CLI reference

For the complete documentation index, see llms.txt. Markdown versions are available by appending .md to page URLs.

The installed binary is lookout. From a source checkout, replace lookout with node bin/lookout.js.

Inspect and validate

Command	Description
`lookout status`	Return runtime and component health as JSON
`lookout plan`	Return ready, degraded, and blocked detections
`lookout config-check`	Validate and print the effective non-secret configuration
`lookout doctor`	Run read-only operational and integrity checks
`lookout preflight-upgrade`	Run the doctor as an upgrade gate
`lookout validate-detection-pipeline`	Replay malicious and near-miss cases through the production pipeline

Command	Description
`lookout survey-declaration <survey.json>`	Merge explicit survey facts into the graph
`lookout survey-declaration-replace <survey.json>`	Replace the explicit survey source’s prior facts
`lookout survey-tailscale <tailnet-id>`	Run a read-only Tailscale survey
`lookout ingest <events.json>`	Ingest normalized events from a JSON file
`lookout import-sigma <rules.yml>`	Validate, compile, and persist supported Sigma rules
`lookout compact <retention-days>`	Compact events older than the retention window

Tailscale surveys require TAILSCALE_API_TOKEN or TAILSCALE_OAUTH_ACCESS_TOKEN at execution time.

Command	Description
`lookout collector-invite <asset-id> <deployment-id>`	Issue a single collector enrollment invitation
`lookout collector-enroll <identity-dir> <server-url> <asset-id> <deployment-id> <ca-file>`	Create an identity and enroll it using `LOOKOUT_ENROLLMENT_TOKEN_FILE`
`lookout collector-keygen <key-directory>`	Create a legacy Ed25519 collector identity
`lookout collector-submit <key-directory> <server-url>`	Run and submit one collection cycle
`lookout collector-run <key-directory> <server-url>`	Run continuous collection and submission
`lookout collector-status <collector-id>`	Inspect enrollment and accepted sequence state

Do not run multiple collector processes against the same state directory.

Command	Description
`lookout api-token-generate <principal-id> <role> [expires-at]`	Generate a bearer token and hashed credential record
`lookout storage-keygen <key-file>`	Generate an owner-only storage master key
`lookout backup-create <backup-file>`	Create an authenticated encrypted backup
`lookout backup-inspect <backup-file>`	Verify and list backup contents
`lookout backup-restore <backup-file> <new-data-directory>`	Restore into a new empty directory

Backup operations require LOOKOUT_MASTER_KEY_FILE. Keep the backup and master key in separate security domains.

Command	Description
`lookout export-resume`	Resume a corrected raw-event export queue
`lookout webhook-resume`	Resume a corrected Alert webhook queue
`lookout deployment-uninstall`	Notify the configured hosted console before uninstall
`lookout validate-live-linux <target-ip> <ssh-user> <known-hosts-file> <identity-file>`	Run non-destructive live Linux validation

All commands return machine-readable JSON on stdout. Installer progress is written to stderr so automation can safely parse the final result.