ness-protection
NESS protection engine (EDR + EPP): on-demand scans, detections, quarantine and anti-ransomware rollback.
On macOS and Linux the help shows the protection component under another binary name. NESS confirmed everything is named ness-protection; commands in those tabs use that name until the final binary is confirmed.
Commands are run by name (the installer adds the binaries to PATH). On Windows, run them in PowerShell as administrator (recommended; required where marked "Yes"). On macOS and Linux, with sudo.
- Windows
- macOS
- Linux
Scanning
| Argument | Description | Example | Requires admin |
|---|---|---|---|
--scan <ruta> | On-demand scan of a path. JSON output (one line per result). | ness-protection --scan C:\Users\Public\Downloads | Recommended |
--scan-quick | Quick scan of high-risk locations. | ness-protection --scan-quick | Recommended |
--scan-full | Full scan (Users, ProgramData and Program Files). | ness-protection --scan-full | Recommended |
--scan-path <carpeta> | Scans a specific folder (lab, USB, shares). Shows progress in the terminal; with a pipe or --json it outputs JSON. | ness-protection --scan-path E:\ | Recommended |
--json | With --scan-path, forces JSON output (useful for scripts). | ness-protection --scan-path E:\ --json | Recommended |
Detections and quarantine
| Argument | Description | Example | Requires admin |
|---|---|---|---|
--alerts [N] | Shows the last N detections from the local journal (default 20). | ness-protection --alerts 50 | Recommended |
--quarantine list | Lists quarantined items. | ness-protection --quarantine list | Recommended |
--quarantine restore <id> | Restores a quarantined item. | ness-protection --quarantine restore <id> | Yes |
--quarantine delete <id> | Permanently deletes a quarantined item. | ness-protection --quarantine delete <id> | Yes |
Anti-ransomware
| Argument | Description | Example | Requires admin |
|---|---|---|---|
--rollback <desde> | Rolls back ransomware changes since an ISO 8601 timestamp or the last incident (last_incident). | ness-protection --rollback last_incident | Yes |
Service
| Argument | Description | Example | Requires admin |
|---|---|---|---|
--install | Installs the protection service. | ness-protection --install | Yes |
--uninstall | Uninstalls the protection service. | ness-protection --uninstall | Yes |
--status | Shows the protection engine status. | ness-protection --status | Recommended |
--version | Shows the version. | ness-protection --version | Recommended |
| Argument | Description | Example | Requires admin |
|---|---|---|---|
--install | Installs the protection component. | sudo ness-protection --install | Yes (sudo) |
--uninstall | Uninstalls the protection component. | sudo ness-protection --uninstall | Yes (sudo) |
--trigger | Sends data to the NESS cloud immediately. | sudo ness-protection --trigger | Yes (sudo) |
--doctor | Health check. | sudo ness-protection --doctor | Yes (sudo) |
--scan | Full scan with all modules. | sudo ness-protection --scan | Yes (sudo) |
--scan-ioc | Only syncs indicators of compromise (IOCs). | sudo ness-protection --scan-ioc | Yes (sudo) |
--version | Shows the version. | ness-protection --version | Yes (sudo) |
--help | Shows help. | ness-protection --help | Yes (sudo) |
| Argument | Description | Example | Requires admin |
|---|---|---|---|
--status | Shows status. | sudo ness-protection --status | Yes (sudo) |
--diagnose | Deep diagnostic. | sudo ness-protection --diagnose | Yes (sudo) |
--once | Runs a single detection cycle and exits. | sudo ness-protection --once | Yes (sudo) |
--version | Shows the version. | ness-protection --version | Yes (sudo) |
--rollback reverts file changes on the device. Use it only during ransomware incident response and, if possible, with NESS support (soporte@nesshq.com). Timestamp example: ness-protection --rollback 2026-10-13T08:00:00.
Agent binaries help (--help) on Windows, macOS and Linux; NESS confirmations (Oct-2026).