Commands / kosa8 attack run
kosa8 attack run
Run the scenarios and write a signed scorecard
Usage
kosa8 run [SCENARIO...]
Policy mode (the default) puts each attempt to the decision code directly, with no daemon and no VM: it is what CI runs. --live also boots a sandbox per posture and runs the network and isolation scenarios inside it, taking the verdict from the audit entries the daemon writes; without a running daemon it says so and stays in policy mode.
The scorecard is signed with this machine's audit signing key (kosa8 audit
key prints its id) and, when the daemon is running, anchored in the audit log
as an attack.run entry. Check it with kosa8 attack verify FILE.
--fail-on allowed exits non-zero when any scenario of the hardened posture (or the only posture run) is ALLOWED; --fail-on approval also when one needs approval.
Options
| Flag | Type | What it does | Default |
|---|---|---|---|
--fail-on | string | exit non-zero when a result is allowed, or needs approval (allowed|approval) | — |
--live | bool | also run the network and isolation scenarios inside real sandboxes (needs the daemon) | — |
--no-record | bool | do not write the attack.run entry to the audit log | — |
-o, --out | string | write the signed scorecard here (default ~/.kosa8/attack/RUN.json) | — |
--posture | string | default (this machine's settings), hardened (the recommended setup), or both | both |
--upload | bool | upload the signed scorecard to your kosa8 Cloud org (run kosa8 login first) | — |