DocumentationCLI command reference
The installed binary is the authoritative reference for its build:
packetsafari
packetsafari help investigate
packetsafari investigate --help
packetsafari alert verify --help
packetsafari ingest --help
Inside a source checkout, omit ./: ./packetsafari is the development launcher, while packetsafari from PATH is the operator CLI.
Primary commands
| Command | Purpose |
|---|---|
config | Save, unset, and display CLI defaults. |
doctor | Diagnose local capture support and prerequisites. |
capture-local | Record traffic on the workstation. |
auth | Manage interactive login state. |
api-key | Create, list, or revoke operator API keys when the signed-in role permits it. |
upload | Upload one capture with login/bearer authentication. |
ingest | Transfer files/directories with resumable state and optional investigation. |
status | Read capture processing status. |
investigate | Run the general goal/workflow investigation contract. |
alert verify | Verify supplied IDS alert context through the same investigation contract. |
probe | Work with installed probe evidence and alert windows. |
analyze, run | Lower-level Agent streaming commands. |
Goals and workflows
Goals are troubleshoot, security, wifi, summary, network, and custom. Workflows are fast, progressive, triage_deep, and triage. --verify adds independent Verification to Fast. --inference-speed fast requests provider acceleration and does not change the workflow.
See Investigations for milestone semantics and selection examples.
Investigation and alert flags
| Flag | Purpose |
|---|---|
--goal | Select the investigation goal. |
--workflow | Select Fast, Progressive, Triage then report, or Triage only. |
--verify | Follow Fast with independent Verification. |
--capture-id | Use an existing upload instead of a local file. |
--event, --envelope | Supply an alert event or PacketSafari alert envelope. |
--external-alert-id | Preserve a source-system alert identity. |
--settings | Load grouped investigation configuration JSON. |
--analysis-plan | Load upload/indexing plan JSON. |
--full-ids | Request complete IDS scanning independently of Fast. |
--anonymize, --anoncap-options | Prepare and use a server-side protected copy. |
--ai-auth-source-id | Choose the configured AI connection. |
--model, --reasoning-effort | Override account/team model defaults. |
--inference-speed | Request standard or eligible provider acceleration. |
--verbosity | Request low, medium, or high response detail. |
--email | Request eligible report delivery. |
--idempotency-key | Give a retry the same request identity. |
--job-id | Resume observation of an existing job. |
--tui | Configure the request interactively before upload. |
--format | Select markdown, json, ndjson, or sse. |
--quiet, --verbose | Control progress and diagnostic detail. |
Explicit flags override environment variables and saved flat configuration. Grouped --settings values and their current precedence are explained in Install and configure.
Development and deployment commands
These similarly named tools have separate responsibilities:
| Invocation | Responsibility |
|---|---|
packetsafari ... | Installed operator CLI described on this page. |
./packetsafari dev ... | Development services from a source checkout. |
./packetsafari release ... | SaaS release workflow from a source checkout. |
packetsafari-ops ... | On-prem host installation, service, backup, and upgrade operations. |
See PacketSafari Ops CLI for deployment operations.