SIS CLI
Investigation Playbook
Start with a scan, retain its report, then query evidence and explain the claims that matter. Every live command can reanalyse the file; a second command is not automatic replay of the first.
Core loop
sis scan sample.html --analysis-profile deep --format json --emit json=report.json
sis query findings --from-report report.json --format json
sis query chains --from-report report.json --format json
sis query iocs --from-report report.json --format json
sis explain members sample.html --json
sis report sample.html --deep --format markdown --out report.md
The saved-report queries project the original run. Members and report analyse again under their own options. Keep the original bytes, input digest, configuration, policy provenance, build identity and output. Read coverage/omissions before interpreting absent findings or an empty graph.
Find and explain an observation
sis query findings sample.html --format json | jq -r '.result[].id'
sis explain finding sample.html <finding-id>
sis explain verdict sample.html --json
sis explain detection sample.html --json
Finding IDs have the form sis-<64 hex>; use the full .result[].id, not a sequential number or prefix. explain finding reanalyses with its own deep posture. If a finding does not resolve, compare the reported posture/configuration and candidate set rather than assuming the saved finding was absent. It has --config but no --deep flag. Use sis docs explain for all explanation surfaces.
Choose the next step
| Question | Guide or surface |
|---|---|
| Which findings or nested assets are present? | sis docs query, sis docs asset-graph |
| Why the verdict, claim or authority decision? | sis docs explain |
| What was skipped, unreadable or not attempted? | sis docs verdict, sis explain members |
| Gate a single CI artefact? | sis docs scan |
| Compare/group many saved reports? | sis docs batch |
| Prepare an automated-consumer derivative? | sis docs assess, sis docs extract |
| Preview or transform a document? | sis docs cdr |
| Explain another build’s behaviour? | sis docs scan-config, sis doctor --json |
A Clean malware verdict and low observed ingestion risk answer different bounded questions. Severity, impact, confidence, reachability and completeness also describe different properties; one strong-looking field does not establish every other axis.
Persistent triage records, where that local-state feature is included, are a separate operation from this investigation loop. Use the commands actually listed by your binary’s help.