Introduction to the Incydr command-line interface

Overview

The Incydr command-line interface (CLI) tool offers a way to interact with your Incydr environment without using the Incydr console or making API calls directly. For example, you can use it to help integrate Incydr with other systems or to automate tasks within Incydr. This article provides an overview of the Incydr CLI and links to additional details. 

Use cases

You can use the Incydr CLI to:

• Integrate with a security information and event management (SIEM) tool by ingesting:
  • File exfiltration events
  • Alerts
  • Audit Log events
• Manage watchlists
• Manage alerts
• Manage users associated with alert rules
• Manage trusted activity
• Create and manage cases 
• View and filter users 

Benefits 

• Ability to output data in the following formats: JSON, CSV, table
• Uses the /v2/file-events Incydr API endpoint, which uses a hierarchical structure with parent objects for each field

CLI documentation 

For more information, see the full Incydr CLI documentation on the Incydr Developer Portal. 

Considerations

Code42 CLI available for existing integrations
The Code42 command-line interface (CLI) is still available for existing integrations. Use the Code42 CLI for preservation-related use cases like legal hold. 

External resources

• CLI documentation
• Download Python

Related topics

• Incydr Developer Portal
• Incydr integrations resources
• Introduction to the Incydr SDK