quox engagement
quox engagement
Section titled “quox engagement”QUOX-SECURITY: engagements + scope targets, live capability scanners (run via scan/scan-async; see “engagement tools” for the list), and findings (report/verify/regrade/resolve)
| Command | What it does |
|---|---|
quox engagement create [options] <name> | Create a new security engagement |
quox engagement list | List engagements for the current org |
quox engagement show <id> | Show an engagement and its targets |
quox engagement set-gripe-target [options] <id> | Set which repo a finding filed from this engagement goes to, and which org GitHub connector token files it. Lets a customer-site engagement file into the customer repo with the customer org token. Pass --clear (or --repo "") to fall back to the platform default (quoxai/quox) and the engagement own org. |
quox engagement add-target [options] <id> <type> <value> | Add a target (type: domain | cidr | repo | cloud_account | url) to an engagement |
quox engagement verify-target <id> <targetId> | Run the domain-verification challenge for a target |
quox engagement check-policy <id> <targetValue> <capabilityRisk> | Check whether a capability of the given risk tier is currently allowed against a target (passive|discovery|safe_active|intrusive|credential_sensitive|exploit_emulation) |
quox engagement scan <id> <target> <tool> | Attempt a Phase 1 capability tool against a verified, in-scope target (tool: discover_hosts | probe_http | discover_app_ports | vuln_scan). Policy-gated; honestly fails if no scan host is configured. |
quox engagement discover-ports [options] <id> <hostTarget> | Discover which app ports on a verified, in-scope host actually serve HTTP(S) (httpx over a curated port set), so a scan hits the real surface instead of only :80/:443. With --add, register each discovered endpoint as a verified url target (control re-proven via fleet membership). |
quox engagement tools | List the real capability tools (name, risk tier, binary). Quoxcli-parity fix: this catalog backed the dashboard Tools tab but had no CLI verb. |
quox engagement scan-async <id> <target> <tool> | Start a capability tool as a background job and return immediately (job_id). Use for tools that can outrun a single request, e.g. vuln_scan/nuclei or discover_app_ports over a wide host set. Poll with quox engagement job <jobId>. |
quox engagement job <jobId> | Check the status/result of an async scan job (queued | running | succeeded | failed) |
quox engagement jobs <id> | List async scan jobs for an engagement |
quox engagement report-finding [options] <id> <targetValue> <title> <description> | Report a candidate finding against a target within an engagement. Always starts as status “candidate” |
quox engagement findings <id> | List findings for an engagement |
quox engagement verify-finding [options] <findingId> <verdict> | Confirm or refute a candidate finding (verdict: confirmed | refuted). A reason is required, a bare verdict is refused |
quox engagement resolve-finding <findingId> | Mark a finding remediated (status: resolved). Refuses a refuted finding |
quox engagement regrade-finding [options] <findingId> <severity> | Re-grade a reported finding’s severity (info | low | medium | high | critical). A reason is required, the same discipline as verify-finding, because severity is a published field |
quox engagement report [options] <id> | Download the engagement report (targets, tools run, findings) as a PDF |
quox engagement issue <findingId> | Raise a finding as a GitHub issue. Honest no-op if GitHub is not configured or the stored token is rejected, never a fake success. Skips re-filing if already raised. |
quox engagement propose [options] <findingId> | Propose a finding as a QuoxPlan note (default stream: QUOX-SECURITY, #438) |
quox engagement schedule | Recurring scan schedules (re-run a tool on a fixed cadence) |
quox engagement sync-issues <id> | Reconcile this engagement’s filed findings against their GitHub issue state. A closed issue auto-resolves its finding. Honest no-op if GitHub is not configured |