CLI reference

Every command, subcommand, and flag exposed by the obexum binary. The CLI is a single self-contained executable — download the signed build for your target OS from Account → Builds, and run it locally or against a remote host over SSH.

Synopsis

obexum [command] [flags]

Obexum is a professional-grade vulnerability scanner that combines deterministic open-source engines (Lynis, Trivy, Nuclei, nmap, osquery) with optional LLM-powered reasoning to surface real risk in your infrastructure.

Global flags

These persistent flags apply to every command:

Commands at a glance

• scan
• verify
• report
• config
• history
• diff
• fix
• playbook
• init
• targets
• findings
• defend
• gui
• sbom

scan

Run a security scan: runs the enabled scanners + audit checks against the configured target and generates reports.

# Scan the local host with config defaults
obexum scan -t local://localhost

# Deep scan of a remote host, HTML + SARIF reports, with Claude reasoning
obexum scan -t ssh://root@10.0.0.5 -d deep -f html,sarif --ai

verify

Verify a single finding has been remediated (ACME-style loop). Re-runs the audit rule bound to a portal-issued verify token and posts the result back; the portal marks the finding pass (fixed) or fail (still present).

# Run on the target host after applying the suggested remediation
obexum verify --upload-token=$VERIFY_JWT --portal-url=https://obexum.com

report

Regenerate a report for a past scan, or render a compliance coverage matrix against a recognised framework. Omit --scan-id to list recent scans.

# Re-render a past scan as JSON
obexum report --scan-id=<id> -f json

# Render a CIS compliance coverage matrix for that scan
obexum report --scan-id=<id> --framework cis

config

Print the effective configuration (after defaults, config file, and flags are merged) as JSON.

obexum config

history

Show scan history and the trend for a target.

obexum history -t prod-dc-01 -n 10

diff

Show what changed between two scans (A = baseline, B = newer): new, resolved, persisting, worsened, and improved findings.

obexum diff <scan-A-id> <scan-B-id>

obexum diff a1b2c3d4 e5f6a7b8 --full

fix

Show, and optionally apply, the remediation plan for a scan. Default mode is dry-run — it prints the ranked plan and does nothing.

# Show the plan (dry-run)
obexum fix --scan-id <uuid>

# Apply only low-risk fixes, confirming each group
obexum fix --scan-id <uuid> --apply --risk-max low

playbook

Inspect and render Obexum remediation playbooks from the built-in knowledge base, independently of any scan. Rendering prints a script that is not executed — it is intended for a change-management reviewer.

playbook list

List every playbook in the built-in KB.

playbook show <playbook-id>

Show the full body of one playbook (summary, advisories, pre/post checks, commands, rollback, references).

playbook render <playbook-id>

Render a playbook into a single shell or PowerShell script for offline review. Nothing is run.

# Browse the catalogue for Windows DC playbooks
obexum playbook list --platform windows-dc

# Render one to a reviewable script
obexum playbook render pb-windows-dc-adcs-001 \
    --item OBX_ESC1_AltSAN \
    --target prod-dc-01 \
    -o fix-ADCS-001.ps1

init

Bootstrap ~/.obexum/ with a starter config.yaml and an ed25519 SSH keypair location. Creates the keys/ and scans/ directories with sensible defaults.

obexum init

targets

Manage named scan targets in ~/.obexum/targets.yaml so you can scan by short name — obexum scan --target prod-dc-01 — instead of retyping the SSH spec each time. You can also scan ad hoc by spec (ssh://user@host or local://localhost) without registering.

targets add <name>

Add (or update) a named scan target.

targets list

List configured scan targets.

targets remove <name>

Remove a configured target.

obexum targets add prod-dc-01 \
    --type windows-dc \
    --host 10.0.0.5 \
    --user Administrator

obexum targets list

findings

Inspect findings from a previous scan engagement, read out of ~/.obexum/scans/<scan_id>/findings.json. When --scan is omitted, the most recent engagement is used.

findings list

List the rule_ids, severities, and counts in an engagement.

findings show <rule-id>

Show one finding's full evidence + remediation hints from an engagement.

obexum findings list

obexum findings show AUD-WIN-ADCS-001

defend

Scan server logs for attackers and enrich with GeoIP + threat intel. Discovers external IPs that attacked the target (SSH brute-force, web 4xx/5xx bursts, fail2ban bans), attributes each with country / ISP / ASN / hosting type, and cross-references public feeds (Spamhaus, FireHOL, ET, CINS, TOR, Blocklist.de).

obexum defend --target ssh://root@example.com

obexum defend --target ssh://root@example.com --blocklist /tmp/block.txt

gui

Start the Obexum GUI server (local web dashboard). Binds to 127.0.0.1:7070 by default and prints a token the browser uses to authenticate.

obexum gui
# then open http://localhost:7070/ui/ and paste the printed token

sbom

Generate an SPDX 2.3 JSON Software Bill of Materials for the target system by enumerating installed packages (dpkg / rpm / apk). Each package emits an SPDX Package + DESCRIBES Relationship with a purl externalRef.

obexum sbom -t local

obexum sbom --target ssh://root@host -o sbom-host.json --name acme-prod

Target specs

Commands that take -t / --target accept these forms:

• local or local://localhost — scan the host the binary runs on.
• ssh://user@host — scan over SSH (defaults to user root, port 22).
• ssh://user@host:port — SSH with an explicit port.

When the flag is omitted, the target is read from your config file (target.*). The SSH key path falls back to ~/.ssh/obexum_ed25519 when not set in config.

See also

• Quickstart — the five-minute end-to-end walkthrough.
• Configuration — the full config.yaml reference.
• Check catalogue — every rule the scanner runs.
• Playbook catalogue (55) — every remediation playbook.