Activate agent with manager at the specified URL in this format:

dsm://<host>:<port>/

where:

<host> could be either the manager's fully qualified domain name (FQDN), IPv4 address, or IPv6 address

<port> is the manager's listening port number

Optionally, after the argument, you can also specify some settings such as the description to send during activation. See Agent-initiated heartbeat command (dsa_control -m). They must be entered as key:value pairs (with a colon as a separator). There is no limit to the number of key:value pairs that you can enter, but the key:value pairs must be separated from each other by a space. Quotation marks around the key:value pair are required if it includes spaces or special characters.

Create an update bundle.

Not supported on macOS

Identify the certificate file.

Not supported on macOS

Generate an agent package.

For more detailed instructions, see Create an agent diagnostic package via CLI on a protected computer.

Agent URL.

Defaults to https://localhost:<port>/ where <port> is the manager's listening port number.

Not supported on macOS

Force the agent to contact the manager now.

-p <str> or --passwd=<str>

Authentication password that you might have configured in Workload Security previously. See Configure self-protection through Workload Security for details.

If configured, the password must be included with all dsa_control commands except dsa_control -a, dsa_control -x, and dsa_control -y.

Example: dsa_control -m -p MyPa$w0rd

If you type the password directly into the command line, it is displayed on the screen. To hide the password with asterisks (*) while you type, enter the interactive form of the command, -p \*, which prompts you for the password.

Example:

Reset the agent's configuration. This will remove the activation information from the agent and deactivate it.

Restore a quarantined file. On Windows, you can also restore cleaned and deleted files.

Enable agent self-protection (1: enable, 0: disable). Self-protection prevents local end-users from uninstalling, stopping, or otherwise controlling the agent. For details, see Enable or disable agent self-protection. Note: Although dsa_control lets you enable self-protection, it does not let you configure an associated authentication password. You'll need Workload Security for that. See Configure self-protection through Workload Security for details. Once configured, the password will need to be entered at the command line using the -p or --passwd= option.

If dsa_control cannot contact the agent service to carry out accompanying instructions, this parameter instructs dsa_control to retry <num> number of times. There is a 1 second pause between retries. Not supported on macOS

Used in conjunction with the -x option to specify the proxy's username and password, if the proxy requires authentication. Separate the username and password by a colon (:). For example, # ./dsa_control -x dsm_proxy://<str> -u <new username>:<new password>. To remove the username and password, type an empty string (""). For example, # ./dsa_control -x dsm_proxy://<str> -u <existing username>:"". If you only want to update the proxy's password without changing the proxy's username, you can use the -u option without -x. For example, # ./dsa_control -u <existing username>:<new password>. Basic authentication only. Digest and NTLM are not supported. Note: Using dsa_control -u only applies to the agent's local configuration. No security policy is changed on the manager as a result of running this command.

Used in conjunction with the -y option to specify the proxy's user name and password, if the proxy requires authentication. Separate the username and password by a colon (:). For example, # ./dsa_control -y relay_proxy://<str> -w <new username>:<new password>. To remove the username and password, type an empty string (""). For example, # ./dsa_control -y relay_proxy://<str> -w <existing username>:"". If you only want to update the proxy's password without changing the proxy's username, you can use the -w option without -y. For example, # ./dsa_control -w <existing username>:<new password>. Basic authentication only. Digest and NTLM are not supported. Note: Using dsa_control -w only applies to the agent's local configuration. No security policy is changed on the manager as a result of running this command.

Configure a proxy between the agent and manager. Provide the proxy's IPv4/IPv6 address or FQDN and port number, separated by a colon (:). Square brackets must surround IPv6 addresses. For example: dsa_control -x "dsm_proxy://[fe80::340a:7671:64e7:14cc]:808/". To remove the address, instead of a URL, type an empty string (""). See also the -u option. For more information, see Connect to Workload Security via proxy. Using dsa_control -x only applies to the agent's local configuration. No security policy is changed on the manager as a result of running this command.

Configure a proxy between an agent and relay. Provide the proxy's IP address or FQDN and port number, separated by a colon (:). Square brackets must surround IPv6 addresses. For example: dsa_control -y "relay_proxy://[fe80::340a:7671:64e7:14cc]:808/". To remove the address, instead of a URL, type an empty string (""). See also the -w option. For more information, see Connect to relays via proxy . Using dsa_control -y only applies to the agent's local configuration. No security policy is changed on the manager as a result of running this command.

Build the baseline for Integrity Monitoring. Not supported on macOS

Scan for changes for Integrity Monitoring. Not supported on macOS

Number of times to retry an activation. Valid values are 0 to 100, inclusive. The default value is 30.

Approximate delay in seconds between retrying activations. Valid values are 1 to 3600, inclusive. The default value is 300.

A flag to enable/disable auto-detect OS proxy. The flag is controlled by agent configuration in C1WS. Values are 1: Enable, 0: Disable.

The timeout values of the proxy resolver, which can be set in seconds, can be set by dsa_control --osProxyResolveTimeout=<resolveTimeout>;<connectTimeout>;<sendTimeout>;<receiveTimeout>. Note they are separated by semicolons and each timeout value ranges from 10 to 180.

Configures a Proxy Auto-Configuration (PAC) server to resolve the corresponding proxy for the agent. Provide the PAC server's IP address or FQDN, port number, and path of the PAC file. For example: http://<Host>:<Port>/<PAC file>To clear the PAC proxy setting, type an empty string ("").

The command must assign a certain component type, for example:

Set a PAC server for resolving proxy to communicate between Manager

Set a PAC server for resolving proxy to communicate between Relay

Set both of the above commands at once:

Clear existing settings:> dsa_control --pacproxyunpw "" manager relay

For more information, see Connect to relays via proxy.

Used in conjunction with the --pacproxy option. It specifies the PAC resolved proxy's user name and password, if the proxy requires authentication. Separate the username and password with a colon (:).To clear the username and password, type an empty string ("").The command must assign a certain component type, for example:Set a PAC server for resolving proxy to communicate between Manager> dsa_control --pacproxyunpw <username>:<password> managerSet a PAC server for resolving proxy to communicate between Relay> dsa_control --pacproxyunpw <username>:<password> relaySet both of the above commands at once:> dsa_control --pacproxyunpw <username>:<password> manager relayClear existing settings:> dsa_control --pacproxyunpw "" manager relayTo update the proxy's password without changing the proxy's username, use the --pacproxyunpw option without --pacproxy:> dsa_control --pacproxyunpw <existing username>:<new password>.

File paths or directories with the delimiter "|" to separate the input file absolute paths and directories. Example file path and directories: "c:\user data|c:\app\config.exe|c:\workapps"Example command: dsa_scan --target "c:\user data|c:\app\config.exe|c:\workapps"

Optional. Supported actions are pass, delete, quarantine. The current agent scan actions of Manual Scan Configuration are applied if the parameter action is not supplied. Example command: dsa_scan --action delete --target "c:\user data|c:\app\config.exe"

Optional. The absolute file path of an output log file. If this option is not supplied, the scan result outputs to the command-line console. Example output file: "c:\temp\scan.log"Example command: dsa_scan --target "c:\users" --log "c:\temp\scan.log"

Optional. Enable scan of large files. When large files containing viruses are detected, the scan returns [Infected] and pass action. Note that large files included in the compressed files cannot be scanned. Example command: dsa_scan --target "c:\user data|c:\app\config.exe" --scanLargeFile