Ghassan Gedeon Achi f583472e9a tctl-investigate[1]: add activity-log search command (#67219) ...

* feat: add `tctl investigate` command

Add a tctl subcommand that searches Teleport's Identity Security
activity logs. The command exposes structured filter flags mirroring
the Identity Security UI: ~19 include/exclude pairs mapping to Lucene
fields (user, resource, IP, country, etc.). Multiple values on the
same flag are OR'd; different flags are AND'd.

`--query` accepts a raw Lucene expression for cases the structured
flags can't express (wildcards, regex, OR across fields) and is
mutually exclusive with the structured filters.

Facets and events are fetched in parallel via errgroup. `total` is
derived from the `event_type` facet on the stats endpoint, so it can
drift a few percent from `len(data)` on long windows.

This PR ships JSON/YAML output only. Text rendering, the geo filter,
and the `--skill` flag land in the next PR in the stack.

* fix: address codex suggestions

* fix: update flag description

2026-06-11 17:47:21 +00:00

..

common

Add a Shared User Display Formatter for the CLI (#67293)

2026-06-03 21:10:30 +00:00

fdpass-teleport

Bump nix in /tool/fdpass-teleport in the rust group (#67361)

2026-06-04 16:22:11 +00:00

tbot

fips: Switch to Go-native FIPS140 builds from boring crypto (#66690)

2026-05-20 00:42:41 +00:00

tctl

tctl-investigate[1]: add activity-log search command (#67219)

2026-06-11 17:47:21 +00:00

teleport

Disable the embedded session helper by default (#67386)

2026-06-03 09:56:48 +00:00

teleport-update

fips: Switch to Go-native FIPS140 builds from boring crypto (#66690)

2026-05-20 00:42:41 +00:00

tsh

Migrate GetTunnelConnections/GetAllTunnelConnections to gRPC (#66066)

2026-06-11 12:44:50 +00:00