Create Checks in cnspec Shell

As you write the checks and queries in a policy, it helps to test your MQL before you add it to a bundle. cnspec provides an interactive shell in which you can explore. The shell helps you understand the checks that cnspec policies use, and write your own as well. It's also a great way to interact with both local and remote targets on the fly.

Run the shell:

cnspec shell local

The shell provides a help command to get information about the resources that power cnspec. Running help without any arguments lists every available MQL resource and its fields. Run help RESOURCE for details on a specific resource. For example:

cnspec> help ports

Returns this help:

ports:              TCP/IP ports on the system
  list []port:      All ports in use by processes (both listening and non-listening)
  listening []port: All listening ports

The shell also features auto-complete, which makes it easy to explore.

Once inside the shell, you can enter MQL queries to live test against your system. For example:

ports.listening.none( port == 23 )

To clear the terminal, type clear.

To exit the cnspec shell, press Ctrl + D or type exit.

Learn more

• To turn the MQL you test here into a policy, read Write Custom Policies.
• To explore cnspec commands, read the CLI Reference.
• To explore MQL resources, read the MQL Reference.
• To learn how to validate, upload, and manage finished policies, read Manage Policies.
• To learn about scanning systems using policies, read Get Started.