SIS CLI

Investigation Playbook

The single-sample workflow across the four investigative surfaces: scan, query, report, explain. Use this as the default starting point; reach for the focused guides (sis docs query, sis docs explain, sis docs report) when you already know which step you need.

Format is detected from content, not extension — every command here works on any supported root.

The core loop

# 1. Baseline verdict + findings (human-readable)
sis scan sample.bin

# 2. Reproducible deep pass (expensive detectors: full font scan, entropy clustering, XFA, JS AST)
sis scan sample.bin --deep --json > triage.json

# 3. Pull the slices you need (see `sis docs query`)
sis query sample.bin findings --where "severity == 'High'" --json
sis query sample.bin chains --chain-summary events --json
sis query sample.bin iocs --json
sis query sample.bin urls --json

# 4. Operator hand-off report when settings are stable
sis report sample.bin --deep --format markdown --out report.md

# 5. Expand the load-bearing finding into evidence
sis explain sample.bin <finding-id>

Choosing a surface

Pivots

• Verdict/severity looks elevated → sis query <s> findings --where "severity == 'High'" --json
• Behaviour spans nested formats → sis query <s> chains --chain-summary events --json
• Need network/URL extraction → sis query <s> iocs --json and sis query <s> urls --json
• One finding needs evidence → sis explain <s> <finding-id>
• “Why was this analysed as format X?” → sis explain-detection <s>

Getting a finding ID for explain

Finding IDs are content-hash based: sis-<64 hex> (e.g. sis-103db1f2254c…). They are not sequential (finding-0007 is not a real ID). Read the full ID from query JSON — it lives at .result.findings[].id:

sis query sample.bin findings --json | jq -r '.result.findings[].id'
sis explain sample.bin sis-103db1f2254c…          # paste the FULL id

explain requires the exact ID (no prefixes) and re-runs analysis, so the ID is sensitive to scan options. See the reproducibility rule below and sis docs explain.

Reproducibility

• Keep --deep consistent across scan, query, report, and explain — depth changes which detectors run, which changes findings and therefore finding IDs.
• A finding ID is a function of the analysis conditions. If the originating scan used a non-default --config or runtime policy bundle, pass the same --config to query/explain, or the ID will not resolve (explain reports the candidate set and the fingerprint mismatch when it fails).
• Prefer --json for any artefact you will store or feed downstream.

Triage decision model

Read severity, impact, and confidence together (never one alone — see sis docs verdict), then weigh: chain completeness and stage, intent mix and top intent, whether the behaviour survives nested traversal, and whether it still holds under the original scan conditions. When downgrading, confirm context in meta and correlated chains and decide whether the risk is structural-only or behavioural — don’t suppress a finding family without a policy rationale.

Note: sis triage (the subcommand) manages triage records and calibration, a separate workflow from this investigation loop. See sis triage --help.

Related guides

• sis docs query · sis docs explain · sis docs report · sis docs verdict
• sis docs assess (AI-ingestion decision) · sis docs cdr (sanitisation)
• (multi-format vs PDF-only scope)