CLI reference

delta [options]

Exit code: 0 if all checks passed, 1 on a failure (a violation, a bad argument, or an I/O error). Modes that only produce output (--baseline, --fleet) return 0 on success / non-empty findings as noted below.

Collection

Option	Description
--processes	Collect the running process list.
--ports	Collect open ports / connections.
--packages	Collect the installed-package inventory (dpkg/opkg/apk). See Packages & vulnerabilities.
--netif	Collect network interfaces, routes and neighbors. See Network.
--fingerprint <dir>	Recursively checksum files under <dir> (plus mode/owner/caps).
--trace	Sample syscall behavior for one bounded window per cycle. See Syscall behavior tracing.
--trace-args	Decode the arguments of the interesting syscalls (paths, peer addresses, protection bits) instead of only counting them. Implies --trace. See Syscall behavior tracing.
--trace-window <ms>	Length of that window in milliseconds (default 1000, max 60000).
--trace-backend <name>	Force a trace backend: auto (default), ebpf, ptrace, es, procinfo.
--trace-run <cmd>	Run <cmd> under a seccomp supervisor, report every syscall it made, and exit. Arguments are space-separated; no shell. See Syscall behavior tracing.
--cve-feed <file>	Match installed packages against a CVE advisory feed (implies --packages). See Packages & vulnerabilities.
--ioc-feed <file>	Match observed connection peers, neighbors and file hashes against a threat-intel (IOC) feed. See Threat detection.
--stun <host[:port]>	NAT reachability beacon: probe a STUN server for the device’s public address and RTT (a reported signal, never a policy gate). Default port 3478. See Shipping reports to a server.

Mounts are always collected (cheap, cross-checked). Device identity and the system-integrity inputs (kernel modules, DNS resolvers, accounts, kernel memory / SLAB/SLUB state) are likewise collected unconditionally — all cheap and path-based. Collection can also be driven from the config collect section — see Configuration.

Policy & output

Option	Description
--cfg <file>	Read the norm (policy) from a JSON config. See Configuration.
--json	Write the JSON report to stdout. See JSON output.
--output-json <file>	Write the JSON report to <file>.
--baseline <file>	Capture the current state as a norm-config and exit (- = stdout). See Baseline capture.

Offline analysis

Option	Description
--root <dir>	Resolve path-based reads under <dir> (a mounted image / rootfs) instead of the live host. See Offline image analysis.

Continuous monitoring

Option	Description
--interval <seconds>	Run continuously, reporting drift between cycles (positive integer). See Continuous monitoring.
--state <file>	Persist the previous observation so drift is detected across runs.

Fleet analysis

Option	Description
--fleet <dir>	Analyze a directory of per-device baselines and report cohort outliers, then exit. See Fleet / cohort analysis.

Report shipping

Option	Description
--server <url>	POST the JSON report to http://host[:port][/path] (once, or every --interval cycle). See Shipping reports to a server.
--spool <dir>	Buffer undeliverable reports and retry them later.
--cacert <file>	CA bundle to verify an https:// server (curl backend).
--insecure	Skip TLS verification for --server (unsafe).
--token <token>	Identification token: embedded in the JSON report and sent as an Authorization: Bearer header so the server can attribute the signals.

Misc

Option	Description
-h, --help	Show usage and exit.