CLI Commands

cnspec policy graph remediation

Show the remediation steps of a check, or of every check under a policy, group, framework, or control.

Show the docs.remediation entries of a check. For a policy, group, framework, or control, the command shows the remediations of every check reachable from it. Pass the UID of the node and the path to the bundle file or directory.

Remediation texts are Markdown. Use --code to print only their fenced code blocks, or --json to add each block, with its language, under a code field so a script can extract the commands without parsing Markdown.

Select one remediation method with --id. A check's cli entry often holds alternative commands for several distributions, while its bash entry is usually a single script. --code prints every block of the selected entries, and a later block can be an alternative to an earlier one rather than a next step, so read the remediation text before you run the output.

Print the bash script that fixes one check:

cnspec policy graph remediation mondoo-linux-security-core-dumps-are-restricted ./content --id bash --code

Print every bash remediation in a policy as JSON:

cnspec policy graph remediation mondoo-linux-security ./content --id bash --json

Options

      --code           Print only the code blocks, without the markdown around them
  -h, --help           help for remediation
      --id strings     Only remediations with these ids, e.g. bash,cli
      --json           Output as JSON, with each remediation's code blocks parsed out
      --lang strings   Only code blocks in these languages, e.g. bash,sh (implies --code)

Options inherited from parent commands

      --api-proxy string        Set the proxy for communications with Mondoo Platform API
      --auto-update             Enable automatic updates of cnspec and its providers; overrides auto_update in the config file (default true)
      --config string           Set config file path (default $HOME/.config/mondoo/mondoo.yml)
      --log-level string        Set the log level: error, warn, info, debug, trace (default "info")
      --logging-config string   Path to a logging configuration file (YAML or JSON) that selects the log writer, level, and writer-specific options
      --strict                  Default MQL strict mode for policies that do not declare one: every link in an MQL chain must resolve
  -v, --verbose                 Enable verbose output

SEE ALSO

cnspec policy graph reachable

Show all nodes reachable from a node in the policy graph.

cnspec policy graph search

Search the policy graph for nodes by name, title, or UID.

On this page

OptionsOptions inherited from parent commandsSEE ALSO