Skip to content

tlm-cli cs

Cybersecurity commands — manage security projects, upload bills of materials, inspect vulnerability metrics, and submit VEX documents.

tlm-cli cs [SUBGROUP] [COMMAND] [OPTIONS]

Subgroups: projects, bom, metrics, vex

projects

Commands for managing cybersecurity projects.

tlm-cli cs projects [COMMAND] [OPTIONS]

projects list

List root projects with their subprojects grouped underneath.

tlm-cli cs projects list [OPTIONS]

Fetches up to 50 root (parentless) projects and expands each one with its direct children. Root projects are shown as group headers (▶) and subprojects are indented below them.

Option Type Description
--name TEXT string Filter root projects by exact name.
--limit INT integer Maximum number of root projects to fetch (default: 50).

Example

# List all root projects and their subprojects
tlm-cli cs projects list

# Filter by root project name
tlm-cli cs projects list --name "gateway-model"

# Limit results
tlm-cli cs projects list --limit 10

Output columns: Name, Version, UUID, Tags

projects show

Show details and direct subprojects for a project.

tlm-cli cs projects show UUID
Argument Description
UUID Project UUID.

Example

tlm-cli cs projects show 38640b33-4ba9-4733-bdab-cbfc40c6f8aa

Output includes:

  • Detail panel: UUID, Name, Version, Description, Active, Tags, Parent UUID, Parent Name, Last BOM Import, Risk Score
  • Subprojects table: Name, Version, UUID, Active

projects create

Create a root cybersecurity project from a PMS model.

Requires DAVE level access permissions.

tlm-cli cs projects create MODEL [OPTIONS]

Resolves the model by exact name and creates a versionless root project whose name matches the model. This project acts as the parent folder for all firmware subprojects uploaded via tlm-cli cs bom upload.

Argument / Option Type Required Description
MODEL string yes Exact PMS model name.
--dry-run flag no Print the request payload without sending it.

Example

# Create a root project for a model
tlm-cli cs projects create "gateway-v2"

# Preview
tlm-cli cs projects create "gateway-v2" --dry-run

projects clone

Clone an existing project to a new version.

Requires DAVE level access permissions.

tlm-cli cs projects clone UUID --version VERSION [OPTIONS]

Cloning is asynchronous — the command queues the operation and returns immediately. The new project appears in projects list once the service has processed it.

Argument / Option Type Default Description
UUID string — UUID of the project to clone.
--version TEXT / -v string — Version string for the cloned project.
--include-tags / --no-tags flag --include-tags Copy tags.
--include-components / --no-components flag --include-components Copy all components.
--include-dependencies / --no-dependencies flag --include-dependencies Copy the dependency graph.
--include-properties / --no-properties flag --no-properties Copy project properties.
--include-services / --no-services flag --no-services Copy services.
--include-audit-history / --no-audit-history flag --include-audit-history Copy audit and analysis history.
--include-acl / --no-acl flag --no-acl Copy ACL team assignments.
--make-latest flag off Mark the clone as the latest version.
--dry-run flag off Show the request payload without sending it.

Example

# Clone to a new version (carries components, dependencies, tags, audit history)
tlm-cli cs projects clone 38640b33-4ba9-4733-bdab-cbfc40c6f8aa --version 2.0.0

# Clone without components
tlm-cli cs projects clone <uuid> --version 1.1.0 --no-components

# Mark the clone as latest
tlm-cli cs projects clone <uuid> --version 2.0.0 --make-latest

# Preview
tlm-cli cs projects clone <uuid> --version 2.0.0 --dry-run

projects move

Move a subproject to a different parent project.

Requires DAVE level access permissions.

tlm-cli cs projects move UUID --parent-uuid PARENT_UUID [OPTIONS]
Argument / Option Type Required Description
UUID string yes UUID of the project to move.
--parent-uuid TEXT string yes UUID of the new parent project.
--dry-run flag no Show the request payload without sending it.

Example

tlm-cli cs projects move <uuid> --parent-uuid <new-parent-uuid>

# Preview
tlm-cli cs projects move <uuid> --parent-uuid <new-parent-uuid> --dry-run

bom

Commands for uploading bills of materials.

tlm-cli cs bom [COMMAND] [OPTIONS]

bom upload

Upload a BOM file for a PMS model firmware version.

tlm-cli cs bom upload BOM_FILE --model MODEL --version VERSION [OPTIONS]

Resolves the model to determine the project hierarchy (firmware name → subproject, model name → parent project). The subproject is created automatically if it does not yet exist.

Argument / Option Type Required Description
BOM_FILE path yes Path to a CycloneDX-compatible BOM file.
--model TEXT / -m string yes PMS model name (must exist).
--version TEXT / -v string yes Firmware version string to associate with the project.
--dry-run flag no Show resolved metadata without uploading.

Example

# Upload a BOM
tlm-cli cs bom upload ./sbom.json --model "gateway-v2" --version "1.2.0"

# Preview what would be uploaded
tlm-cli cs bom upload ./sbom.cdx --model "sensor-x" --version "0.9.1" --dry-run

Note: The firmware name (not the model name) is used as the subproject name. Use tlm-cli pms models show MODEL_NAME to check the firmware name before uploading.

metrics

Commands for inspecting vulnerability metrics.

tlm-cli cs metrics [COMMAND] [OPTIONS]

metrics cves

Show CVE metrics for a project within a date interval.

tlm-cli cs metrics cves UUID --start YYYYMMDD --end YYYYMMDD

Retrieves vulnerability datapoints for the project between the start and end dates. Each row represents a daily snapshot with severity-bucketed counts and a total risk score.

Argument / Option Type Required Description
UUID string yes Project UUID.
--start TEXT / -s string yes Interval start date in YYYYMMDD format.
--end TEXT / -e string yes Interval end date in YYYYMMDD format.

Example

tlm-cli cs metrics cves 38640b33-4ba9-4733-bdab-cbfc40c6f8aa --start 20260101 --end 20260131

Output columns: Date, Critical, High, Medium, Low, Total Vulns, Risk Score

vex

Commands for uploading VEX documents.

tlm-cli cs vex [COMMAND] [OPTIONS]

vex upload

Upload a VEX document to an existing project.

tlm-cli cs vex upload VEX_FILE [--project-uuid UUID | --project-name NAME --project-version VERSION] [OPTIONS]

Identify the target project either by UUID or by name and version. Exactly one of these two approaches must be used.

Argument / Option Type Required Description
VEX_FILE path yes Path to a CycloneDX-compatible VEX file.
--project-uuid TEXT / -u string exclusive Target project UUID.
--project-name TEXT / -n string exclusive Target project name (requires --project-version).
--project-version TEXT / -v string exclusive Target project version (requires --project-name).
--dry-run flag no Show resolved metadata without uploading.

Example

# Upload by project UUID
tlm-cli cs vex upload ./vex.json --project-uuid 38640b33-4ba9-4733-bdab-cbfc40c6f8aa

# Upload by project name and version
tlm-cli cs vex upload ./vex.json --project-name "gateway-fw" --project-version "1.2.0"

# Preview
tlm-cli cs vex upload ./vex.json --project-uuid <uuid> --dry-run