matchy

The Matchy command-line interface.

Synopsis

matchy <COMMAND> [OPTIONS]

Description

Matchy is a command-line tool for building and querying databases of IP addresses, CIDR ranges, exact strings, and glob patterns.

Commands

matchy build

Build a database from input files.

$ matchy build threats.csv --input-format csv --output threats.mxy

See matchy build for details.

matchy query

Query a database for matches.

$ matchy query threats.mxy 192.0.2.1

See matchy query for details.

matchy match

Scan log files or stdin for entries that match a database.

$ matchy match threats.mxy access.log --stats

See matchy match for details.

matchy extract

Extract IoC candidates from log files or stdin.

$ matchy extract access.log --types all

See matchy extract for details.

matchy inspect

Inspect database contents and structure.

$ matchy inspect threats.mxy

See matchy inspect for details.

matchy validate

Validate a database file for safety and consistency.

$ matchy validate threats.mxy --level strict

See matchy validate for details.

matchy bench

Benchmark synthetic database build, load, and query performance.

$ matchy bench combined

See matchy bench for details.

Global Options

`-h, --help`

Print help information for matchy or a specific command.

$ matchy --help
$ matchy build --help

`-V, --version`

Print version information.

$ matchy --version
matchy 2.0.1

Examples

Complete Workflow

# 1. Build database
$ matchy build threats.csv --input-format csv --output threats.mxy

# 2. Inspect it
$ matchy inspect threats.mxy

# 3. Query it
$ matchy query threats.mxy 192.0.2.1

# 4. Scan logs against it
$ matchy match threats.mxy access.log --stats

# 5. Run a synthetic benchmark
$ matchy bench combined

Working with GeoIP

# Query a MaxMind GeoLite2 database
$ matchy query GeoLite2-City.mmdb 8.8.8.8

# Inspect it
$ matchy inspect GeoLite2-City.mmdb

Environment Variables

`MATCHY_LOG`

Set log level: error, warn, info, debug, trace

$ MATCHY_LOG=debug matchy build data.csv --input-format csv --output db.mxy

Exit Status

0 - Success
1 - Error

Files

Matchy databases typically use the .mxy extension, though any extension works. Standard MMDB files use .mmdb.

Matchy Documentation