magnus919_agent-skills/crowdsec/references/cscli-command-reference.md

cscli Command Reference

Full reference for cscli — the CrowdSec command-line tool for managing the entire stack.

Global Flags

-c, --config string   path to crowdsec config file (default "/etc/crowdsec/config.yaml")
-o, --output string   Output format: human, json, raw
    --color string    Output color: yes, no, auto (default "auto")
    --debug           Set logging to debug
    --info            Set logging to info
    --warning         Set logging to warning
    --error           Set logging to error
    --trace           Set logging to trace
-h, --help            help for cscli

Hub Management

Command	Description
cscli hub update	Update the local hub index (state-changing; run only after the mutation safety gate)
cscli hub list	List hub index info
cscli collections install <name>	Install a collection
cscli collections list	List installed collections
cscli collections list --all	List all available collections
cscli collections upgrade <name>	Upgrade a collection
cscli collections inspect <name>	Show collection details and metrics
cscli collections delete <name>	Remove a collection
cscli parsers install <name>	Install a parser
cscli parsers list	List installed parsers
cscli parsers list --all	List all available parsers
cscli parsers upgrade <name>	Upgrade a parser
cscli parsers inspect <name>	Show parser details/metrics
cscli parsers delete <name>	Remove a parser
cscli scenarios install <name>	Install a scenario
cscli scenarios list	List installed scenarios
cscli scenarios list --all	List all available scenarios
cscli scenarios upgrade <name>	Upgrade a scenario
cscli scenarios inspect <name>	Show scenario details/metrics
cscli scenarios delete <name>	Remove a scenario
cscli postoverflows install <name>	Install a postoverflow
cscli postoverflows list	List installed postoverflows
cscli appsec-rules list	List installed AppSec rules
cscli appsec-configs list	List AppSec configurations
cscli contexts list	List contexts
cscli hubtest	Run functional tests on hub configurations

Decision & Alert Management

Command	Description
cscli decisions add --ip <IP> [--duration 4h] [--type ban] [--reason "..."]	Add a manual decision
cscli decisions list	List active decisions
cscli decisions list -o json	List decisions as JSON (includes CTI data)
cscli decisions delete --id <id>	Delete a specific decision by ID
cscli decisions delete --ip <IP>	Delete all decisions for an IP
cscli alerts list	List alerts
cscli alerts list --contain "scenario:ssh-bf"	Filter alerts by scenario
cscli alerts inspect <id>	Show alert details

Bouncer & Agent Management

Command	Description
cscli bouncers add <name>	Add a bouncer and generate API key (shown once only)
cscli bouncers list	List all bouncers with IP, validity, last pull
cscli bouncers delete <name>	Remove a bouncer
cscli machines add <name> [--password <pwd>]	Register an agent machine
cscli machines list	List registered agents
cscli machines delete <name>	Remove an agent

Metrics & Observability

Command	Description
cscli metrics	Full metrics dashboard
cscli metrics -o json	JSON output for programmatic use
cscli metrics show appsec	AppSec-specific metrics (processed vs blocked)
cscli metrics show bouncers	Bouncer-specific metrics

Console & LAPI

Command	Description
cscli console status	Check console connection status
cscli console enroll <enroll_key>	Enroll engine in CrowdSec Console
cscli lapi register	Register remote agent to LAPI

Additional Commands

Command	Description
cscli version	Display version and build info
cscli config	View current configuration
cscli explain	Explain log pipeline — simulate how a log line is processed
cscli simulation	Manage simulation status of scenarios
cscli allowlists	Manage centralized allowlists (v1.6+)
cscli capi	Manage interaction with Central API
cscli papi	Manage interaction with Polling API
cscli dashboard	Manage Metabase dashboard container
cscli support	Generate support bundle for troubleshooting
cscli notifications list	List notification plugins
cscli notifications test <name>	Test a notification plugin