Skip to content

ANTA PSIRT CLI

Preview

The anta psirt command is a preview feature. Its interface and behavior may change at any time without a deprecation notice.

Report availability

JSON, text, and table reports are not currently implemented for anta psirt.

The anta psirt command runs security advisory tests from the complete built-in catalog installed with ANTA. It shares inventory options, filters, execution behavior, and exit handling with anta nrfu.

Command overview

$ anta psirt --help
Usage: anta psirt [OPTIONS] COMMAND [ARGS]...

  [PREVIEW] Run ANTA tests for Arista security advisories. This command is a
  preview feature; its interface and behavior may change at any time without a
  deprecation notice. JSON, text, and table reports are not currently
  implemented.

Options:
  -u, --username TEXT             Username to connect to EOS  [env var:
                                  ANTA_USERNAME; required]
  -p, --password TEXT             Password to connect to EOS that must be
                                  provided. It can be prompted using '--
                                  prompt' option.  [env var: ANTA_PASSWORD]
  --enable-password TEXT          Password to access EOS Privileged EXEC mode.
                                  It can be prompted using '--prompt' option.
                                  Requires '--enable' option.  [env var:
                                  ANTA_ENABLE_PASSWORD]
  --enable                        Some commands may require EOS Privileged
                                  EXEC mode. This option tries to access this
                                  mode before sending a command to the device.
                                  [env var: ANTA_ENABLE]
  -P, --prompt                    Prompt for passwords if they are not
                                  provided.  [env var: ANTA_PROMPT]
  --timeout FLOAT                 Global API timeout. This value will be used
                                  for all devices.  [env var: ANTA_TIMEOUT;
                                  default: 30.0]
  --insecure                      Disable SSH Host Key validation.  [env var:
                                  ANTA_INSECURE]
  --disable-cache                 Disable cache globally.  [env var:
                                  ANTA_DISABLE_CACHE]
  --use-session-auth / --no-session-auth
                                  Enable or explicitly disable eAPI session
                                  authentication globally. When unset, per-
                                  device inventory values apply.  [env var:
                                  ANTA_USE_SESSION_AUTH]
  -i, --inventory FILE            Path to the inventory YAML file.  [env var:
                                  ANTA_INVENTORY; required]
  --inventory-format [yaml|json]  Format of the inventory file, either 'yaml'
                                  or 'json'  [env var: ANTA_INVENTORY_FORMAT]
  --tags TEXT                     List of tags using comma as separator:
                                  tag1,tag2,tag3.  [env var: ANTA_TAGS]
  -d, --device TEXT               Run tests on a specific device. Can be
                                  provided multiple times.
  -t, --test TEXT                 Run only a specific security advisory test.
                                  Can be provided multiple times.
  --ignore-status                 Exit code will always be 0.  [env var:
                                  ANTA_PSIRT_IGNORE_STATUS]
  --ignore-error                  Ignore test errors when determining the exit
                                  code.  [env var: ANTA_PSIRT_IGNORE_ERROR]
  --hide [success|failure|error|skipped]
                                  Hide results by type: success / failure /
                                  error / skipped.
  --dry-run                       Run anta psirt command but stop before
                                  starting to execute the tests. Considers all
                                  devices as connected.  [env var:
                                  ANTA_PSIRT_DRY_RUN]
  --help                          Show this message and exit.

Commands:
  csv         Generate a detailed security advisory CSV report.
  md-report   Generate a detailed security advisory Markdown report.
  tpl-report  ANTA command to check network state with templated report.

Provide an inventory and credentials as for NRFU and select a report format:

anta psirt --inventory inventory.yml --username admin --prompt md-report --md-output sa-report.md

By default, the command runs every test registered in the built-in anta.tests.advisories catalog.

Use --test to filter the built-in catalog and run only selected security advisories. Provide the advisory test class name:

anta psirt --inventory inventory.yml --test SA117 md-report --md-output sa117-report.md

Repeat --test to assess multiple selected advisories.

PSIRT-specific execution settings can be configured with ANTA_PSIRT_IGNORE_STATUS, ANTA_PSIRT_IGNORE_ERROR, and ANTA_PSIRT_DRY_RUN.

The command accepts the shared ANTA environment variables documented in the ANTA CLI overview, except for the catalog-related variables and ANTA_DISCONNECT_INVENTORY. The built-in security advisory catalog cannot be overridden.

Reports

CSV and Markdown use the security advisory reporters to include advisory and vulnerability metadata with per-device findings. Markdown reports also include a run overview with execution timing, inventory and filter details, and assessment counts. CSV also includes result remediation when provided by the advisory test. Jinja templates remain available for custom report formats.

Template reports

Template reports are intended for advanced customization. Reach out to the ANTA maintainers if you need help creating a template for your use case.

See Security Advisory Reports for the report schemas, result semantics, and detailed rendering behavior.

anta psirt --inventory inventory.yml csv --csv-output sa-report.csv
anta psirt --inventory inventory.yml md-report --md-output sa-report.md
anta psirt --inventory inventory.yml tpl-report --template report.j2 --output sa-report.txt

The Markdown report always renders one Device Findings row per vulnerability assessment. It does not accept --expand.

See the NRFU documentation for shared filters and dry-run behavior.