# End-User Usage Guide

This guide describes how to interact with RAVENSTRIKE via the terminal dashboard or single CLI commands.

---

## 1. The Command Line Interface (CLI)

The CLI is best for scripting, automating pipeline steps, or receiving raw JSON output directly into files or downstream SIEM/SOAR setups.

### Command Help
To view all available commands and flags:

```bash
# Using global installation:
ravenstrike --help
ravenstrike run --help

# Or using npx:
npx @ravenstrike/agent --help
npx @ravenstrike/agent run --help
```

---

## 2. Interactive Terminal Dashboard

For a visual, guided workflow, launch the dashboard:

```bash
# Using global installation:
ravenstrike dashboard

# Or using npx:
npx @ravenstrike/agent dashboard
```

* **How to use**: Type your threat description or a slash command in the input box at the bottom, and press **Enter**.
* **Navigation**: Scroll pipeline events using arrow keys or page up/down.
* **Exit**: Press `q` or `Ctrl+C` to quit.

> [!WARNING]
> The dashboard displays and logs entered text locally. Avoid pasting unredacted credentials, API keys, or customer-identifiable information.

---

## 3. Running Specific Pipeline Modules (Slash Commands)

If you only want output from a specific stage (such as generating a Sigma rule, or just drafting triage steps), use a **slash command** as your input.

### Examples:

```bash
# Get Scope: technique identification & assumptions
ravenstrike run --input "/scope encoded PowerShell" --platform CrowdStrike

# Get Detect: Sigma rule & CrowdStrike native query
ravenstrike run --input "/sigma encoded PowerShell" --platform CrowdStrike

# Get Enrich: Field extractions & priority scoring
ravenstrike run --input "/enrich endpoint alert" --platform Generic

# Get Cover: ATT&CK coverage maps
ravenstrike run --input "/coverage" --platform Generic

# Get Triage: Analyst investigative checklist
ravenstrike run --input "/triage suspicious process" --platform QRadar
```

---

## 4. Running the Full Pipeline

To execute all 7 stages sequentially and compile a complete incident handoff package, use the full pipeline trigger:

```bash
ravenstrike run \
  --input "run full pipeline for encoded PowerShell" \
  --platform QRadar
```

### The Output Structure
The result is printed as a structured JSON object containing:

* `route`: Routing confidence metrics and destination.
* `metadata`: AI engine details (e.g. mock vs. openai provider) and rarity score.
* `steps`:
  * `ingest`: Intake details and raw text.
  * `scope`: Telemetry expectations and blind spots.
  * `enrich`: Field normalization maps and priority level (P1-P4).
  * `detect`: The Sigma rule block and native SIEM query.
  * `cover`: MITRE ATT&CK coverage matrix.
  * `triage`: Evidence checklist and verdict logic.
  * `package`: Unified incident-handoff record (with custom Incident ID).

---

## 5. Important Limitations

* **Deterministic Reference Model**: The current operational rules pipeline generates outputs modeled around the suspicious encoded PowerShell reference threat scenario.
* **Static Query Translation**: Platform labels format output queries (e.g., KQL for Sentinel, SPL for Splunk). RAVENSTRIKE does not run live queries against your actual SIEM/EDR clusters.
* **Rule Verification**: Always verify Sigma rules and platform query outputs before implementing them in production change controls.