# noust incident

Freeze the evidence of a security incident and lock the console down.

```bash
noust incident [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`freeze`](#noust-incident-freeze), [`status`](#noust-incident-status), [`unfreeze`](#noust-incident-unfreeze)

## noust incident freeze

Take an evidence package with a SHA-256 manifest and lock the console down.

```bash
noust incident freeze [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--no-lock` | Take the evidence only; leave the console open for sign-in. |  |
| `--revoke-sessions` | Also end every console session open now (after listing them in the package). |  |
| `--hours` | How far back the journal excerpts go. | `24` |
| `--output` | Directory to create the package in (default: incidents/ beside the store). |  |
| `--json` | Print the result as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust incident status

Say whether the console is locked down for an incident.

```bash
noust incident status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the lockdown as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust incident unfreeze

Lift the console lockdown a freeze put in place.

```bash
noust incident unfreeze [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the lockdown that was lifted as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |