Advanced System Use

Advanced examples for enterprise security assessment, incident response, continuous monitoring, and VDI identity. All commands below assume a valid license key is configured.

Enterprise Security Assessment

Large-scale cryptographic asset discovery across enterprise networks. Scan entire subnets, generate compliance reports (CBOM), and tag scans for tracking and audit trails. Ideal for quarterly security audits, risk assessments, and post-quantum readiness evaluations.

Windows POWERSHELL:

# Complete enterprise scan
.\certscanner-windows-amd64.exe -host 10.0.0.0/16 -ports 443,22,993,995,636,8443 `
  -cipherscanquick -tags "enterprise,quarterly-audit" `
  -outputformat flatndjson -output Q4-crypto-audit.ndjson

# With change tracking (encrypted local database, opt-in)
.\certscanner-windows-amd64.exe -mode local -cipherscanquick -enable-tracking `
  -bolt-path C:\ProgramData\Tychon\tracking.bolt -outputformat flatndjson

# Generate compliance report
.\certscanner-windows-amd64.exe -host critical-servers.txt -cipherscanquick `
  -outputformat cbom -output compliance-cbom.json

# Stream to SIEM
.\certscanner-windows-amd64.exe -mode local -scanfilesystem -scanmemory `
  -outputformat flatndjson | your-siem-ingester

Linux BASH:

# Complete enterprise scan
./certscanner-linux-x64 -host 10.0.0.0/16 -ports 443,22,993,995,636,8443 \
  -cipherscanquick -tags "enterprise,quarterly-audit" \
  -outputformat flatndjson -output Q4-crypto-audit.ndjson

# With change tracking (encrypted local database, opt-in)
./certscanner-linux-x64 -mode local -cipherscanquick -enable-tracking \
  -bolt-path /var/lib/tychon/tracking.bolt -outputformat flatndjson

# Generate compliance report
./certscanner-linux-x64 -host critical-servers.txt -cipherscanquick \
  -outputformat cbom -output compliance-cbom.json

# Stream to SIEM
./certscanner-linux-x64 -mode local -scanfilesystem -scanmemory \
  -outputformat flatndjson | your-siem-ingester

macOS BASH:

# Complete enterprise scan
./certscanner-darwin-amd64 -host 10.0.0.0/16 -ports 443,22,993,995,636,8443 \
  -cipherscanquick -tags "enterprise,quarterly-audit" \
  -outputformat flatndjson -output Q4-crypto-audit.ndjson

# With change tracking (encrypted local database, opt-in)
./certscanner-darwin-amd64 -mode local -cipherscanquick -enable-tracking \
  -bolt-path ~/Library/Application\ Support/Tychon/tracking.bolt -outputformat flatndjson

# Generate compliance report
./certscanner-darwin-amd64 -host critical-servers.txt -cipherscanquick \
  -outputformat cbom -output compliance-cbom.json

# Stream to SIEM (no memory scanning on macOS)
./certscanner-darwin-amd64 -mode local -scanfilesystem \
  -outputformat flatndjson | your-siem-ingester

Incident Response & Forensics

Rapid cryptographic asset discovery during security incidents and breach investigations. Capture complete system state including active connections, in-memory cryptographic libraries, filesystem certificates, and email archives. Generate forensic reports for incident response teams and compliance documentation.

Windows POWERSHELL:

# Complete system crypto inventory
.\certscanner-windows-amd64.exe -mode local -scanfilesystem -scanmemory -scanconnected `
  -scanoutlookarchives -outputformat html -output system-crypto-report.html

# Quick compromise assessment
.\certscanner-windows-amd64.exe -mode local -scanconnected -quickscan `
  -outputformat json -output active-connections.json

# Memory forensics for crypto libraries
.\certscanner-windows-amd64.exe -mode local -scanmemory `
  -outputformat flatndjson -output crypto-libs-memory.ndjson

Linux BASH:

# Complete system crypto inventory
./certscanner-linux-x64 -mode local -scanfilesystem -scanmemory -scanconnected \
  -scanoutlookarchives -outputformat html -output system-crypto-report.html

# Quick compromise assessment
./certscanner-linux-x64 -mode local -scanconnected -quickscan \
  -outputformat json -output active-connections.json

# Memory forensics for crypto libraries
./certscanner-linux-x64 -mode local -scanmemory \
  -outputformat flatndjson -output crypto-libs-memory.ndjson

macOS BASH:

# Complete system crypto inventory (no memory scanning)
./certscanner-darwin-amd64 -mode local -scanfilesystem -scanconnected \
  -scanoutlookarchives -outputformat html -output system-crypto-report.html

# Quick compromise assessment
./certscanner-darwin-amd64 -mode local -scanconnected -quickscan \
  -outputformat json -output active-connections.json

# Note: Memory scanning not available on macOS

Continuous Monitoring

Automated scanning for continuous security monitoring and compliance tracking. Stream results to SIEM platforms (Elasticsearch, Kafka, Splunk), integrate with Windows EventLog, enable ARP-based network discovery, and upload reports to S3 for centralized storage. Perfect for scheduled jobs, real-time alerting, and DevSecOps pipelines.

Windows POWERSHELL:

# Automated daily scans with SIEM streaming and change tracking
.\certscanner-windows-amd64.exe -host production-hosts.txt -cipherscanquick `
  -tags "automated,daily-scan" -enable-tracking -outputformat flatndjson `
  -posttoelastic -elasticnode "https://elastic.company.com:9200" `
  -elasticapikey "$env:ELASTIC_KEY"

# Real-time Kafka streaming
.\certscanner-windows-amd64.exe -host production-hosts.txt -cipherscanquick `
  -tags "automated,realtime-stream" -posttokafka `
  -kafkabrokers "kafka1:9092,kafka2:9092,kafka3:9092" `
  -kafkatopic "tychon-crypto-assets" -kafkausername "$env:KAFKA_USER" `
  -kafkapassword "$env:KAFKA_PASSWORD" -kafkasecurityprotocol "SASL_SSL"

# Windows EventLog integration
.\certscanner-windows-amd64.exe -mode local -outputformat eventlog

# ARP-based network discovery
.\certscanner-windows-amd64.exe -mode local -arpscan -quickscan -outputformat flatndjson `
  -output network-discovery.ndjson

# Upload reports to S3 for centralized storage
.\certscanner-windows-amd64.exe -host example.com -cipherscanquick -outputformat flatndjson `
  -upload-s3 -s3bucket "company-security-reports" `
  -s3prefix "certscanner/production" -s3region "us-west-2"

Linux BASH:

# Automated daily scans with SIEM streaming and change tracking
./certscanner-linux-x64 -host production-hosts.txt -cipherscanquick \
  -tags "automated,daily-scan" -enable-tracking -outputformat flatndjson \
  -posttoelastic -elasticnode "https://elastic.company.com:9200" \
  -elasticapikey "$ELASTIC_KEY"

# Real-time Kafka streaming
./certscanner-linux-x64 -host production-hosts.txt -cipherscanquick \
  -tags "automated,realtime-stream" -posttokafka \
  -kafkabrokers "kafka1:9092,kafka2:9092,kafka3:9092" \
  -kafkatopic "tychon-crypto-assets" -kafkausername "$KAFKA_USER" \
  -kafkapassword "$KAFKA_PASSWORD" -kafkasecurityprotocol "SASL_SSL"

# ARP-based network discovery
./certscanner-linux-x64 -mode local -arpscan -quickscan -outputformat flatndjson \
  -output network-discovery.ndjson

# Upload reports to S3 for centralized storage
./certscanner-linux-x64 -host example.com -cipherscanquick -outputformat flatndjson \
  -upload-s3 -s3bucket "company-security-reports" \
  -s3prefix "certscanner/production" -s3region "us-west-2"

macOS BASH:

# Automated daily scans with SIEM streaming and change tracking
./certscanner-darwin-amd64 -host production-hosts.txt -cipherscanquick \
  -tags "automated,daily-scan" -enable-tracking -outputformat flatndjson \
  -posttoelastic -elasticnode "https://elastic.company.com:9200" \
  -elasticapikey "$ELASTIC_KEY"

# Real-time Kafka streaming
./certscanner-darwin-amd64 -host production-hosts.txt -cipherscanquick \
  -tags "automated,realtime-stream" -posttokafka \
  -kafkabrokers "kafka1:9092,kafka2:9092,kafka3:9092" \
  -kafkatopic "tychon-crypto-assets" -kafkausername "$KAFKA_USER" \
  -kafkapassword "$KAFKA_PASSWORD" -kafkasecurityprotocol "SASL_SSL"

# ARP-based network discovery
./certscanner-darwin-amd64 -mode local -arpscan -quickscan -outputformat flatndjson \
  -output network-discovery.ndjson

# Upload reports to S3 for centralized storage
./certscanner-darwin-amd64 -host example.com -cipherscanquick -outputformat flatndjson \
  -upload-s3 -s3bucket "company-security-reports" \
  -s3prefix "certscanner/production" -s3region "us-west-2"

VDI Identity - Stable Host ID Across Session Resets

Non-persistent VDI pools (Azure Virtual Desktop, VMware Horizon, Citrix) wipe the OS machine UUID on every session shutdown. Without identity correction, each scan appears as a brand-new host and prior records become orphaned. Use -vdi to enable roaming-profile identity resolution, or -host-id for direct BigFix injection. On Windows, VDI mode is also auto-detected via HKLM registry keys (VMware Horizon, Citrix, AVD). The stable ID is stored in %APPDATA%\Tychon\certscanner-id.json (roaming profile, survives session wipe).

Identity resolution priority:

  1. -host-id flag - direct override (BigFix injection)
  2. Roaming profile file - %APPDATA%\Tychon\certscanner-id.json (persists across VDI wipes)
  3. SHA-256 hash of domain\username - deterministic fallback, no file I/O
  4. gopsutil HostID - default behavior for physical / non-VDI systems

Windows POWERSHELL:

# Auto-detect VDI environment via registry (VMware Horizon, Citrix, AVD)
# and use roaming-profile identity instead of machine UUID
.\certscanner-windows-amd64.exe -mode local -vdi -fullscan `
  -outputformat flatndjson -output local-scan.ndjson

# Force a specific stable host ID (BigFix injection pattern)
$StableID = (Get-ItemProperty "HKCU:\Software\Tychon" -Name "HostID" -EA SilentlyContinue).HostID
.\certscanner-windows-amd64.exe -mode local -host-id $StableID -fullscan `
  -outputformat flatndjson -output local-scan.ndjson

# Verify identity source in output (check observer.vdi_identity_source field)
# Values: cli_override | profile_file | username_hash | gopsutil
.\certscanner-windows-amd64.exe -mode local -vdi -logfile scan.log
# Then: Select-String "Host identity" scan.log

Linux BASH:

# On Linux, VDI registry auto-detection is not available.
# Use -host-id for stable identity in containerised or ephemeral environments.

# Inject a stable ID (e.g. from an environment variable set by the provisioner)
./certscanner-linux-x64 -mode local -host-id "$STABLE_HOST_ID" -fullscan \
  -outputformat flatndjson -output local-scan.ndjson

# Verify via log output (identity source will be "cli_override")
./certscanner-linux-x64 -mode local -host-id "$STABLE_HOST_ID" -logfile scan.log
# grep "Host identity" scan.log

macOS BASH:

# On macOS, VDI registry auto-detection is not available.
# Use -host-id for stable identity if running in a managed/ephemeral environment.

# Inject a stable ID (e.g. from a configuration profile or MDM variable)
./certscanner-darwin-arm64 -mode local -host-id "$STABLE_HOST_ID" -fullscan \
  -outputformat flatndjson -output local-scan.ndjson

# Verify via log output (identity source will be "cli_override")
./certscanner-darwin-arm64 -mode local -host-id "$STABLE_HOST_ID" -logfile scan.log
# grep "Host identity" scan.log