CLI Reference

Run in the browser at /cli, or docker exec -it tis-cli node /app/src/cli/index.js. Tab completes commands and options; <command> --help shows its options. Built-ins: clear, logout, exit/quit, help.

Lists accept --page/-p and --limit/-l (default 10). Tables fit the terminal width; results are reported as ✔ success, ! warning, ✖ error. Options marked * are required. Sources and groups can be referenced by ID or name where noted.

Sources

Command (aliases)	Options
sources:print (sources, sources:list)	--page, --limit
source:create (source:add, source:new)	--name*, --url, --format (plain|hosts|json|csv), --tags a,b, --schedule "<cron or preset>", --options/-o '<json>', --private, --manual, --days-retention, --days-purge
source:update (source:edit)	--id*, --name, --url, --format, --tags (replace), --schedule (manual/null clears), --options/-o, --private/--no-private, --manual/--no-manual, --days-retention/--days-purge (default clears)
source:detail (source:view, source:show)	--id*
source:delete (source:remove, source:rm)	--id*
source:fetch	--id*, --dry-run
geoip:update	Download the GeoIP data now and recompute the countries.
scheduler:resync (scheduler:reload, scheduler:sync)	--id (default: all sources)

Indicators

Command (aliases)	Options
indicators:print (indicators, indicators:list)	--type/-t, --tag (source tag), --permanent/--no-permanent, --country CZ,SK, --page, --limit
indicator:add (indicator:new)	--source/-s* (ID or name), values as arguments or --value (repeatable, comma-separated), --file <path>, --tags a,b, --permanent
indicator:update (indicator:edit)	--id*, --permanent/--no-permanent, --tags (replace, "" clears)
indicator:delete (indicator:remove, indicator:rm)	--id*
indicators:search <value> (lookup)	IP/CIDR, domain or URL – is it listed, by which source?
indicators:export (export, indicators:out)	--format/-f (plain|hosts|rpz|zone|csv|nftables|ipset|ipfw|dnsmasq|unbound), --type/-t, --tag, --whitelist/-w (repeatable), --group/-g (ID or name), --rpz-ip (response|client|nsip), --countries (CZ,SK / !CN)

Groups

Command (aliases)	Options
groups:print (groups, groups:list)	--page, --limit
group:create (group:add, group:new)	--name*, --description, --sources (IDs or names, feed[tag,!tag]), --whitelist, --blacklist, --whitelist-sources, --blacklist-sources, --countries (CZ,SK / !CN)
group:update (group:edit)	--group/-g*, --name, --description, --sources/--add-source/--remove-source, --whitelist/--add-whitelist/--remove-whitelist, --blacklist/--add-blacklist/--remove-blacklist, --whitelist-sources/--add-whitelist-source/--remove-whitelist-source, --blacklist-sources/--add-blacklist-source/--remove-blacklist-source, --countries (replace)
group:detail (group:view, group:show)	--group/-g*
group:delete (group:remove, group:rm)	--group/-g*

All list values are comma-separated; "" clears a replaced list.

Audit

Command (aliases)	Options
audit (audit:print)	--actor, --page, --limit – newest first

Tokens

Command (aliases)	Options
tokens:print (tokens, tokens:list)	--page, --limit
token:create (token:add, token:new)	--name*, --description, --role (admin|user|guest), --acl '<json array>'
token:update (token:edit)	--id*, --name, --description (null clears), --role, --acl (null clears)
token:rotate (token:renew)	--id*
token:delete (token:remove, token:rm)	--id*

Examples

source:create --name urlhaus-hosts --url https://urlhaus.abuse.ch/downloads/hosts/ --format hosts --schedule "0 * * * *" --tags malware
source:fetch --id 4 --dry-run
indicator:add -s customer-x-blocklist --permanent evil.example.com 203.0.113.0/24
group:update -g customer-x --add-source urlhaus-hosts
export --group customer-x --format rpz -w 192.168.0.0/16
token:create --name customer-x-pull --role guest --acl '["export/group/customer-x"]'