Triage CLI Reference

Audience: Security analysts and DevOps engineers who triage scan findings and record auditable decisions, including in air-gapped environments. Scope: The stella triage command group — listing and inspecting findings, recording evidence-based decisions, interactive batch triage, and signed offline import/export with replay tokens.

Overview

The stella triage command group drives vulnerability triage, decision management, and offline workflows. It supports evidence-first decision making and produces audit-ready, signed bundles and replay tokens so decisions remain verifiable across air-gap boundaries.

Commands

stella triage list

List findings for triage.

stella triage list [OPTIONS]

Options

OptionDescriptionDefault
--scan-id <ID>Filter by scan ID-
--status <STATUS>Filter: untriaged, affected, not_affected, wont_fix, false_positiveall
--priority-min <N>Minimum priority (0-1)0
--priority-max <N>Maximum priority (0-1)1
--sort <FIELD>Sort: priority, vuln, component, createdpriority
--format <FMT>Output: table, json, csvtable
--limit <N>Max results50
--workspace <PATH>Offline workspace-

Examples

# List untriaged high-priority findings
stella triage list \
  --scan-id scan-12345678 \
  --status untriaged \
  --priority-min 0.7

# Export for review
stella triage list \
  --scan-id scan-12345678 \
  --format json > findings.json

stella triage show

Show finding details with evidence.

stella triage show <FINDING-ID> [OPTIONS]

Options

OptionDescriptionDefault
--show-evidenceInclude full evidencefalse
--evidence-firstLead with evidence summaryfalse
--show-historyShow decision historyfalse
--format <FMT>Output: text, json, yamltext
--workspace <PATH>Offline workspace-

Example

# Show with evidence
stella triage show CVE-2024-1234 \
  --show-evidence \
  --evidence-first

# Output:
# ═══════════════════════════════════════════
# CVE-2024-1234 · pkg:npm/lodash@4.17.20
# ═══════════════════════════════════════════
#
# EVIDENCE
# ────────
# Reachability: TAINTED_SINK (tier 3/3)
#   └─ api.js:42 → utils.js:15 → lodash/merge
#
# Call Stack:
#   1. api.js:42     handleUserInput()
#   2. utils.js:15   processData()
#   3. lodash:merge  <vulnerable sink>
#
# VEX: No statement
# EPSS: 0.67 (High)
# KEV: No
#
# VULNERABILITY
# ─────────────
# CVE-2024-1234: Prototype Pollution in lodash
# CVSS: 7.5 (High)
# CWE: CWE-1321
#
# STATUS: untriaged

stella triage decide

Record a triage decision.

stella triage decide <FINDING-ID> [OPTIONS]

Options

OptionDescriptionDefault
--status <STATUS>Required: affected, not_affected, wont_fix, false_positive-
--justification <TEXT>Decision justification-
--reviewer <NAME>Reviewer identifiercurrent user
--vex-emitEmit VEX statementfalse
--workspace <PATH>Offline workspace-

Examples

# Mark as not affected
stella triage decide CVE-2024-1234 \
  --status not_affected \
  --justification "Feature gated, unreachable in production"

# Mark affected and emit VEX
stella triage decide CVE-2024-5678 \
  --status affected \
  --justification "In use, remediation planned" \
  --vex-emit

stella triage batch

Interactive batch triage mode.

stella triage batch [OPTIONS]

Options

OptionDescriptionDefault
--scan-id <ID>Scan to triage-
--query <EXPR>Filter expression-
--input <PATH>Offline bundle-
--workspace <PATH>Offline workspace-

Keyboard Shortcuts

KeyAction
j / ↓Next finding
k / ↑Previous finding
aMark affected
nMark not affected
wMark won’t fix
fMark false positive
eShow full evidence
gShow graph context
uUndo last decision
/Search findings
?Show help
qSave and quit

Example

# Interactive triage
stella triage batch \
  --scan-id scan-12345678 \
  --query "priority>=0.5"

stella triage export

Export findings for offline triage.

stella triage export [OPTIONS]

Options

OptionDescriptionDefault
--scan-id <ID>Scan to exportrequired
--findings <IDS>Specific finding IDs (comma-separated)-
--all-findingsExport all findingsfalse
--include-evidenceInclude evidence datatrue
--include-graphInclude dependency graphtrue
--output <PATH>Output path (.stella.bundle.tgz)required
--signSign the bundletrue

Example

# Export specific findings
stella triage export \
  --scan-id scan-12345678 \
  --findings CVE-2024-1234,CVE-2024-5678 \
  --output triage-bundle.stella.bundle.tgz

stella triage import

Import offline bundle for triage.

stella triage import [OPTIONS]

Options

OptionDescriptionDefault
--input <PATH>Bundle pathrequired
--workspace <PATH>Target workspace~/.stellaops/triage
--verifyVerify signaturetrue
--public-key <PATH>Public key for verification-

stella triage export-decisions

Export decisions for sync.

stella triage export-decisions [OPTIONS]

Options

OptionDescriptionDefault
--workspace <PATH>Workspace pathrequired
--output <PATH>Output pathrequired
--format <FMT>Format: json, ndjsonjson
--signSign outputtrue

stella triage import-decisions

Import and apply decisions.

stella triage import-decisions [OPTIONS]

Options

OptionDescriptionDefault
--input <PATH>Decisions filerequired
--verifyVerify signaturestrue
--applyApply to serverfalse
--dry-runPreview onlyfalse
--conflict-mode <MODE>Conflict handling: keep-local, keep-server, newest, reviewreview

stella triage verify-bundle

Verify bundle integrity.

stella triage verify-bundle [OPTIONS]

Options

OptionDescriptionDefault
--input <PATH>Bundle pathrequired
--public-key <PATH>Public keyrequired
--strictFail on warningsfalse

stella triage show-token

Display replay token details.

stella triage show-token <TOKEN>

stella triage verify-token

Verify replay token.

stella triage verify-token <TOKEN> [OPTIONS]

Options

OptionDescriptionDefault
--public-key <PATH>Public keyrequired

Exit Codes

CodeMeaning
0Success
1Findings require attention
10Invalid arguments
11Resource not found
20Verification failed
21Signature invalid
30Conflict detected
99Internal error

Environment Variables

VariableDescription
STELLAOPS_OFFLINEEnable offline mode
STELLAOPS_TRIAGE_WORKSPACEDefault workspace
STELLAOPS_REVIEWERDefault reviewer name