Sextant

CLI tool for navigating security events across multiple endpoints (Splunk, TheHive).

Installation

Requires Python 3.10+.

pip install .

For Okta/WebAuthn authentication support:

pip install ".[auth]"

Configuration

Sextant reads its configuration from ~/.config/sextant/config.yaml. Each entry in endpoints registers a CLI subcommand.

endpoints:
- name: splunk-prodclient: splunkremote: https://splunk.example.com:8089credentials:
provider: 1passwordvault: Securityitem: Splunkfields:
secret: api-token
- name: hiveclient: thehiveremote: https://thehive.example.com:9000credentials:
secret: <your-api-key>

Endpoints

Field	Description
name	Name used as the CLI subcommand
client	Client module to use (splunk or thehive)
remote	Base URL of the service
verify	TLS verification (default: true). Set to false to skip, or a path to a CA bundle
credentials	Authentication credentials (see below)

Credentials

Inline credentials -- provide fields directly:

credentials:
secret: my-api-token

TheHive also supports basic auth:

credentials:
username: analystpassword: hunter2

1Password integration -- fields are resolved at runtime via the op CLI:

credentials:
provider: 1passwordvault: Securityitem: Splunkfields:
secret: api-token

Usage

sextant <endpoint> <resource> <action> [options]

Global commands

# Test authentication against all configured endpoints
sextant check

Splunk

# Run a search query (results stream as a live table in the terminal)
sextant splunk-prod query "search index=_internal | head 10 | fieldsummary"
sextant splunk-prod query --from 1h --to now "search index=main sourcetype=syslog"# List and inspect saved searches
sextant splunk-prod search list
sextant splunk-prod search list --user admin --name "failed logins"
sextant splunk-prod search get "My Saved Search"# Dispatch a saved search and optionally trigger its alert actions
sextant splunk-prod search run "My Saved Search"
sextant splunk-prod search run --trigger --from 2h --to 30m "My Saved Search"# Manage search jobs
sextant splunk-prod job list
sextant splunk-prod job list --user admin
sextant splunk-prod job get <sid>
sextant splunk-prod job get <sid> --wait 30 --fields _time,host,source
# List accessible indexes
sextant splunk-prod indexes

TheHive

# List recent alerts and cases (default: last 10 minutes)
sextant hive alert list
sextant hive alert list --from 1h
sextant hive case list --from 7d
# Get a specific alert
sextant hive alert get <alert-id># Create an alert from a JSON file
sextant hive alert new alert.json

Piping

When stdout is not a terminal, all commands output JSON for piping:

# Pipe job results between commands
sextant splunk-prod search run "My Search"| sextant splunk-prod job get - --wait 60
# Feed into jq
sextant hive alert list --from 1d | jq '.[].title'

Time formats

Time options (--from, --to) accept:

Format	Example	Description
Relative	30s, 10m, 2h, 7d, 1y	Duration ago from now
ISO 8601	2025-01-15T08:00:00	Absolute timestamp