> For the complete documentation index, see [llms.txt](https://witfy.gitbook.io/clowrk/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://witfy.gitbook.io/clowrk/card-modules/command-line.md).

# Command Line

The Command Line module puts a terminal inside a case, so your team can run commands on a host without leaving Clowrk — and so every command that was run stays recorded on the case.

**Requirement:** a Priax connector must be configured. Clowrk finds the host through your CMDB, so a machine that is not in the CMDB cannot be selected here.

## What it is for

An analyst working an incident usually needs two things at once: the case, and a shell on the machine the case is about. Switching to a separate remote-access tool breaks that in three ways — the output lives somewhere else, nobody else on the team sees what was tried, and the next person to pick up the case starts from nothing.

With this module the command, its output and who ran it are part of the case history.

## Supported hosts

| Host                                                                     | Supported                             |
| ------------------------------------------------------------------------ | ------------------------------------- |
| Windows                                                                  | Yes — commands run through PowerShell |
| Linux                                                                    | Yes                                   |
| Anything else (network gear, printers, appliances, virtualisation hosts) | No                                    |

Clowrk decides which of these a host is from how it is registered in the CMDB. **If it cannot tell, it will not open a session** — you will see the host as unavailable rather than a terminal that fails when you use it. That refusal is deliberate: guessing at an unknown device is worse than saying no.

## How a session works

1. **Pick the host.** Choose it from the CMDB tree in the card. Only hosts Clowrk can connect to are offered.
2. **Authenticate.** Enter the credentials for that machine. They are encrypted before being stored and are never displayed again — not to you, not to anyone else on the team.
3. **Run commands.** Type a command and send it. Output comes back into the card and is visible to everyone who has the case open.
4. **The session expires.** Stored credentials are held for 30 minutes of a working session, then you authenticate again.

Several sessions can be open on the same case at once — one tab per host — which is the normal shape when an incident spans more than one machine.

## Saved credentials for a team

Instead of every analyst typing credentials for every session, an administrator can register credentials once for the whole team, under **Manage host credentials**.

* A **default per operating system** — one set for Windows hosts, one for Linux.
* A **per-host override** when one machine needs different credentials.

When a command runs, Clowrk looks for a host-specific entry first, then falls back to the operating-system default. If neither exists, the analyst is asked to authenticate.

Only administrators can see or change this list, and passwords are never shown once saved.

> **When a case is opened automatically by a monitoring event, there is no analyst to ask.** Those runs use the team credentials, which is the whole reason to configure them. Without them, automatic remediation cannot connect.

## What happens when nothing comes back

Commands are sent to an agent running on the host. If no result arrives within five minutes, Clowrk closes the command with an explicit message:

> The remote agent returned no result after 5 minutes. It is not known whether the command ran on the host — check the host before running it again.

Read that literally. It does **not** mean the command failed, and it does not mean it was skipped — it means the answer was lost, and the command may well have executed. Before re-running anything that would be harmful twice (a restart, a deletion, a configuration change), check the host first.

## What is recorded

Every command produces a record on the case: the command text, who sent it, the host it was aimed at, the output, and the result. That record does not change afterwards, even if the source article or procedure is edited later.

## Related

* [Knowledge Base](/clowrk/knowledge-base.md) — how an article can carry commands that this module runs
* [Priax Connector](/clowrk/connectors/priax.md) — the CMDB this module reads hosts from