SIS CLI

Format Coverage Guide

This guide summarises current format families, detection expectations, and nesting behaviour.

Detection rules

  • Format is inferred from content and structure, not filename suffix.
  • Claimed format mismatch is triaged separately from detected format.
  • Supported roots should stay on their native analysis path.

Supported format families

Current families include:

  • PDF
  • HTML
  • HTA
  • standalone CSS stylesheet roots (.css)
  • standalone LESS stylesheet roots (.less)
  • RTF
  • OOXML (.docx, .xlsx, .pptx)
  • OneNote (.one)
  • MHT
  • OLE compound documents
  • Windows shortcuts (.lnk)
  • PE executables
  • ELF executables
  • ISO/UDF images
  • ZIP archives
  • standalone VBScript (.vbs)
  • standalone JavaScript (.js)
  • standalone WSF (.wsf)
  • standalone PowerShell (.ps1)
  • standalone shell scripts (.sh)
  • standalone VBA text
  • embedded VBScript

Nested and mixed-format expectations

Nested payloads are analysed in one bounded graph. Agents should expect:

  • format-specific findings inside containers
  • subgraph lineage for nested evidence
  • correlations spanning format boundaries (for example HTML -> ZIP -> PE)

Explicit gaps

Missing native support in a listed family should be treated as either:

  • a tracked bug, or
  • a deliberate, documented gap with operational notes

Practical checks

  1. Run baseline and deep scans:
sis scan sample.bin
sis scan sample.bin --deep --json
  1. Validate multi-format output:
sis query sample.bin findings --format json
sis query sample.bin correlations --format json
  1. Inspect chain composition:
sis query sample.bin chains --chain-summary events

Use actions.chains only for PDF structural action-graph inspection:

sis query sample.pdf actions.chains --chain-summary events

Per-format detail

For the exact finding kinds a format can produce (with severity, confidence, and intent wiring), query it directly rather than relying on this summary:

sis explain-format pdf
sis explain-format lnk --json
  • sis docs verdict (data model + classification)
  • sis docs query (query namespaces)
  • sis docs investigate (the triage loop)
  • (explain-format, coverage)