# kosa8 attack run

Run the scenarios and write a signed scorecard

## Usage

```
kosa8 run [SCENARIO...]
```

Policy mode (the default) puts each attempt to the decision code directly,
with no daemon and no VM: it is what CI runs. --live also boots a sandbox per
posture and runs the network and isolation scenarios inside it, taking the
verdict from the audit entries the daemon writes; without a running daemon
it says so and stays in policy mode.

The scorecard is signed with this machine's audit signing key (`kosa8 audit
key` prints its id) and, when the daemon is running, anchored in the audit log
as an attack.run entry. Check it with `kosa8 attack verify FILE`.

--fail-on allowed exits non-zero when any scenario of the hardened posture (or
the only posture run) is ALLOWED; --fail-on approval also when one needs approval.

## Flags

| Flag | Type | What it does | Default |
|---|---|---|---|
| `--fail-on` | string | exit non-zero when a result is allowed, or needs approval (allowed\|approval) |  |
| `--live` | bool | also run the network and isolation scenarios inside real sandboxes (needs the daemon) |  |
| `--no-record` | bool | do not write the attack.run entry to the audit log |  |
| `--out, -o` | string | write the signed scorecard here (default ~/.kosa8/attack/RUN.json) |  |
| `--posture` | string | default (this machine's settings), hardened (the recommended setup), or both | `both` |
| `--upload` | bool | upload the signed scorecard to your kosa8 Cloud org (run kosa8 login first) |  |

---
Source: https://docs.kosa8.com/reference/attack-run/