> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# ankra security

> Read the Security Center: exploited-in-the-wild findings, fleet posture and scanner coverage

## ankra security

Read the organisation's Security Center - the same data the portal shows,
for your own reporting and automation.

Every finding carries its exploitation intelligence: whether CISA lists the
CVE in its Known Exploited Vulnerabilities (KEV) catalog, with CISA's
remediation deadline and required action, and the FIRST EPSS probability
that it is exploited in the next 30 days. Findings sort by exploitability by
default - CISA listing first, then EPSS, then severity - so the top of the
list is what is actually being exploited, not what merely has the highest
CVSS score.

Pass -o json (or yaml) for the full API document.

## ankra security advisory

Show the platform's advisory for one CVE: the parsed NVD/OSV record, CISA's guidance and your exposure

```bash theme={null}
ankra security advisory <cve-id> [flags]
```

**Flags**

| Flag             | Default | Description                                           |
| ---------------- | ------- | ----------------------------------------------------- |
| `-o`, `--output` |         | Output format: json or yaml (default: human-readable) |

## ankra security clusters

Per-cluster security posture and scanner freshness

```bash theme={null}
ankra security clusters [flags]
```

**Flags**

| Flag             | Default      | Description                                                                                                  |
| ---------------- | ------------ | ------------------------------------------------------------------------------------------------------------ |
| `--order`        | `desc`       | Sort order: asc or desc                                                                                      |
| `-o`, `--output` |              | Output format: json or yaml (default: human-readable)                                                        |
| `--page`         | `1`          | Page number                                                                                                  |
| `--page-size`    | `50`         | Clusters per page (max 100)                                                                                  |
| `--search`       |              | Match cluster name                                                                                           |
| `--sort`         | `actionable` | Sort key: actionable, known\_exploited, severity, observed, accepted\_risk, latest\_report\_at, status, name |
| `--status`       |              | Scanner or posture status filter: fresh, stale, unscanned, clean, critical, high, degraded                   |

## ankra security finding

Show one finding with CISA's guidance and every current occurrence

```bash theme={null}
ankra security finding <finding-id> [flags]
```

**Flags**

| Flag             | Default | Description                                           |
| ---------------- | ------- | ----------------------------------------------------- |
| `-o`, `--output` |         | Output format: json or yaml (default: human-readable) |

## ankra security findings

List the organisation's logical findings (one row per CVE and package,
deduplicated across clusters and workloads).

By default the list is the actionable set (open and acknowledged findings)
sorted by exploitability. Narrow it with --known-exploited to the CVEs CISA
lists as exploited in the wild, or with --severity, --status, --fixable,
\--cluster, --addon and --namespace.

Examples:
ankra security findings --known-exploited
ankra security findings --severity critical --fixable true --sort epss
ankra security findings --cluster production --status any -o json

```bash theme={null}
ankra security findings [flags]
```

**Flags**

| Flag                | Default               | Description                                                                                                                                          |
| ------------------- | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--addon`           |                       | Only findings attributed to one add-on (slug)                                                                                                        |
| `--cluster`         |                       | Only findings observed on one cluster (name or id)                                                                                                   |
| `--fixable`         | `any`                 | Fix availability: true, false or any                                                                                                                 |
| `--known-exploited` | `false`               | Only CVEs CISA lists as exploited in the wild (KEV)                                                                                                  |
| `--namespace`       |                       | Only findings observed in one namespace                                                                                                              |
| `--order`           | `desc`                | Sort order: asc or desc                                                                                                                              |
| `-o`, `--output`    |                       | Output format: json or yaml (default: human-readable)                                                                                                |
| `--page`            | `1`                   | Page number                                                                                                                                          |
| `--page-size`       | `25`                  | Findings per page (max 100)                                                                                                                          |
| `--search`          |                       | Match CVE id, package name or title                                                                                                                  |
| `--severity`        | `[]`                  | Severity filter, repeatable: critical, high, medium, low, unknown                                                                                    |
| `--sort`            | `exploitability`      | Sort key: exploitability, epss, known\_exploited, severity, first\_seen\_at, last\_seen\_at, affected\_clusters, occurrences, package\_name, cve\_id |
| `--status`          | `[open,acknowledged]` | Status filter, repeatable: open, acknowledged, accepted\_risk, resolved, or any                                                                      |

## ankra security overview

Fleet security summary: totals, CISA KEV exposure, scanner coverage and remediation candidates

```bash theme={null}
ankra security overview [flags]
```

**Flags**

| Flag             | Default | Description                                           |
| ---------------- | ------- | ----------------------------------------------------- |
| `--addon`        |         | Scope the overview to one add-on (slug)               |
| `--cluster`      |         | Scope the overview to one cluster (name or id)        |
| `-o`, `--output` |         | Output format: json or yaml (default: human-readable) |