{"token_count": 757}

# Identity Security from the Command Line

Identity Security is available only with Teleport Enterprise.

Teleport Identity Security exposes several `tctl` commands for querying Access Graph data directly from your terminal: security detections, identity activity logs, access-path changes to crown jewels, and identity access review. Use them to script investigations, feed automation, and work without leaving the shell.

## How it works

These commands query Teleport Access Graph through the Teleport Proxy Service, using the credentials from your current `tsh` session.

## Prerequisites

- A Teleport Enterprise cluster v18.11.0 or later with Identity Security enabled.
- Access Graph running. Teleport Enterprise Cloud manages Access Graph for you. For self-hosted clusters, follow the [Docker](https://goteleport.com/docs/identity-security/access-graph/self-hosted.md) or [Helm](https://goteleport.com/docs/identity-security/access-graph/self-hosted-helm.md) deployment guide. Each command requires a minimum Access Graph version, noted on its page.
- `tctl` installed locally. See [Installation](https://goteleport.com/docs/installation.md).
- A logged-in session created with `tsh login`, or a Teleport identity file passed with `tctl -i <identity-file> --auth-server <proxy-or-auth-addr>`.
- A Teleport user with a role that allows the `list` and `read` verbs on the `access_graph` resource. The preset `editor` role has the required permissions by default.

## Get started

Log in to your cluster, then run any Identity Security command:

```
$ tsh login --proxy=teleport.example.com --user=alice
$ tctl detections ls
```

## Commands

| Command                                                                                      | What it does                                        | In the Web UI                                                                       |
| -------------------------------------------------------------------------------------------- | --------------------------------------------------- | ----------------------------------------------------------------------------------- |
| [`tctl detections`](https://goteleport.com/docs/identity-security/cli/detections.md) \*      | Investigate security detections and anomalies.      | [Alerts](https://goteleport.com/docs/identity-security/usage/alerts.md)             |
| [`tctl investigate`](https://goteleport.com/docs/identity-security/cli/investigate.md) \*    | Search and explore Identity Security activity logs. | [Investigate](https://goteleport.com/docs/identity-security/usage/investigate.md)   |
| [`tctl access-changes`](https://goteleport.com/docs/identity-security/cli/access-changes.md) | Monitor access-path changes to crown jewels.        | [Crown Jewels](https://goteleport.com/docs/identity-security/usage/crown-jewels.md) |
| [`tctl access-review`](https://goteleport.com/docs/identity-security/cli/access-review.md)   | Review which identities can access which resources. | Access Graph                                                                        |

\* Requires [Identity Activity Center](https://goteleport.com/docs/identity-security/access-graph/identity-activity-center.md).

## Next steps

- [tctl CLI reference](https://goteleport.com/docs/reference/cli/tctl.md)