Forecast

What node9 would have caught in the agent history already on this machine, before you install anything.

Run it

node9 scan              # last 90 days
node9 scan --all        # everything on disk
node9 scan --days 30

Reads the session files your agent already writes and replays them against node9's rules. Nothing is installed and nothing is intercepted; this is a report about the past.

Choosing the view

For a person

node9 scan --compact      # one screen
node9 scan --drill-down   # every finding, full commands

Compact fits on a screen. Drill-down gives you the command and the session id behind each finding, which is what you want when you are deciding whether a finding is real.

For a machine

node9 scan --json

Machine-readable output with no banner or progress, so it can be piped.

Sending the counts to a dashboard

node9 scan --upload-history
node9 scan --upload-history --since 6m

Uploads aggregate counts from the sessions already on disk, so a workspace that has just been set up is not empty. Safe to run more than once; it does not double-count. The default window is three months.

Forecast · node9 documentation

Forecast

Choosing the view