> ## Documentation Index
> Fetch the complete documentation index at: https://devlookout.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CLI reference

> Operate surveys, collectors, storage, detections, and integrations with the Lookout CLI.

> For the complete documentation index, see [llms.txt](https://devlookout.com/llms.txt). Markdown versions are available by appending `.md` to page URLs.

The installed binary is `lookout`. From a source checkout, replace `lookout` with `node bin/lookout.js`.

## Inspect and validate

| Command                               | Description                                                          |
| ------------------------------------- | -------------------------------------------------------------------- |
| `lookout status`                      | Return runtime and component health as JSON                          |
| `lookout plan`                        | Return ready, degraded, and blocked detections                       |
| `lookout config-check`                | Validate and print the effective non-secret configuration            |
| `lookout doctor`                      | Run read-only operational and integrity checks                       |
| `lookout preflight-upgrade`           | Run the doctor as an upgrade gate                                    |
| `lookout validate-detection-pipeline` | Replay malicious and near-miss cases through the production pipeline |

## Survey and ingest

| Command                                            | Description                                          |
| -------------------------------------------------- | ---------------------------------------------------- |
| `lookout survey-declaration <survey.json>`         | Merge explicit survey facts into the graph           |
| `lookout survey-declaration-replace <survey.json>` | Replace the explicit survey source's prior facts     |
| `lookout survey-tailscale <tailnet-id>`            | Run a read-only Tailscale survey                     |
| `lookout ingest <events.json>`                     | Ingest normalized events from a JSON file            |
| `lookout import-sigma <rules.yml>`                 | Validate, compile, and persist supported Sigma rules |
| `lookout compact <retention-days>`                 | Compact events older than the retention window       |

Tailscale surveys require `TAILSCALE_API_TOKEN` or `TAILSCALE_OAUTH_ACCESS_TOKEN` at execution time.

## Collectors

| Command                                                                                     | Description                                                            |
| ------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| `lookout collector-invite <asset-id> <deployment-id>`                                       | Issue a single collector enrollment invitation                         |
| `lookout collector-enroll <identity-dir> <server-url> <asset-id> <deployment-id> <ca-file>` | Create an identity and enroll it using `LOOKOUT_ENROLLMENT_TOKEN_FILE` |
| `lookout collector-keygen <key-directory>`                                                  | Create a legacy Ed25519 collector identity                             |
| `lookout collector-submit <key-directory> <server-url>`                                     | Run and submit one collection cycle                                    |
| `lookout collector-run <key-directory> <server-url>`                                        | Run continuous collection and submission                               |
| `lookout collector-status <collector-id>`                                                   | Inspect enrollment and accepted sequence state                         |

Do not run multiple collector processes against the same state directory.

## Credentials and storage

| Command                                                         | Description                                          |
| --------------------------------------------------------------- | ---------------------------------------------------- |
| `lookout api-token-generate <principal-id> <role> [expires-at]` | Generate a bearer token and hashed credential record |
| `lookout storage-keygen <key-file>`                             | Generate an owner-only storage master key            |
| `lookout backup-create <backup-file>`                           | Create an authenticated encrypted backup             |
| `lookout backup-inspect <backup-file>`                          | Verify and list backup contents                      |
| `lookout backup-restore <backup-file> <new-data-directory>`     | Restore into a new empty directory                   |

Backup operations require `LOOKOUT_MASTER_KEY_FILE`. Keep the backup and master key in separate security domains.

## Recovery and delivery

| Command                                                                                 | Description                                           |
| --------------------------------------------------------------------------------------- | ----------------------------------------------------- |
| `lookout export-resume`                                                                 | Resume a corrected raw-event export queue             |
| `lookout webhook-resume`                                                                | Resume a corrected Alert webhook queue                |
| `lookout deployment-uninstall`                                                          | Notify the configured hosted console before uninstall |
| `lookout validate-live-linux <target-ip> <ssh-user> <known-hosts-file> <identity-file>` | Run non-destructive live Linux validation             |

All commands return machine-readable JSON on stdout. Installer progress is written to stderr so automation can safely parse the final result.