Fortify CLI

https://fortify.github.io/fcli/
Admin
Fortify CLI (fcli) is a universal command-line interface utility for interacting with various...
Tokens:1,201,317
Snippets:20,381
Trust Score:9.7
Update:3 months ago
Show doc for...
Tokens:
Raw
### Sample fcli tool installation commands

Source: https://fortify.github.io/fcli/dev_feat.v3.x.aviator.26.3/manpage/fcli-tool-vuln-exporter-install.html

Examples demonstrating various installation scenarios, including version selection and uninstallation policies.

```bash
fcli tool <name> install -v latest
```

```bash
fcli tool <name> install -v latest --uninstall all
```

```bash
fcli tool <name> install -v 2 --uninstall 2
```

```bash
fcli tool <name> install -v latest fcli tool <name> install -v 1 --no-global-bin
```

--------------------------------

### Basic fcli Workflow Setup

Source: https://fortify.github.io/fcli/dev_feat.v3.x.aviator.26.3/ci/github/v3.1.x/setup-action.html

Example configuration for a GitHub Actions workflow that installs fcli and executes custom commands.

```yaml
name: Custom Fortify Workflow
on: [push]

jobs:
  custom-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: fortify/github-action/setup@v3
        with:
          fcli: bootstrapped               # Set up bootstrapped fcli version. May also specify specific version, but
                                           # then fcli may be downloaded twice (bootstrap version and requested version).
        env:
          FCLI_BOOTSTRAP_VERSION: v3.15.0  # Defaults to latest v3.x.y, pin to specific version for stability
      - name: Run custom fcli commands
        run: |
          fcli fod session login ...
          # Your custom workflow here
          fcli fod session logout ...
```

--------------------------------

### [step] with

Source: https://fortify.github.io/fcli/dev_feat.v3.x.aviator.26.3/action-development.html

Allows for running initialization and cleanup steps around a block of steps, such as managing sessions or configuring data writers.

```APIDOC
## [step] with

### Description
This step allows for running initialization and cleanup steps around the steps listed in the 'do' block. This includes managing fcli sessions and defining writers for outputting data in various formats.

### Parameters
- **sessions** (array) - Optional - List of login/logout configurations.
- **writers** (object) - Optional - Configuration for data writers (e.g., csvWriter).
- **do** (array) - Required - The steps to execute within the context.
```

--------------------------------

### fcli ssc custom-tag get

Source: https://fortify.github.io/fcli/dev_feat.v3.x.aviator.26.3/manpage/fcli-ssc-custom-tag-get.html

Retrieves details for a specific custom tag using its name or GUID.

```APIDOC
## fcli ssc custom-tag get

### Description
Retrieves information about a specific custom tag from the Fortify SSC server.

### Arguments
- **customTagNameOrGuid** (string) - Required - The name or GUID of the custom tag to retrieve.

### Options
- **--ssc-session** (string) - Optional - Name of the SSC session to use. Default: default.
- **-o, --output** (string) - Optional - Select output type (csv, table, expr, json, xml, yaml).
- **--to-file** (string) - Optional - Write output to the specified file.
- **--debug** (flag) - Optional - Enable collection of debug logs.
- **--log-level** (string) - Optional - Set logging level (TRACE, DEBUG, INFO, WARN, ERROR, NONE).
```

--------------------------------

### fcli ssc action run setup-appversion

Source: https://fortify.github.io/fcli/dev_feat.v3.x.aviator.26.4/ssc-actions.html

Prepares an application version for security scanning by creating the application and/or release if they do not exist.

```APIDOC
## fcli ssc action run setup-appversion

### Description
Allows for preparing an application version for running an application security scan, creating the application and/or release if they do not exist yet. This action provides a standardized approach for application version creation.

### Options
- **--appversion, --av** (string) - Required - Application version name as <appName>:<versionName>
- **--add-users** (string) - Optional - See fcli ssc appversion create
- **--attrs, --attributes** (string) - Optional - See fcli ssc appversion create
- **--copy** (string) - Optional - See fcli ssc appversion create
- **--description, -d** (string) - Optional - See fcli ssc appversion create
- **--copy-from, --from** (string) - Optional - See fcli ssc appversion create
- **--issue-template** (string) - Optional - See fcli ssc appversion create
- **--refresh-timeout** (string) - Optional - See fcli ssc appversion create. Default: 300s
- **--store** (string) - Optional - See fcli ssc appversion create
```

--------------------------------

### fcli ssc variable get

Source: https://fortify.github.io/fcli/dev_feat.v3.x.aviator.26.3/manpage/fcli-ssc-variable-get.html

Retrieves a variable from SSC by name, ID, or GUID for a specified application version.

```APIDOC
## fcli ssc variable get

### Description
Retrieves a specific variable from SSC using its name, ID, or GUID, scoped to a particular application version.

### Parameters
#### Required Parameters
- **--av** (string) - Required - Application version ID or <application>:<version> name.
- **VariableNameOrIdOrGuid** (string) - Required - The variable name, ID, or GUID to retrieve.

#### Optional Parameters
- **--delim** (string) - Optional - Change the default delimiter character for application:version arguments.
- **--ssc-session** (string) - Optional - Name of the SSC session to use. Default: default.
- **--output** (string) - Optional - Select output type (csv, table, expr, json, xml, yaml).
- **--style** (string) - Optional - Select output style (e.g., header, pretty, flat).
- **--to-file** (string) - Optional - Write output to the specified file.
- **--debug** (boolean) - Optional - Enable collection of debug logs.
- **--log-level** (string) - Optional - Set logging level (TRACE, DEBUG, INFO, WARN, ERROR, NONE).
```

--------------------------------

### Custom Fortify Workflow Setup

Source: https://fortify.github.io/fcli/dev_feat.v3.x.aviator.26.3/ci/github/v3.0.x/setup-action.html

Basic configuration for a GitHub Actions workflow using the setup action with fcli version pinning.

```yaml
name: Custom Fortify Workflow
on: [push]

jobs:
  custom-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: fortify/github-action/setup@v3
        with:
          fcli: bootstrapped               # Set up bootstrapped fcli version. May also specify specific version, but
                                           # then fcli may be downloaded twice (bootstrap version and requested version).

        env:
          FCLI_BOOTSTRAP_VERSION: v3.15.0  # Defaults to latest v3.x.y, pin to specific version for stability
      - name: Run custom fcli commands
        run: |
          fcli fod session login ...
          # Your custom workflow here
          fcli fod session logout ...
```

--------------------------------

### fcli ssc performance-indicator get

Source: https://fortify.github.io/fcli/dev_feat.v3.x.aviator.26.3/manpage/fcli-ssc-performance-indicator-get.html

Retrieves a performance indicator by its name, ID, or GUID for a specified application version.

```APIDOC
## fcli ssc performance-indicator get

### Description
Retrieves the details of a performance indicator from Fortify SSC. The command requires the application version and the performance indicator identifier.

### Usage
fcli ssc performance-indicator get --av <appVersionNameOrId> <performanceIndicatorNameOrIdOrGuid>

### Parameters
#### Required Parameters
- **--av, --appversion** (string) - Application version ID or <application>:<version> name.
- **performanceIndicatorNameOrIdOrGuid** (string) - Performance indicator name, ID, or GUID.

#### Optional Parameters
- **--delim** (string) - Change the default delimiter character for application:version arguments.
- **--ssc-session** (string) - Name of the SSC session to use. Default: default.
- **-o, --output** (string) - Select output type (csv, table, expr, json, xml, yaml).
- **--to-file** (string) - Write output to the specified file.
- **--debug** (flag) - Enable collection of debug logs.
```

--------------------------------

### Manage sessions with [step] with

Source: https://fortify.github.io/fcli/dev_feat.v3.x.aviator.26.3/action-development.html

Use this step to wrap operations in initialization and cleanup logic, such as session login/logout or writer management.

```yaml
steps:
  - with:
      sessions:
        - login: fcli fod session login ... --fod-session=myActionSession
          logout: fcli fod session logout --fod-session=myActionSession
    do:
      - run.fcli:
          myCmd: fcli fod ... --fod-session-myActionSession
```

```yaml
steps:
  - with:
      writers:
        csvWriter:
          to: ${cli.file}
        type: csv
    do:
      - records.for-each:
          from: ${records}
          record.var-name: record
          do:
            - writer.append:
                csvWriter: ${record}
```

--------------------------------

### Wait for SAST scan completion

Source: https://fortify.github.io/fcli/dev_feat.v3.x.aviator.26.3/manpage/fcli-fod-mast-scan-wait-for.html

Example showing how to start a SAST scan and wait for its completion using an fcli variable.

```bash
fcli fod sast-scan start ... --store scan
fcli fod sast-scan wait-for ::scan::
```

--------------------------------

### fcli fod action run setup-release

Source: https://fortify.github.io/fcli/dev_feat.v3.x.create-pr-fcli-action/fod-actions.html

Automates the creation and configuration of an application release for security scanning, including optional SAST and software composition analysis setup.

```APIDOC
## fcli fod action run setup-release

### Description
Prepares an application release for security scanning by creating the application/release if they do not exist and configuring scan settings. Currently supports SAST scan setup.

### Options
- **--release, --rel** (string) - Required - Release name as <application>[:<microservice>]:<release>
- **--scan-types, -t** (string) - Optional - Comma-separated list of scan types (only 'sast' supported).
- **--attributes, --attrs** (string) - Optional - Comma-separated list of attributes to set on the application/release.
- **--sdlc-status, --status** (string) - Optional - SDLC status. Default: Development
- **--app-type** (string) - Optional - Application type. Default: Web
- **--app-criticality** (string) - Optional - Application criticality. Default: Medium
- **--override-sast-settings** (boolean) - Optional - Override existing SAST scan settings if already configured.
```

--------------------------------

### fcli fod sast-scan start

Source: https://fortify.github.io/fcli/dev_feat.v3.x.create-pr-fcli-action/manpage/fcli-fod-sast-scan-start.html

Initiates a SAST scan for a specific FoD release. The scan must have been previously set up via the FoD UI or the 'fcli fod sast-scan setup' command.

```APIDOC
## fcli fod sast-scan start

### Description
Starts a SAST scan for a specified FoD release using a ScanCentral package file.

### Parameters
- **--file** (string) - Required - Absolute path of the ScanCentral package (.Zip) file to upload.
- **--rel** (string) - Required - Release id or <application>[:<microservice>]:<release> name.
- **--delim** (string) - Optional - Change the default delimiter character for release arguments.
- **--entitlement-preference** (string) - Optional - Entitlement preference (SingleScanOnly, SubscriptionOnly, SingleScanFirstThenSubscription, SubscriptionFirstThenSingleScan).
- **--in-progress-action** (string) - Optional - Action if a scan is already in progress (DoNotStartScan, CancelScanInProgress, Queue).
- **--notes** (string) - Optional - Scan notes.
- **--progress** (string) - Optional - Configure progress output (auto, none, simple, stderr, single-line, ansi).
- **--remediation** (string) - Optional - Remediation preference (RemediationScanIfAvailable, RemediationScanOnly, NonRemediationScanOnly).
- **--validate-entitlement** (boolean) - Optional - Validate if an entitlement has been set and is still valid.
- **--fod-session** (string) - Optional - Name of the FoD session to use.
```

--------------------------------

### Install latest tool version

Source: https://fortify.github.io/fcli/dev_feat.v3.x.aviator.26.3/manpage/fcli-tool-debricked-cli-install.html

Installs the latest version of the tool while retaining any previously installed versions.

```bash
fcli tool <name> install -v latest
```
Tokens:
Raw