Examples

Real workflows, copy and run

Every recipe below reflects the extractor and dashboard as they actually behave today.

Linux, non-root, fully offline

The default posture: unprivileged scan, zero network, one sealed report.

# copy the issued extractor to the target any way you like
./hbs-extractor --no-elevate --quiet

# exit 0; hbs-report-*.hbs sits beside the binary
# deliver it via USB drop / dashboard upload

Air-gapped push over a jump host

Let the extractor deliver the report itself - the only time it uses the network.

# token comes from the environment…
HBS_PUSH_TOKEN=<campaignPushToken> ./hbs-extractor \
  --no-elevate --quiet --push https://dashboard.example/api/ingest

# …or from a read-only token file (mutually exclusive with the env var)
./hbs-extractor --push https://dashboard.example/api/ingest \
  --push-token-file /etc/hbs/push.token

Filtered re-scan of one category

Chase a specific finding without re-running the full catalog.

# only the SSH family, written to a fixed path
./hbs-extractor --category SSH --no-elevate --quiet \
  --out /tmp/ssh-followup.hbs

# or an explicit ID list
./hbs-extractor --only LIN-SSH-001,LIN-NET-004 --out /tmp/scan.hbs

Windows scripted / CI run

No prompts, no pause, machine-readable output.

hbs-extractor.exe --no-elevate --no-pause --quiet
# admin-only controls need one consent:
hbs-extractor.exe --elevate
# denial still completes: remaining checks fall back read-only
# and unresolved results become DegradedPartial

Create a campaign and issuance via API

Drive the dashboard programmatically; the session cookie authenticates.

POST /api/campaigns                         { "name":"Acme Q3", "locations":[{"name":"DC-East"}] }
POST /api/campaigns/:id/locations/:loc/issuances   { "platform":"linux-amd64" }
GET  /api/issuances/:id/download?token=<downloadToken>

Batch upload a fleet of reports

Collected offline by USB? Drop them all at once.

# Campaign → Locations & Hosts → drag up to 32 .hbs files
# into the drop zone.
#
# The dashboard decrypts, verifies, routes each host by
# machine-id, and auto-resolves findings that now pass on
# re-scans. SSE /api/events fires report-arrived per file.