ANTA PSIRT CLI
Preview
The anta psirt command is a preview feature. Its interface and behavior may change at any time without a deprecation notice.
Report availability
JSON, text, and table reports are not currently implemented for anta psirt.
The anta psirt command runs security advisory tests from the complete built-in
catalog installed with ANTA. It shares inventory options, filters, execution
behavior, and exit handling with anta nrfu.
Command overview¶
$ anta psirt --help
Usage: anta psirt [OPTIONS] COMMAND [ARGS]...
[PREVIEW] Run ANTA tests for Arista security advisories. This command is a
preview feature; its interface and behavior may change at any time without a
deprecation notice. JSON, text, and table reports are not currently
implemented.
Options:
-u, --username TEXT Username to connect to EOS [env var:
ANTA_USERNAME; required]
-p, --password TEXT Password to connect to EOS that must be
provided. It can be prompted using '--
prompt' option. [env var: ANTA_PASSWORD]
--enable-password TEXT Password to access EOS Privileged EXEC mode.
It can be prompted using '--prompt' option.
Requires '--enable' option. [env var:
ANTA_ENABLE_PASSWORD]
--enable Some commands may require EOS Privileged
EXEC mode. This option tries to access this
mode before sending a command to the device.
[env var: ANTA_ENABLE]
-P, --prompt Prompt for passwords if they are not
provided. [env var: ANTA_PROMPT]
--timeout FLOAT Global API timeout. This value will be used
for all devices. [env var: ANTA_TIMEOUT;
default: 30.0]
--insecure Disable SSH Host Key validation. [env var:
ANTA_INSECURE]
--disable-cache Disable cache globally. [env var:
ANTA_DISABLE_CACHE]
--use-session-auth / --no-session-auth
Enable or explicitly disable eAPI session
authentication globally. When unset, per-
device inventory values apply. [env var:
ANTA_USE_SESSION_AUTH]
-i, --inventory FILE Path to the inventory YAML file. [env var:
ANTA_INVENTORY; required]
--inventory-format [yaml|json] Format of the inventory file, either 'yaml'
or 'json' [env var: ANTA_INVENTORY_FORMAT]
--tags TEXT List of tags using comma as separator:
tag1,tag2,tag3. [env var: ANTA_TAGS]
-d, --device TEXT Run tests on a specific device. Can be
provided multiple times.
-t, --test TEXT Run only a specific security advisory test.
Can be provided multiple times.
--ignore-status Exit code will always be 0. [env var:
ANTA_PSIRT_IGNORE_STATUS]
--ignore-error Ignore test errors when determining the exit
code. [env var: ANTA_PSIRT_IGNORE_ERROR]
--hide [success|failure|error|skipped]
Hide results by type: success / failure /
error / skipped.
--dry-run Run anta psirt command but stop before
starting to execute the tests. Considers all
devices as connected. [env var:
ANTA_PSIRT_DRY_RUN]
--help Show this message and exit.
Commands:
csv Generate a detailed security advisory CSV report.
md-report Generate a detailed security advisory Markdown report.
tpl-report ANTA command to check network state with templated report.
Provide an inventory and credentials as for NRFU and select a report format:
anta psirt --inventory inventory.yml --username admin --prompt md-report --md-output sa-report.md
By default, the command runs every test registered in the built-in
anta.tests.advisories catalog.
Use --test to filter the built-in catalog and run only selected security
advisories. Provide the advisory test class name:
anta psirt --inventory inventory.yml --test SA117 md-report --md-output sa117-report.md
Repeat --test to assess multiple selected advisories.
PSIRT-specific execution settings can be configured with
ANTA_PSIRT_IGNORE_STATUS, ANTA_PSIRT_IGNORE_ERROR, and
ANTA_PSIRT_DRY_RUN.
The command accepts the shared ANTA environment variables documented in the
ANTA CLI overview, except for
the catalog-related variables and ANTA_DISCONNECT_INVENTORY. The built-in
security advisory catalog cannot be overridden.
Reports¶
CSV and Markdown use the security advisory reporters to include advisory and vulnerability metadata with per-device findings. Markdown reports also include a run overview with execution timing, inventory and filter details, and assessment counts. CSV also includes result remediation when provided by the advisory test. Jinja templates remain available for custom report formats.
Template reports
Template reports are intended for advanced customization. Reach out to the ANTA maintainers if you need help creating a template for your use case.
See Security Advisory Reports for the report schemas, result semantics, and detailed rendering behavior.
anta psirt --inventory inventory.yml csv --csv-output sa-report.csv
anta psirt --inventory inventory.yml md-report --md-output sa-report.md
anta psirt --inventory inventory.yml tpl-report --template report.j2 --output sa-report.txt
The Markdown report always renders one Device Findings row per vulnerability
assessment. It does not accept --expand.
See the NRFU documentation for shared filters and dry-run behavior.