noust incident
Freeze the evidence of a security incident and lock the console down.
Shell
noust incident [OPTIONS] COMMAND [ARGS]...Subcommands: freeze, status, unfreeze
noust incident freeze
Take an evidence package with a SHA-256 manifest and lock the console down.
Shell
noust incident freeze [OPTIONS]| Option | What it does | Default |
|---|---|---|
--no-lock |
Take the evidence only; leave the console open for sign-in. | |
--revoke-sessions |
Also end every console session open now (after listing them in the package). | |
--hours |
How far back the journal excerpts go. | 24 |
--output |
Directory to create the package in (default: incidents/ beside the store). | |
--json |
Print the result as JSON. | |
--reason |
Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |
noust incident status
Say whether the console is locked down for an incident.
Shell
noust incident status [OPTIONS]| Option | What it does | Default |
|---|---|---|
--json |
Print the lockdown as JSON. | |
--reason |
Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |
noust incident unfreeze
Lift the console lockdown a freeze put in place.
Shell
noust incident unfreeze [OPTIONS]| Option | What it does | Default |
|---|---|---|
--json |
Print the lockdown that was lifted as JSON. | |
--reason |
Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |