Identity Security from the Command Line

Report an Issue

Is this page helpful?

How can we improve this page?

View as Markdown

Identity Security is available only with Teleport Enterprise.

Teleport Identity Security exposes several tctl commands for querying Access Graph data directly from your terminal: security detections, identity activity logs, access-path changes to crown jewels, and identity access review. Use them to script investigations, feed automation, and work without leaving the shell.

How it works

These commands query Teleport Access Graph through the Teleport Proxy Service, using the credentials from your current tsh session.

Prerequisites

• A Teleport Enterprise cluster v18.11.0 or later with Identity Security enabled.
• Access Graph running. Teleport Enterprise Cloud manages Access Graph for you. For self-hosted clusters, follow the Docker or Helm deployment guide. Each command requires a minimum Access Graph version, noted on its page.
• tctl installed locally. See Installation.
• A logged-in session created with tsh login, or a Teleport identity file passed with tctl -i <identity-file> --auth-server <proxy-or-auth-addr>.
• A Teleport user with a role that allows the list and read verbs on the access_graph resource. The preset editor role has the required permissions by default.

Get started

Log in to your cluster, then run any Identity Security command:

tsh login --proxy=teleport.example.com --user=alice
tctl detections ls

Commands

Command	What it does	In the Web UI
tctl detections *	Investigate security detections and anomalies.	Alerts
tctl investigate *	Search and explore Identity Security activity logs.	Investigate
tctl access-changes	Monitor access-path changes to crown jewels.	Crown Jewels
tctl access-review	Review which identities can access which resources.	Access Graph

* Requires Identity Activity Center.

Next steps

• tctl CLI reference