot malware deobfuscate [OPTIONS] FILE

submit¶

Submit to online sandboxes.

bsot malware submit [OPTIONS] FILE

Option	Description
`--no-upload`	Hash lookup only

ioc¶

Extract IOCs from file.

bsot malware ioc [OPTIONS] FILE

compare¶

Compare files (fuzzy hashing).

bsot malware compare [OPTIONS] FILE1 FILE2

report¶

Reporting and case management.

case¶

Case management commands.

Command	Description
`new`	Create new case
`list`	List cases
`open`	Open case
`close`	Close case
`add`	Add artifact
`note`	Add note
`timeline`	Add timeline entry
`status`	Show case status

generate¶

Generate report.

bsot report generate [OPTIONS]

Option	Description
`--template`	Template: `executive`, `technical`, `ioc`, `timeline`
`-o, --output`	Output file

ioc¶

Export IOCs.

bsot report ioc [OPTIONS]

Option	Description
`--format`	Format: `json`, `csv`, `stix`, `misp`

timeline¶

Export timeline.

bsot report timeline [OPTIONS]

package¶

Package case for delivery.

bsot report package [OPTIONS]

Option	Description
`--encrypt`	Encrypt package
`-o, --output`	Output file

config¶

Configuration management.

bsot config [COMMAND]

Command	Description
`show`	Show configuration
`set`	Set configuration value
`get`	Get configuration value
`path`	Show config file path

cache¶

Cache management.

bsot cache [COMMAND]

Command	Description
`clear`	Clear cache
`stats`	Show cache statistics