RocketCyber CLI

Command-line interface for RocketCyber Managed SOC platform. Built with TypeScript and Commander.js, providing a simple and powerful way to interact with RocketCyber from the terminal.

Features

• JSON output by default with optional table formatting
• Full support for RocketCyber API resources
• Environment variable configuration
• Type-safe with TypeScript
• Pagination support
• Filtering and sorting

Installation

From npm (GitHub Packages)

npm install -g @wyre-technology/rocketcyber-cli

From source

git clone https://github.com/wyre-technology/rocketcyber-cli.git
cd rocketcyber-cli
npm install
npm run build
npm link

Configuration

The CLI requires authentication via environment variables:

Variable	Description	Required	Default
ROCKETCYBER_API_KEY	Your RocketCyber API key	Yes	-
ROCKETCYBER_REGION	API region: us or eu	No	us

Example Setup

export ROCKETCYBER_API_KEY="your-api-key-here"
export ROCKETCYBER_REGION="us"

For persistent configuration, add these to your shell profile (~/.bashrc, ~/.zshrc, etc.).

Usage

General Syntax

rocketcyber <resource> <action> [options]

Output Formats

All commands support two output formats:

• --format json (default): Machine-readable JSON output
• --format table: Human-readable table format

Available Commands

Account

Get account information:

# Get current account
rocketcyber account get

# Get specific account
rocketcyber account get --account-id 12345

# Table output
rocketcyber account get --format table

Agents

List monitored agents/endpoints:

# List all agents
rocketcyber agents list

# Filter by connectivity status
rocketcyber agents list --connectivity online

# Filter by hostname
rocketcyber agents list --hostname "server-01"

# Filter by platform
rocketcyber agents list --platform "Windows"

# With pagination
rocketcyber agents list --page 2 --page-size 50

# Table output
rocketcyber agents list --format table

Incidents

List security incidents:

# List all incidents
rocketcyber incidents list

# Filter by status
rocketcyber incidents list --status "open"

# Filter by severity
rocketcyber incidents list --severity "high"

# Filter by title
rocketcyber incidents list --title "Malware"

# Date range filter
rocketcyber incidents list --dates "2026-01-01:2026-03-01"

# Table output
rocketcyber incidents list --format table

Events

List security events:

# List all events
rocketcyber events list

# Filter by event type
rocketcyber events list --event-type "malware"

# Filter by severity
rocketcyber events list --severity "critical"

# Filter by hostname
rocketcyber events list --hostname "server-01"

# Date range filter
rocketcyber events list --dates "2026-03-01:2026-03-17"

# Table output
rocketcyber events list --format table

Get event summary/statistics:

# Get event summary
rocketcyber events summary

# Filter by date range
rocketcyber events summary --dates "2026-03-01:2026-03-17"

# Table output
rocketcyber events summary --format table

Firewalls

List firewall devices:

# List all firewalls
rocketcyber firewalls list

# Filter by connectivity
rocketcyber firewalls list --connectivity online

# Filter by vendor
rocketcyber firewalls list --vendor "Fortinet"

# Filter by hostname
rocketcyber firewalls list --hostname "fw-01"

# Table output
rocketcyber firewalls list --format table

Apps

List managed apps:

# List all apps
rocketcyber apps list

# Filter by name
rocketcyber apps list --name "Office 365"

# Filter by status
rocketcyber apps list --status "active"

# Table output
rocketcyber apps list --format table

Windows Defender

Get Windows Defender status:

# Get Defender status
rocketcyber defender get

# For specific account
rocketcyber defender get --account-id 12345

# Table output
rocketcyber defender get --format table

Office 365

Get Office 365 status:

# Get Office 365 status
rocketcyber office get

# For specific account
rocketcyber office get --account-id 12345

# Table output
rocketcyber office get --format table

Health Check

Verify API connectivity:

rocketcyber health
rocketcyber health --format table

Examples

Monitor all critical incidents

rocketcyber incidents list --severity critical --format table

Check online agents

rocketcyber agents list --connectivity online --format table

Get security events for a specific host

rocketcyber events list --hostname "server-01" --format table

Export incident data to JSON file

rocketcyber incidents list --severity high > high-severity-incidents.json

View event statistics

rocketcyber events summary --dates "2026-03-01:2026-03-17" --format table

Development

Prerequisites

• Node.js >= 20.0.0
• npm or yarn

Setup

git clone https://github.com/wyre-technology/rocketcyber-cli.git
cd rocketcyber-cli
npm install

Build

npm run build

Type Checking

npm run typecheck

Linting

npm run lint

Testing

npm test
npm run test:watch

Contributing

See CONTRIBUTING.md for guidelines.

Changelog

See CHANGELOG.md for release history.

License

MIT - See LICENSE for details.

Related Projects

• @wyre-technology/node-rocketcyber - Node.js client library (used by this CLI)
• @wyre-technology/rocketcyber-mcp - RocketCyber MCP server for Claude

Support

For issues and questions:

• GitHub Issues: https://github.com/wyre-technology/rocketcyber-cli/issues
• Documentation: https://github.com/wyre-technology/rocketcyber-cli

Security

For security issues, please contact security@wyretech.com.