- Snyk helps you find, fix and monitor known vulnerabilities in open source
-
+# Snyk CLI
-
-
-
-
+[Snyk](https://snyk.io) scans and monitors your projects for security vulnerabilities.
----
+
-## What is Snyk?
+# What is [Snyk](https://snyk.io)?
-
+[Snyk](https://snyk.io) is a developer-first cloud-native security tool.
+It covers multiple areas of application security:
-## Table Of Contents:
+1. [**Snyk Open Source**](https://snyk.io/product/open-source-security-management/): Find and automatically fix open source vulnerabilities
+2. [**Snyk Code**](https://snyk.io/product/snyk-code/): Find and fix vulnerabilities in your application code in real time
+3. [**Snyk Container**](https://snyk.io/product/container-vulnerability-management/): Find and fix vulnerabilities in container images and Kubernetes applications
+4. [**Snyk Infrastructure as Code**](https://snyk.io/product/infrastructure-as-code-security/): Find and fix insecure configurations in Terraform and Kubernetes code
-- [Installation](#installation)
-- [CLI](#cli)
-- [Features](#features)
-- [Docker](#docker)
-- [Badge](#badge)
+[Learn more about what Snyk can do and sign up for a free account »](https://snyk.io)
-## Installation
+# What is Snyk CLI?
-1. Install the Snyk utility using `npm install -g snyk`.
-2. Once installed you will need to authenticate with your Snyk account: `snyk auth`
+Snyk CLI brings the functionality of [Snyk](https://snyk.io) into your development workflow. It can be run locally or in your CI/CD pipeline to scan your projects for security issues.
-For more detail on how to authenticate take a look at the [CLI authentication](https://snyk.io/docs/using-snyk#authentication?utm_campaign=docs&utm_medium=github&utm_source=CLI_authentication) section of the Snyk documentation.
+## Supported languages and tools
-## CLI
+Snyk supports many languages and tools, including Java, .NET, JavaScript, Python, Golang, PHP, C/C++, Ruby, Scala and more. See our [Language Support documentation](https://support.snyk.io/hc/en-us/articles/360020352437-Language-support-summary).
-```console
-snyk [options] [command] [package]
-```
+CLI also supports [Docker scanning](https://support.snyk.io/hc/en-us/articles/360003946897-Snyk-Container-security-overview) and [Terraform, k8s and other Infrastructure as Code files scanning](https://support.snyk.io/hc/en-us/categories/360001342678-Infrastructure-as-code).
-Run `snyk --help` to get a quick overview of all commands or for full details on the CLI read the snyk.io [CLI docs](https://snyk.io/docs/using-snyk?utm_campaign=docs&utm_medium=github&utm_source=cli).
+---
-The package argument is optional. If no package is given, Snyk will run the command against the current working directory allowing you test you non-public applications.
+# Install Snyk CLI
-## Features
+Snyk CLI can be installed through multiple channels.
-- **Find** known vulnerabilities by running `snyk test` on a project either as a one off or as part of your CI process.
-- **Fix** vulnerabilities using `snyk wizard` and `snyk protect`.
- - `snyk wizard` walks you through finding and fixing known vulnerabilities in your project. Remediation options include configuring your policy file to update, auto patch and ignore vulnerabilities. (npm only)
- - `snyk protect` your code from vulnerabilities by applying patches and optionally suppressing specific vulnerabilities.
-- **Alert** `snyk monitor` records the state of dependencies and any vulnerabilities on snyk.io so you can be alerted when new vulnerabilities or updates/patches are disclosed that affect your repositories.
-- **Prevent** new vulnerable dependencies from being added to your project by running `snyk test` as part of your CI to fail tests when vulnerable Node.js or Ruby dependencies are added.
+## Install with npm or Yarn
-## Docker
+[Snyk CLI is available as an npm package](https://www.npmjs.com/package/snyk). If you have Node.js installed locally, you can install it by running:
-Snyk is also provided as a set of Docker images that carry the runtime environment of each package manager. For example, the npm image will carry all of the needed setup to run `npm install` on the currently running container. Currently there are images for npm, Ruby, Maven, Gradle and SBT.
+```bash
+npm install snyk@latest -g
+```
-The images can perform `snyk test` by default on the specified project which is mounted to the container as a read/write volume, and `snyk monitor` if the `MONITOR` environment variable is set when running the docker container. If you want an HTML report for `test` command, make sure `--json` parameter is provided. `monitor` command appends it automatically. An HTML file called `snyk_report.html` and a CSS file called `snyk_report.css` will be generated. The image also writes a file called `snyk-res.json` for internal use and `snyk-error.log` for errors that we can look at if something goes wrong.
+or if you are using Yarn:
-The following environment variables can be used when running the container on docker:
+```bash
+yarn global add snyk
+```
-- `SNYK_TOKEN` - Snyk API token, obtained from [https://app.snyk.io/account](https://app.snyk.io/account).
-- `USER_ID` - [OPTIONAL] Current user ID on the host machine. If not provided will take the user ID of the currently running user inside the container. This is used for CI builds such as Jenkins where we are running with a non-privileged user and want to allow the user to access the mounted project folder.
-- `MONITOR` - [OPTIONAL] If set, tells the image that we want to run `snyk monitor` after running `snyk test`.
-- `PROJECT_FOLDER` - [OPTIONAL] If set, this will cd to the directory inside the mounted project dir to run snyk inside it.
-- `ENV_FLAGS` - [OPTIONAL] additional environment parameters to pass to `snyk test` when running the container.
+## More installation methods
-Docker images are tagged according to the package manager runtime they include, the package manager version and snyk version.
-The general format of tags is [snyk-version]-[package-manager]-[package-manager-version] or just [package-manager]-[package-manager-version] if we want to use the latest version of snyk. Please see available tags to see the available options.
+
+ Standalone executables (macOS, Linux, Windows)
-[snyk-version] - The version of snyk that is installed in the image, if version is omitted it will use the latest version.
-[package-manager] - One of the available package managers (e.g: npm, mvn, gradle, etc...).
-[package-manager-version] - The version of the package manager that is installed inside the image.
+### Standalone executables
-Please see the following examples on how to run Snyk inside docker:
+Use [GitHub Releases](https://github.com/snyk/snyk/releases) to download a standalone executable of Snyk CLI for your platform.
-### Node.js (npm)
+We also provide these standalone executables on our official CDN. See [the `release.json` file](https://static.snyk.io/cli/latest/release.json) for the download links:
-We will need to mount the project root folder when running the image so that Snyk can access the code within the container. The host project folder will be mounted to `/project` on the container and will be used to read the dependencies file and write results for CI builds. Here's an example of running `snyk test` and `snyk monitor` in the image (with the latest version of Snyk) for npm:
+```text
+https://static.snyk.io/cli/latest/release.json
+# Or for specific version or platform
+https://static.snyk.io/cli/v1.666.0/release.json
+https://static.snyk.io/cli/latest/snyk-macos
```
-docker run -it
- -e "SNYK_TOKEN="
- -e "USER_ID=1234"
- -e "MONITOR=true"
- -v ":/project"
- snyk/snyk-cli:npm test --org=my-org-name
+
+For example, to download and run the latest Snyk CLI on macOS, you could run:
+
+```bash
+curl https://static.snyk.io/cli/latest/snyk-macos -o snyk
+chmod +x ./snyk
+mv ./snyk /usr/local/bin/
```
-### RubyGems
+You can also use these direct links to download the executables:
-We will need to mount the project root folder when running the image so that Snyk can access the code within the container. The host project folder will be mounted to `/project` on the container and will be used to read the dependencies file and write results for CI builds. Here's an example of running `snyk test` and `snyk monitor` in the image (with the latest version of Snyk) for RubyGems:
+- macOS: https://static.snyk.io/cli/latest/snyk-macos
+- Windows: https://static.snyk.io/cli/latest/snyk-win.exe
+- Linux: https://static.snyk.io/cli/latest/snyk-linux
+- Linux (arm64): https://static.snyk.io/cli/latest/snyk-linux-arm64
+- Alpine: https://static.snyk.io/cli/latest/snyk-alpine
-```
-docker run -it
- -e "SNYK_TOKEN="
- -e "USER_ID=1234"
- -e "MONITOR=true"
- -v ":/project"
- snyk/snyk-cli:rubygems test --org=my-org-name
-```
+Drawback of this method is, that you will have to manually keep the Snyk CLI up to date.
+
+#### Verifying standalone binaries
+
+You can verify both shasum of downloaded binaries and their GPG signatures.
-### Maven 3.5.4
+Download location on `static.snyk.io` contains a file called `sha256sums.txt.asc`.
+You can download it directly `https://static.snyk.io/cli/latest/sha256sums.txt.asc` or for a specific version like `https://static.snyk.io/cli/v1.666.0/sha256sums.txt.asc`.
-We will need to mount the project root folder when running the image so that Snyk can access the code within the container and mount the local .m2 and .ivy2 folders. The host project folder will be mounted to `/project` on the container and will be used to read the dependencies file and write results for CI builds. Here's an example of running `snyk test` and `snyk monitor` in the image (with the latest version of Snyk) for Maven:
+To check that a downloaded file matches the checksum, use a `sha256sum` command like so:
+```bash
+grep snyk-macos sha256sums.txt.asc | sha256sum -c -
```
-docker run -it
- -e "SNYK_TOKEN="
- -e "USER_ID=1234"
- -e "MONITOR=true"
- -v ":/project"
- -v "/home/user/.m2:/home/node/.m2"
- -v "/home/user/.ivy2:/home/node/.ivy2"
- snyk/snyk-cli:maven-3.5.4 test --org=my-org-name
+
+If you want to verify Snyk CLI standalone binaries against [Snyk CLI GPG key](help/_about-this-project/snyk-code-signing-public.pgp), you will need to import it first:
+
+```bash
+# 68BFBCCEB7794E6FC06A2044A29C32E91F4B9569 is the key belonging to code-signing@snyk.io
+# Copy of this public key is also in this repository /help/_about-this-project/snyk-code-signing-public.pgp
+gpg --keyserver hkps://keys.openpgp.org --recv-keys 68BFBCCEB7794E6FC06A2044A29C32E91F4B9569
```
-### SBT 0.13.16 / SBT 1.0.4
+Then verify the file is signed with:
-We will need to mount the project root folder when running the image so that Snyk can access the code within the container and mount the local .m2 and .ivy2 folders. The host project folder will be mounted to `/project` on the container and will be used to read the dependencies file and write results for CI builds. Here are examples of running `snyk test` and `snyk monitor` in the image (with the latest version of Snyk) for SBT:
+```bash
+gpg --verify sha256sums.txt.asc
+```
-NOTE: the `dependency-tree` module is required for `snyk` to process Scala projects. Use [version 0.8.2](https://github.com/jrudolph/sbt-dependency-graph/tree/v0.8.2) for SBT 0.13.16 and [version 0.9.0](https://github.com/jrudolph/sbt-dependency-graph/tree/v0.9.0) for version SBT 1.0.4.
+Command output should look like:
+```plain
+gpg: Signature made Mon Apr 25 16:55:01 2022 CEST
+gpg: using RSA key 68BFBCCEB7794E6FC06A2044A29C32E91F4B9569
+gpg: Good signature from "Snyk Limited " [unknown]
+gpg: WARNING: This key is not certified with a trusted signature!
+gpg: There is no indication that the signature belongs to the owner.
+Primary key fingerprint: 68BF BCCE B779 4E6F C06A 2044 A29C 32E9 1F4B 9569
```
-docker run -it
- -e "SNYK_TOKEN="
- -e "USER_ID=1234"
- -e "MONITOR=true"
- -v ":/project"
- -v "/home/user/.m2:/home/node/.m2"
- -v "/home/user/.ivy2:/home/node/.ivy2"
- snyk/snyk-cli:sbt-0.13.16 test --org=my-org-name
+
+
+
+
+ Install with Homebrew (macOS, Linux)
+
+### Homebrew
+
+Install Snyk CLI from [Snyk tap](https://github.com/snyk/homebrew-tap) with [Homebrew](https://brew.sh) by running:
+
+```bash
+brew tap snyk/tap
+brew install snyk
```
+
+
+
+ Scoop (Windows)
+
+### Scoop
+
+Install Snyk CLI from our [Snyk bucket](https://github.com/snyk/scoop-snyk) with [Scoop](https://scoop.sh) on Windows:
+
```
-docker run -it
- -e "SNYK_TOKEN="
- -e "USER_ID=1234"
- -e "MONITOR=true"
- -v ":/project"
- -v "/home/user/.m2:/home/node/.m2"
- -v "/home/user/.ivy2:/home/node/.ivy2"
- snyk/snyk-cli:sbt-1.0.4 test --org=my-org-name
+scoop bucket add snyk https://github.com/snyk/scoop-snyk
+scoop install snyk
```
-### Gradle 2.8 / Gradle 4.4 / Gradle 5.4
+
-We will need to mount the project root folder when running the image so that Snyk can access the code within the container and mount the local .m2 and .ivy2 folders. The host project folder will be mounted to `/project` on the container and will be used to read the dependencies file and write results for CI builds. Here's an example of running `snyk test` and `snyk monitor` in the image (with the latest version of Snyk) for Gradle:
+
+ Snyk CLI in a Docker image
+### Snyk CLI in a Docker image
+
+Snyk CLI can also be run from a Docker image. Snyk offers multiple Docker tags under [`snyk/snyk`](https://hub.docker.com/r/snyk/snyk). These images wrap the Snyk CLI and depending on the Tag come with a relevant tooling for different projects. [See the snyk/images on GitHub for more details and examples](https://github.com/snyk/snyk-images).
+
+
+
+## Install as a part of a Snyk CLI integration
+
+Snyk also offers many integrations into developer tooling. These integrations will install and manage the Snyk CLI for you. For example:
+
+- [Snyk Jenkins plugin](https://github.com/jenkinsci/snyk-security-scanner-plugin)
+- [CircleCI Orb](https://github.com/snyk/snyk-orb)
+- [Azure Pipelines Task](https://github.com/snyk/snyk-azure-pipelines-task)
+- [GitHub Actions](https://github.com/snyk/actions)
+- [IntelliJ IDE Plugin](https://github.com/snyk/snyk-intellij-plugin)
+- [VS Code Extension](https://marketplace.visualstudio.com/items?itemName=snyk-security.snyk-vulnerability-scanner)
+- [Eclipse IDE Extension](https://github.com/snyk/snyk-eclipse-plugin)
+- [Maven plugin](https://github.com/snyk/snyk-maven-plugin)
+- And many more. See [the Integrations documentation](https://support.snyk.io/hc/en-us/categories/360000598398-Integrations)
+
+
+
+---
+
+# Getting started with Snyk CLI
+
+Once you installed the Snyk CLI, you can verify it's working by running:
+
+```bash
+snyk --help
```
-docker run -it
- -e "SNYK_TOKEN="
- -e "USER_ID=1234"
- -e "MONITOR=true"
- -v ":/project"
- -v "/home/user/.m2:/home/node/.m2"
- -v "/home/user/.ivy2:/home/node/.ivy2"
- snyk/snyk-cli:gradle-2.8 test --org=my-org-name
-```
+See the [full Snyk CLI help](./help/cli-commands).
+
+## Authenticating Snyk CLI
+
+Snyk CLI depends on [Snyk.io](https://snyk.io) APIs. Connect your Snyk CLI with [Snyk.io](https://snyk.io) by running:
+
+```bash
+snyk auth
```
-docker run -it
- -e "SNYK_TOKEN="
- -e "USER_ID=1234"
- -e "MONITOR=true"
- -v ":/project"
- -v "/home/user/.m2:/home/node/.m2"
- -v "/home/user/.ivy2:/home/node/.ivy2"
- snyk/snyk-cli:gradle-4.4 test --org=my-org-name
+
+## Setting up language support
+
+Depending on your project's language, you might need to setup your language environment before using Snyk.
+
+See our [Language Support documentation](https://support.snyk.io/hc/en-us/articles/360020352437-Language-support-summary).
+
+## Scanning your project
+
+If you are already in a folder with a supported project, start by running:
+
+```bash
+snyk test
```
+Or scan a Docker image by its tag with [Snyk Container](https://snyk.io/product/container-vulnerability-management/):
+
+```bash
+snyk container test ubuntu:18.04
```
-docker run -it
- -e "SNYK_TOKEN="
- -e "USER_ID=1234"
- -e "MONITOR=true"
- -v ":/project"
- -v "/home/user/.m2:/home/node/.m2"
- -v "/home/user/.ivy2:/home/node/.ivy2"
- snyk/snyk-cli:gradle-5.4 test --org=my-org-name
+
+Or a k8s file:
+
+```bash
+snyk iac test /path/to/kubernetes_file.yaml
```
-### Docker
+## Monitoring your project
+
+Snyk can also monitor your project periodically and alert you for new vulnerabilities. The `snyk monitor` is similar to `snyk test` and can be used to create a project on the Snyk website that will be continuously monitored for new vulnerabilities.
-We will need to mount the project root folder when running the image so that Snyk can access the code within the container and Docker socket so that Snyk can access Docker daemon. The host project folder will be mounted to `/project` on the container and will be used to read the Docker file (with --file). Here's an example of running `snyk test` and `snyk monitor` in the image (with the latest version of Snyk) for Docker:
+
\"}' > \"${PROJECT_PATH}/${PROJECT_FOLDER}/${HTML_FILE}\" 2>>\"${ERROR_FILE}\""
fi
-
-runCmdAsDockerUser "cat \"${OUTPUT_FILE}\" | \
-jq 'def sortBySeverity: .vulnerabilities|= map(. + {severity_numeric: (if(.severity) == \"high\" then 1 else (if(.severity) == \"medium\" then 2 else (if(.severity) == \"low\" then 3 else 4 end) end) end)}) |.vulnerabilities |= sort_by(.severity_numeric) | del(.vulnerabilities[].severity_numeric); if (. | type) == \"array\" then map(sortBySeverity) else sortBySeverity end'| \
-snyk-to-html | \
-sed 's/<\/head>/ <\/head>/' \
->> \"${PROJECT_PATH}/${PROJECT_FOLDER}/${HTML_FILE}\""
-
-runCmdAsDockerUser "cat /home/node/snyk_report.css > \
-\"${PROJECT_PATH}/${PROJECT_FOLDER}/snyk_report.css\""
-# fi
-#
+runCmdAsDockerUser "cat \"${OUTPUT_FILE}\" | snyk-to-html >> \"${PROJECT_PATH}/${PROJECT_FOLDER}/${HTML_FILE}\""
if [ $RC -ne "0" ]; then
exitWithMsg "${OUTPUT_FILE}" "$RC"
diff --git a/docker/docker-python-entrypoint.sh b/docker/docker-python-entrypoint.sh
index 7c8881f10a..27e4b76b67 100755
--- a/docker/docker-python-entrypoint.sh
+++ b/docker/docker-python-entrypoint.sh
@@ -1,6 +1,74 @@
#!/bin/bash
-
virtualenv -p python snyk
source snyk/bin/activate
-pip install -U -r "${PROJECT_PATH}/requirements.txt"
+
+exitWithMsg() {
+ echo "Failed to run the process ..."
+
+ if [ -f "$1" ]; then
+ cat "$1"
+ else
+ echo "$1"
+ fi
+
+ exit "$2"
+}
+
+installRequirementsTxtDeps() {
+ echo "Installing dependencies from requirements file"
+ pip install -U -r "$1"
+}
+
+installPipfileDeps() {
+ pushd "${PROJECT_PATH}/"
+ echo "Found Pipfile"
+ pipenv install --system --deploy
+ popd
+}
+
+PROJECT_SUBDIR=""
+echo "Project path = ${PROJECT_PATH}"
+if [ -n "${TARGET_FILE}" ]; then
+ if [ ! -f "${PROJECT_PATH}/${PROJECT_FOLDER}/${TARGET_FILE}" ]; then
+ exitWithMsg "\"${PROJECT_PATH}/${PROJECT_FOLDER}/${TARGET_FILE}\" does not exist" 2
+ fi
+
+ PROJECT_SUBDIR=$(dirname "${TARGET_FILE}")
+ MANIFEST_NAME=$(basename "${TARGET_FILE}")
+ TEST_SETTINGS="--file=${MANIFEST_NAME} "
+
+ echo "Target file = ${TARGET_FILE}"
+
+ case $MANIFEST_NAME in
+ *req*.txt)
+ echo "Installing dependencies from requirements file"
+ installRequirementsTxtDeps "${PROJECT_PATH}/$MANIFEST_NAME"
+ ;;
+ *setup.py)
+ echo "Installing dependencies from setup.py"
+ pip install -U -e "${PROJECT_PATH}"
+ ;;
+ *Pipfile)
+ echo "Installing dependencies from Pipfile"
+ installPipfileDeps
+ ;;
+ *)
+ exitWithMsg "\"${PROJECT_PATH}/${TARGET_FILE}\" is not supported" 3
+ ;;
+ esac
+fi
+
+if [ -z "${TARGET_FILE}" ]; then
+ if [ -f "${PROJECT_PATH}/requirements.txt" ]; then
+ echo "Found requirement.txt"
+ installRequirementsTxtDeps "${PROJECT_PATH}/requirements.txt"
+ elif [ -f "${PROJECT_PATH}/setup.py" ]; then
+ echo "Found setup.py"
+ pip install -U -e "${PROJECT_PATH}"
+ elif [ -f "${PROJECT_PATH}/Pipfile" ]; then
+ echo "Found Pipfile"
+ installPipfileDeps
+ fi
+fi
+
bash docker-entrypoint.sh "$@"
diff --git a/docker/snyk_report.css b/docker/snyk_report.css
deleted file mode 100644
index 86202f197f..0000000000
--- a/docker/snyk_report.css
+++ /dev/null
@@ -1,263 +0,0 @@
-body {
- -moz-font-feature-settings: "pnum";
- -webkit-font-feature-settings: "pnum";
- font-variant-numeric: proportional-nums;
- display: flex;
- flex-direction: column;
- font-feature-settings: "pnum";
- font-size: 100%;
- line-height: 1.5;
- min-height: 100vh;
- -webkit-text-size-adjust: 100%;
- margin: 0;
- padding: 0;
- background-color: #F5F5F5;
- font-family: 'Arial', 'Helvetica', Calibri, sans-serif;
-}
-
-h1,
-h2,
-h3,
-h4,
-h5,
-h6 {
- font-weight: 500;
-}
-
-a,
-a:link,
-a:visited {
- border-bottom: 1px solid #4b45a9;
- text-decoration: none;
- color: #4b45a9;
-}
-
-a:hover,
-a:focus,
-a:active {
- border-bottom: 2px solid #4b45a9;
-}
-
-hr {
- border: none;
- margin: 1em 0;
- border-top: 1px solid #c5c5c5;
-}
-
-ul {
- padding: 0 1em;
- margin: 1em 0;
-}
-
-code {
- background-color: #EEE;
- color: #333;
- padding: 0.25em 0.5em;
- border-radius: 0.25em;
-}
-
-pre {
- background-color: #333;
- font-family: monospace;
- padding: 0.5em 1em 0.75em;
- border-radius: 0.25em;
- font-size: 14px;
-}
-
-pre code {
- padding: 0;
- background-color: transparent;
- color: #fff;
-}
-
-a code {
- border-radius: .125rem .125rem 0 0;
- padding-bottom: 0;
- color: #4b45a9;
-}
-
-a[href^="http://"]:after,
-a[href^="https://"]:after {
- background-image: linear-gradient(transparent,transparent),url("data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%20112%20109%22%3E%3Cg%20id%3D%22Page-1%22%20fill%3D%22none%22%20fill-rule%3D%22evenodd%22%3E%3Cg%20id%3D%22link-external%22%3E%3Cg%20id%3D%22arrow%22%3E%3Cpath%20id%3D%22Line%22%20stroke%3D%22%234B45A9%22%20stroke-width%3D%2215%22%20d%3D%22M88.5%2021l-43%2042.5%22%20stroke-linecap%3D%22square%22%2F%3E%3Cpath%20id%3D%22Triangle%22%20fill%3D%22%234B45A9%22%20d%3D%22M111.2%200v50L61%200z%22%2F%3E%3C%2Fg%3E%3Cpath%20id%3D%22square%22%20fill%3D%22%234B45A9%22%20d%3D%22M66%2015H0v94h94V44L79%2059v35H15V30h36z%22%2F%3E%3C%2Fg%3E%3C%2Fg%3E%3C%2Fsvg%3E");
- background-repeat: no-repeat;
- background-size: .75rem;
- content: "";
- display: inline-block;
- height: .75rem;
- margin-left: .25rem;
- width: .75rem;
-}
-
-
-/* Layout */
-
-[class*=layout-container] {
- margin: 0 auto;
- max-width: 71.25em;
- padding: 1.9em 1.3em;
- position: relative;
-}
-.layout-container--short {
- padding-top: 0;
- padding-bottom: 0;
-}
-
-.layout-container--short:after {
- display: block;
- content: "";
- clear: both;
-}
-
-/* Header */
-
-.header {
- padding-bottom: 1px;
-}
-
-.project__header {
- background-color: #4C4A73;
- color: #fff;
- margin-bottom: -1px;
- padding-top: 1em;
- padding-bottom: 0.25em;
- border-bottom: 2px solid #BBB;
-}
-
-.project__header__title {
- overflow-wrap: break-word;
- word-wrap: break-word;
- word-break: break-all;
- margin-bottom: .1em;
- margin-top: 0;
- float: left;
-}
-
-.timestamp {
- float: right;
- clear: none;
- margin-bottom: 0;
-}
-
-.meta-counts {
- clear: both;
- display: block;
- flex-wrap: wrap;
- justify-content: space-between;
- margin: 0 0 1.5em;
- color: #fff;
- clear: both;
- font-size: 1.1em;
-}
-
-.meta-count {
- display: block;
- flex-basis: 100%;
- margin: 0 1em 1em 0;
- float: left;
- padding-right: 1em;
- border-right: 2px solid #fff;
-}
-
-.meta-count:last-child {
- border-right: 0;
- padding-right: 0;
- margin-right: 0;
-}
-
-/* Card */
-
-.card {
- background-color: #fff;
- border: 1px solid #c5c5c5;
- border-radius: .25rem;
- margin: 0 0 2em 0;
- position: relative;
- min-height: 40px;
- padding: 1.5em;
-}
-
-.card .label {
- background-color: #767676;
- border: 2px solid #767676;
- color: white;
- padding: 0.25rem 0.75rem;
- font-size: 0.875rem;
- text-transform: uppercase;
- display: inline-block;
- margin: 0;
- border-radius: 0.25rem;
-}
-
-.card .label__text {
- vertical-align: text-top;
-}
-
-.card .label--high {
- background-color: #B51B72;
- border-color: #B51B72;
-}
-
-.card .label--medium {
- background-color: #E29022;
- border-color: #E29022;
-}
-
-.card .label--low {
- background-color: #222049;
- border-color: #222049;
-}
-
-.card .card.severity--low {
- border-color: #222049;
-}
-
-.card .card.severity--medium {
- border-color: #E29022;
-}
-
-.card .card.severity--high {
- border-color: #B51B72;
-}
-
-.card--vuln {
- padding-top: 4em;
- max-width: 48.75em;
-}
-
-.card--vuln .label {
- left: 0;
- position: absolute;
- top: 1.1em;
- padding-left: 1.9em;
- padding-right: 1.9em;
- border-radius: 0 0.25rem 0.25rem 0;
-}
-
-.card--vuln .card__section h2 {
- font-size: 22px;
- margin-bottom: 0.5em;
-}
-
-.card--vuln .card__section p {
- margin: 0 0 0.5em 0;
-}
-
-.card--vuln .card__meta {
- padding: 0 0 0 1em;
- margin: 0;
- font-size: 1.1em;
-}
-
-.card .card__meta__paths {
- font-size: 0.9em;
-}
-
-.card--vuln .card__title {
- font-size: 28px;
- margin-top: 0;
-}
-
-.card--vuln .card__cta p {
- margin: 0;
- text-align: right;
-}
diff --git a/help/README.md b/help/README.md
new file mode 100644
index 0000000000..1a912f4160
--- /dev/null
+++ b/help/README.md
@@ -0,0 +1,9 @@
+# CLI Help files
+
+Snyk CLI Help files are managed by GitBook connected to the [snyk/user-docs](https://github.com/snyk/user-docs) repository.
+
+It's recommended to make all CLI Help changes there. Changes from GitBook are automatically [synced to the Snyk CLI repository with a GitHub Action](https://github.com/snyk/snyk/actions/workflows/sync-cli-help-to-user-docs.yml). The Action creates a PR that needs to be approved and merged. This Action could also be manually triggered.
+
+If you need to make changes tied to a specific PR, you can make them in this repository first, merge the changes and then move them over to the GitBook.
+
+CLI help files are a standard Markdown.
diff --git a/help/_about-this-project/README.md b/help/_about-this-project/README.md
new file mode 100644
index 0000000000..da8fdbb79e
--- /dev/null
+++ b/help/_about-this-project/README.md
@@ -0,0 +1,4 @@
+# About Snyk CLI: Documenting design decisions
+
+- [Why is Snyk CLI bundling its dependencies?](why-we-are-bundling-dependencies.md)
+- [Snyk CLI PGP key](snyk-code-signing-public.pgp)
diff --git a/help/_about-this-project/snyk-code-signing-public.pgp b/help/_about-this-project/snyk-code-signing-public.pgp
new file mode 100644
index 0000000000..6f28702703
--- /dev/null
+++ b/help/_about-this-project/snyk-code-signing-public.pgp
@@ -0,0 +1,51 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGJmfEwBEADWBKcDoaf8cAnCg1FPcibCzEtKLts9GEpv1ekXi3BP+ZVqdY6/
+vPVznMPgSCDJz4kahDoX18mSZcxJUc6cgu1XPvGHhQE0rcvpUwnTTjnoo4vzvOAM
+SNvaVTmCwO6jYecj5HrBLpy5dhyGUc68GKcOB0CnmsQYFnHrnJOcGdB0AgKsL1Ll
+TZ3qZYe7vS/1i3RoPfoOx+jW8hHPqKltaSf7HRiWcTBpQg8rPjpBRPY/PtXklHy8
+ib76GzEYA7J/X4azBs6I08mSUoUWH0ATwNFSsnR6xN96kEA+d4cL8O9gL9SNpZRX
+X1FPZXfUr8KjS7X2VfDAhG/Ch+aKmTgJF3dIUGHwuegJlVYia32EV3uQH93qnFxA
+oIkP5muhDNNlZ0SDVQLRCTuC6TTKy36VoHNTj3XzUG3+q49RaSdHsp/f90A+caVy
+R6HgYJfcvBhdX7SC+aYpU822j/4SLi2L3K32j+qcIE8iEPR2LlgopEecHQmyI2G4
+0K5HUWaHJPu+EH0s4fsIZfZgESkLQhiBEIon2zTO7Zz8tWxVV0aR4/85Djnn5UUq
+h6efMw2g8WaUkRD3Djsi9CpepyKLakWH3+bBVnKzH8pWdGMa272wn9PVfeCwF8xq
+wICI/PPfN7d7RpULWjphzqeEl/ni0yUIiNPiwBlYH5fbpUlVpndWWXROZwARAQAB
+tCNTbnlrIExpbWl0ZWQgPGNvZGUtc2lnbmluZ0BzbnlrLmlvPokCTgQTAQoAOBYh
+BGi/vM63eU5vwGogRKKcMukfS5VpBQJiZnxMAhsDBQsJCAcDBRUKCQgLBRYCAwEA
+Ah4BAheAAAoJEKKcMukfS5VpeQ0P/j5CgXpwsx3De56+4tibEBqHLfv4wwWxBsoy
+Wv6L1BfgKyI0NSs1IUJSx5GdsXSwtU9Mp5PhBlVVA6U0SwOxt5ghRSf/kCvB1oP1
+Oo8W3dBl4Y4oWFlIM280t2v/PveBdB1nNiPxmAG1jHtoMqbHFkmZDFvroYFSj/rm
+FOe2qXOc/gwj5RUVVu+tTCPwCyCF9tBfqnbYbLjmI2z1om90uFqSOVDZJbUCY9ZK
+OR9Szu0/Jybg9/7VQ2BDRLi4LSRIASHOc4ZbHfX/44NZOODwzCme78MbbS9cFvRX
+SkFzH1I1yEqtCzCF23Nav/Dbemyhe2zi/Qhi/XCufOsg3tK3uSjWWqeIm5knP/IL
+MSdoEOxIkGZ+FHJ6yzO5r4bLYrfwWLrFI/k5dCGgzKiX76TwakqkcJ0NX5kSLdle
+O2HBSuuoPCLcX7QfPWh51CF/EZ6IV/Rmc+ZbyW2UbJ4FuYWsb9wMdSiaoi8TGiVt
+1snb9QRbTo3ZJWRN+pE4bW2UadieE8wfyHHVEMo5RQ49heaR0Q5VJkapnPWfKb1v
+3QTJh4L2Jju0cGQD+OtAvTQ005ZjG0ZXR4GiKArCUMebJRzNR3FFR/vyItP2lb31
+GwCObABWUtP4oCMRxTGHpGRNLJCmMvWIs1RejxB9Y7svU7fcF06jHF5UXke7NSOs
+fLaduZz2uQINBGJmfEwBEACpd4neyneH+/2d5KKQyXpPnPpCnxPIcQ9Ql4QyGuJB
+Em/PeVZDMaqpuQwNfFsPCjV1C9uF9VJfTlvQnXPqA/OndVaWbfBFqEtnS6RX4NHf
+FWIMcYibpg+3lHSY5iY4B4R/WIrlO021g3ULpsVL/Sz4Zz4drF2lZXgcGiBmiRVo
+JopU+KPUbjO0rFh927EYEJ80+LT0E4M+dJnEofGd5P0bTeQWNqoVABLAKql+erHX
+kBUrwMk8/ekdqfn5DYM31OR19Ogud/3cxsxOkhgvWWwUhtihu9NiqtO2y0c4ijHG
+WgWXjM3K2zs23f+pfNLfTtE8pkZw7Swmr0GRQ6Ikx9LqhdGPKqoALr8TqVUudZXU
+8clact0OtmHKASAI4bH51b3XSTmj1+v8g4/oEjukniuFm5Fave78Rh/EaO2IXjxc
+moCSCk6bK2YEM2fSjCuTVI9zm+CzyQ9MmvEJcR0vBCU2vHcrwKkvKXQIssePZT12
+B8IO9LT5jeVnFmtI+tLY2E/r7tqrmcgmHciAw0ugFGG7uYQivF21Mlqz72Dx+P0+
+WVch456NHUy26ALhAv8jU7OQprpzuRQOytYKiUK5GwrF91/6WmhYyIzlVFIYoqfQ
+s0WEu2apcPIx9OVtWoot8cynskneJ9s+EtPNF4T/Zh8YTCvGIhRy7Tvt6GbEnDQE
+UQARAQABiQI2BBgBCgAgFiEEaL+8zrd5Tm/AaiBEopwy6R9LlWkFAmJmfEwCGwwA
+CgkQopwy6R9LlWkJpg/+JWhBKpWJ9Kv4I0XWpMOlCzaKPk0TDqXpSPg+MWOGrv3i
+Q2Xeyi4HCy7oBISI1YpF4mJeaJikC1KQIikOmCKyj6kYj+WnHfjBUkplOKMe80ZU
+X5AZWsUfw2p1LJn0fCcdJrHDAn29R0abaoe9ExYPlXgFmBNoIQNvG/fMzwoIYmPO
+WsWPmqCzYQ7oCi4kOHhOo1isDlrunT0egSb6KXKdLPwn1u+rTQno1fBFQB/cY9s5
+F036QfVx0M4NdX8LzNQCObXZdln0PSqSNs7EXzHGv5ivuBZaFVsKv+HPSnaUng/M
+fyDZhOowNy6NEgB042lnOl0wO8JEm8Av1PC7y/1gTijAd1bFAjX7m0FqIfkJnhvY
+yGwSnGq4qXECpivBGA4Y2xUXURaSDNk8h1TjUT4366CGqSaVgTL5zZ2Jiu6rDozk
+9A4ur3GwldHpszUm3zAhDrjTHxDVFohhbBW9kmcQQmsz1PKiWMqCKT2V3J+Pn/HE
+VEu6go9VxdW4bZyb4Zc0ikB5T+FEuHOMK8QSeEfdWgzG87YJZkTCf5o90wl3A8YJ
+dvQcwQJsZ4FGInMk62VVyHrrJmD7W6+35/dLcAbrjMfrkR9FE97q3wRk4KkGPzDi
+r3OBWax7GYllVWd94kYFN4mRQxQISPRpO9yvH58WbsGxlymYr5lfibYI7AX+/B0=
+=vpdV
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/help/_about-this-project/why-we-are-bundling-dependencies.md b/help/_about-this-project/why-we-are-bundling-dependencies.md
new file mode 100644
index 0000000000..312876859c
--- /dev/null
+++ b/help/_about-this-project/why-we-are-bundling-dependencies.md
@@ -0,0 +1,11 @@
+# Why is Snyk CLI bundling its dependencies?
+
+Snyk CLI is a Node.js application that's distributed as a standalone executable or an [npm/yarn package](https://www.npmjs.com/package/snyk). Snyk CLI relies on many other npm packages, that are defined in the `package.json` manifest.
+
+Over the years we've run into multiple issues and limitations in the npm/yarn ecosystem. These caused a number of issues ranging from annoyances to outright security problems. The root cause for most of those was that npm packages installation does not respect lockfiles that are distributed with the package.
+
+Without a working lockfile, we couldn't control versions of dependencies that are installed with the Snyk CLI. When you ran `npm install snyk --global` on your machine, **you could end up with different and sometimes incompatible versions than those we tested the Snyk CLI with**. Things got even more complicated once you were installing Snyk CLI with a different npm version or yarn command or as a direct dependency into your project.
+
+This forced us to work on making Snyk CLI installations more predictable. We chose to use [Webpack](https://webpack.js.org) to bundle all the JavaScript code from the Snyk CLI, including the dependencies. This means Webpack will pick only the code that's required for the CLI and create a JavaScript **bundle**. This bundle is self-contained. This improved our testing, as we can rely on a single artifact that gets built, regardless of installation method and environment. As a result, when publishing the CLI we don't declare any dependencies in `package.json` as they are already included in the published bundle.
+
+Another major win is a much [smaller distribution and faster Snyk CLI installation](https://updates.snyk.io/smaller-and-faster-cli!-206415). E.g., a Windows npm installation took about 2-3 minutes. After bundling was released it takes a few seconds.
diff --git a/help/api-license.txt b/help/api-license.txt
deleted file mode 100644
index 03afde9d27..0000000000
--- a/help/api-license.txt
+++ /dev/null
@@ -1 +0,0 @@
-The use of Snyk's API, whether through the use of the 'snyk' npm package or otherwise, is subject to the terms & conditions specified here: https://snyk.io/policies
diff --git a/help/cli-commands/README.md b/help/cli-commands/README.md
new file mode 100644
index 0000000000..3f6795407d
--- /dev/null
+++ b/help/cli-commands/README.md
@@ -0,0 +1,69 @@
+# CLI help
+
+Snyk CLI scans and monitors your projects for security vulnerabilities and license issues.
+
+For more information visit the [Snyk website](https://snyk.io)
+
+For details see the [CLI documentation](https://docs.snyk.io/features/snyk-cli)
+
+## How to get started
+
+1. Authenticate by running `snyk auth`
+2. Test your local project with `snyk test`
+3. Get alerted for new vulnerabilities with `snyk monitor`
+
+## Available commands
+
+To learn more about each Snyk CLI command, use the `--help` option, for example, `snyk auth --help` or `snyk container --help`
+
+**Note:** The help on the docs site is the same as the `--help` in the CLI.
+
+### [`snyk auth`](auth.md)
+
+Authenticate Snyk CLI with a Snyk account.
+
+### [`snyk test`](test.md)
+
+Test a project for open source vulnerabilities and license issues.
+
+**Note**: Use `snyk test --unmanaged` to scan all files for known open source dependencies (C/C++ only).
+
+### [`snyk monitor`](monitor.md)
+
+Snapshot and continuously monitor a project for open source vulnerabilities and license issues.
+
+### [`snyk container`](container.md)
+
+Test container images for vulnerabilities.
+
+### [`snyk iac`](iac.md)
+
+Commands to find and manage security issues in Infrastructure as Code files.
+
+### [`snyk code`](code.md)
+
+Find security issues using static code analysis.
+
+### [`snyk log4shell`](log4shell.md)
+
+Find Log4Shell vulnerability.
+
+### [`snyk config`](config.md)
+
+Manage Snyk CLI configuration.
+
+### [`snyk policy`](policy.md)
+
+Display the `.snyk` policy for a package.
+
+### [`snyk ignore`](ignore.md)
+
+Modify the `.snyk` policy to ignore stated issues.
+
+## Debug
+
+Use `-d` option to output the debug logs.
+
+## Configure the Snyk CLI
+
+You can use environment variables to configure the Snyk CLI and also set variables to configure the Snyk CLI to connect with the Snyk API. See [Configure the Snyk CLI](https://docs.snyk.io/features/snyk-cli/configure-the-snyk-cli)
diff --git a/help/cli-commands/apps.md b/help/cli-commands/apps.md
new file mode 100644
index 0000000000..f8f6fb19e5
--- /dev/null
+++ b/help/cli-commands/apps.md
@@ -0,0 +1,55 @@
+# snyk apps -- Create and manage your Snyk Apps
+
+# Usage
+
+`snyk apps []`
+
+## Description
+
+Snyk Apps are integrations that extend the functionality of the Snyk platform. They provide you with an opportunity to mould your Snyk experience to suit your specific needs.
+
+[For more information see our user docs](https://docs.snyk.io/features/integrations/snyk-apps)
+
+## Commands
+
+**_Note: All `apps` commands are only accessible behind the `--experimental` flag and the behaviour can change at any time, without prior notice. You are kindly advised to use all the commands with caution_**
+
+### `create`
+
+Create a new Snyk App.
+
+## Options
+
+### `--interactive`
+
+Use the command in interactive mode.
+
+### `--org=`
+
+(Required for the `create` command)
+Specify the `` to create the Snyk App under.
+
+### `--name=`
+
+(Required for the `create` command)
+The name of Snyk App that will be displayed to the user during the authentication flow.
+
+### `--redirect-uris=`
+
+(Required for the `create` command)
+A comma separated list of redirect URIs. This will form a list of allowed redirect URIs to call back after authentication.
+
+### `--scopes=`
+
+(Required for the `create` command)
+A comma separated list of scopes required by your Snyk App. This will form a list of scopes that your app is allowed to request during authorization. You can read more about the allowed scopes in our [docs](https://docs.snyk.io/snyk-apps/getting-started-with-snyk-apps/create-an-app-via-the-api#requesting-scopes).
+
+## Examples
+
+### `Create Snyk App`
+
+\$ snyk apps create --experimental --org=48ebb069-472f-40f4-b5bf-d2d103bc02d4 --name='My Awesome App' --redirect-uris=https://example1.com,https://example2.com --scopes=org.read,org.report.read
+
+### `Create Snyk App Interactive Mode`
+
+\$ snyk apps create --experimental --interactive
diff --git a/help/cli-commands/auth.md b/help/cli-commands/auth.md
new file mode 100644
index 0000000000..ce4dabc189
--- /dev/null
+++ b/help/cli-commands/auth.md
@@ -0,0 +1,27 @@
+# Auth
+
+## Usage
+
+`snyk auth [] []`
+
+## Description
+
+The `snyk auth` command authenticates your machine to associate the Snyk CLI with your Snyk account.
+
+Running `$ snyk auth` opens a browser window with prompts to log in to your Snyk account and authenticate. No repository permissions are needed at this stage, only your email address.
+
+When you have authenticated you can start using the CLI; see [Getting started with the CLI](https://docs.snyk.io/snyk-cli/getting-started-with-the-cli)
+
+## Value
+
+In some environments and configurations you must use the ``; see [Authenticate the CLI with your account](https://docs.snyk.io/features/snyk-cli/authenticate-the-cli-with-your-account)
+
+The value may be a user token or a service account; see [Service accounts](https://docs.snyk.io/features/integrations/managing-integrations/service-accounts)
+
+In a CI/CD environment use the `SNYK_TOKEN` environment variable; see [Configure the Snyk CLI](https://docs.snyk.io/features/snyk-cli/configure-the-snyk-cli)
+
+After setting this environment variable you can use CLI commands.
+
+## Debug
+
+Use the `-d` option to output the debug logs.
diff --git a/help/cli-commands/code.md b/help/cli-commands/code.md
new file mode 100644
index 0000000000..8580643ae0
--- /dev/null
+++ b/help/cli-commands/code.md
@@ -0,0 +1,80 @@
+# Code
+
+## Usage
+
+`snyk code [] [] []`
+
+## Description
+
+The `snyk code` command finds security issues using Static Code Analysis.
+
+For more information see [CLI for Snyk Code](https://docs.snyk.io/snyk-code/cli-for-snyk-code)
+
+## Subcommand: `test`
+
+Test for any known issue.
+
+## Exit codes
+
+Possible exit codes and their meaning:
+
+**0**: success, no vulnerabilities found\
+**1**: action_needed, vulnerabilities found\
+**2**: failure, try to re-run command\
+**3**: failure, no supported projects detected
+
+## Configure the Snyk CLI
+
+You can use environment variables to configure the Snyk CLI and set variables for connecting with the Snyk API; see [Configure the Snyk CLI](https://docs.snyk.io/features/snyk-cli/configure-the-snyk-cli)
+
+## Debug
+
+Use the `-d` option to output the debug logs.
+
+## Options for the code test subcommand
+
+### `--org=`
+
+Specify the ``to run Snyk commands tied to a specific organization. The `` influences private test limits.
+
+If you have multiple organizations, you can set a default from the CLI using:
+
+`$ snyk config set org=`
+
+Set a default to ensure all newly tested projects are tested under your default organization. If you need to override the default, use the `--org=` option.
+
+Default: `` that is the current preferred organization in your [Account settings](https://app.snyk.io/account)
+
+Note that you can also use `--org=`. The `ORG_ID` works in both the CLI and the API. The organization slug name works in the CLI, but not in the API.
+
+For more information see the article [How to select the organization to use in the CLI](https://support.snyk.io/hc/en-us/articles/360000920738-How-to-select-the-organization-to-use-in-the-CLI)
+
+### `--json`
+
+Print results in JSON format.
+
+Example: `$ snyk code test --json`
+
+### `--json-file-output=`
+
+Save test output in JSON format directly to the specified file, regardless of whether or not you use the `--json` option.
+
+This is useful if you want to display the human-readable test output using stdout and at the same time save the JSON format output to a file.
+
+Example: `$ snyk code test --json-file-output=vuln.json`
+
+### `--sarif`
+
+Return results in SARIF format.
+
+Example: `$ snyk code --sarif`
+
+### `--sarif-file-output=`
+
+Save test output in SARIF format directly to the \ file, regardless of whether or not you use the `--sarif` option.
+
+This is especially useful if you want to display the human-readable test output using stdout and at the same time save the SARIF format output to a file.
+
+### `--severity-threshold=`
+
+Report only vulnerabilities at the specified level or higher. Note that the Snyk Code configuration issues do not currently use the `critical` severity level.
diff --git a/help/cli-commands/config.md b/help/cli-commands/config.md
new file mode 100644
index 0000000000..76b33f83cb
--- /dev/null
+++ b/help/cli-commands/config.md
@@ -0,0 +1,61 @@
+# Config
+
+## Usage
+
+`snyk config []`
+
+## Description
+
+The `snyk config` command manages your local Snyk CLI config file, a JSON file located at `$XDG_CONFIG_HOME` or `~/.config` followed by `configstore/snyk.json`
+
+Example: `~/.config/configstore/snyk.json`
+
+This command does not manage the `.snyk` file that is part of your project. See the [`snyk policy`](policy.md) and [`snyk ignore`](ignore.md) commands.
+
+## Debug
+
+Use the `-d` option to output the debug logs.
+
+## Subcommands
+
+### `get `
+
+Print a config value.
+
+### `set =`
+
+Create a new config value.
+
+### `unset `
+
+Remove a config value.
+
+### `clear`
+
+Remove all config values.
+
+## Supported `` values
+
+### `api`
+
+API token to use when calling Snyk API.
+
+### `endpoint`
+
+Define the API endpoint to use.
+
+### `disable-analytics`
+
+Turn off analytics reporting.
+
+### `oci-registry-url`
+
+Configure the OCI registry used in IaC scanning with custom rules.
+
+### `oci-registry-username`
+
+Configure the username for an OCI registry used in IaC scanning with custom rules.
+
+### `oci-registry-password`
+
+Configure the password for an OCI registry used in IaC scanning with custom rules.
diff --git a/help/cli-commands/container-monitor.md b/help/cli-commands/container-monitor.md
new file mode 100644
index 0000000000..d4ab3faff6
--- /dev/null
+++ b/help/cli-commands/container-monitor.md
@@ -0,0 +1,137 @@
+# Container monitor
+
+## Usage
+
+`snyk container monitor [] []`
+
+## Description
+
+The `snyk container monitor` command captures the container image layers and dependencies and monitor for vulnerabilities on [snyk.io](https://snyk.io)
+
+For more information see [Snyk CLI for container security](https://docs.snyk.io/products/snyk-container/snyk-cli-for-container-security)
+
+## Exit codes
+
+Possible exit codes and their meaning:
+
+**0**: success, image layers and dependencies captured\
+**2**: failure, try to re-run command\
+**3**: failure, no supported projects detected
+
+## Configure the Snyk CLI
+
+You can use environment variables to configure the Snyk CLI and set variables for connecting with the Snyk API.
+
+There are environment variables that apply to the container command; see [Configure the Snyk CLI](https://docs.snyk.io/features/snyk-cli/configure-the-snyk-cli)
+
+## Debug
+
+Use the `-d` option to output the debug logs.
+
+## Options
+
+### `--org=`
+
+Specify the `` to run Snyk commands tied to a specific organization. The `` influences some features availability and private test limits.
+
+If you have multiple organizations, you can set a default from the CLI using:
+
+`$ snyk config set org=`
+
+Set a default to ensure all newly tested and monitored projects are tested and monitored under your default organization. If you need to override the default, use the `--org=` option.
+
+Default: `` that is the current preferred organization in your [Account settings](https://app.snyk.io/account)
+
+Note that you can also use `--org=`. The `ORG_ID` works in both the CLI and the API. The organization slug name works in the CLI, but not in the API.
+
+For more information see the article [How to select the organization to use in the CLI](https://docs.snyk.io/snyk-cli/test-for-vulnerabilities/how-to-select-the-organization-to-use-in-the-cli)
+
+### `--file=`
+
+For more detailed advice, include the path to the Dockerfile for the image.
+
+### `--project-name=`
+
+Specify a custom Snyk project name.
+
+### `--policy-path=`
+
+Manually pass a path to a `.snyk` policy file.
+
+### `--json`
+
+Print results in JSON format, useful for integrating with other tools
+
+Example: `$ snyk container test --json`
+
+### `--project-environment=[,]...>`
+
+Set the project environment to one or more values (comma-separated). To clear the project environment set `--project-environment=`
+
+Allowed values: `frontend`, `backend`, `internal`, `external`, `mobile`, `saas`, `onprem`, `hosted`, `distributed`
+
+For more information see [Project attributes](https://docs.snyk.io/getting-started/introduction-to-snyk-projects/view-project-information/project-attributes)
+
+### `--project-lifecycle=[,`
+
+Set the project lifecycle to one or more values (comma-separated). To clear the project lifecycle set `--project-lifecycle=`
+
+Allowed values: `production, development, sandbox`
+
+For more information see [Project attributes](https://docs.snyk.io/getting-started/introduction-to-snyk-projects/view-project-information/project-attributes)
+
+### `--project-business-criticality=[,]...>`
+
+Set the project business criticality to one or more values (comma-separated). To clear the project business criticality set `--project-business-criticality=`
+
+Allowed values: `critical`, `high`, `medium`, `low`
+
+For more information see [Project attributes](https://docs.snyk.io/getting-started/introduction-to-snyk-projects/view-project-information/project-attributes)
+
+### `--project-tags=[,]...>`
+
+Set the project tags to one or more values (comma-separated key values pairs with an "=" separator).
+
+Example: `--project-tags=department=finance,team=alpha`
+
+To clear the project tags set `--project-tags=`
+
+### `--tags=[,]...>`
+
+This is an alias for `--project tags`
+
+### `--app-vulns`
+
+Allow detection of vulnerabilities in your application dependencies from container images, as well as from the operating system, all in one single scan.
+
+In CLI version 1.962.0 and higher, use the `--app-vulns` option with the the `--json` option to see the operating system as well as application vulnerabilities in JSON format in the results.
+
+For more information see [Detecting application vulnerabilities in container images](https://docs.snyk.io/products/snyk-container/getting-around-the-snyk-container-ui/detecting-application-vulnerabilities-in-container-images)
+
+### `--nested-jars-depth`
+
+When using `--app-vulns` use the `--nested-jars-depth` option to set how many levels of nested jars Snyk is to unpack. Depth must be a number.
+
+### `--exclude-base-image-vulns`
+
+Do not show vulnerabilities introduced only by the base image. Available when using `snyk container test` only.
+
+### `--platform=`
+
+For multi-architecture images, specify the platform to test.
+
+Supported platforms are: `linux/amd64`, `linux/arm64`, `linux/riscv64`, `linux/ppc64le`, `linux/s390x`, `linux/386`, `linux/arm/v7`, or `linux/arm/v6`
+
+### `--username=`
+
+Specify a username to use when connecting to a container registry. This is ignored in favor of local Docker binary credentials when Docker is present.
+
+### `--password=`
+
+Specify a password to use when connecting to a container registry. This is ignored in favor of local Docker binary credentials when Docker is present.
+
+## Example for the container monitor command
+
+**Scan and monitor Docker images**
+
+`$ snyk container monitor `
diff --git a/help/cli-commands/container-test.md b/help/cli-commands/container-test.md
new file mode 100644
index 0000000000..75c7e177f4
--- /dev/null
+++ b/help/cli-commands/container-test.md
@@ -0,0 +1,149 @@
+# Container test
+
+## Usage
+
+`snyk container test [] []`
+
+## Description
+
+The `snyk container test` command tests container images for any known vulnerabilities.
+
+For more information see [Snyk CLI for container security](https://docs.snyk.io/products/snyk-container/snyk-cli-for-container-security)
+
+## Exit codes
+
+Possible exit codes and their meaning:
+
+**0**: success, no vulnerabilities found\
+**1**: action_needed, vulnerabilities found\
+**2**: failure, try to re-run command\
+**3**: failure, no supported projects detected
+
+## Configure the Snyk CLI
+
+You can use environment variables to configure the Snyk CLI and set variables for connecting with the Snyk API.
+
+There are environment variables that apply to the container command; see [Configure the Snyk CLI](https://docs.snyk.io/features/snyk-cli/configure-the-snyk-cli)
+
+## Debug
+
+Use the `-d` option to output the debug logs.
+
+## Options
+
+### `--print-deps`
+
+Print the dependency tree before sending it for analysis.
+
+### `--org=`
+
+Specify the `` to run Snyk commands tied to a specific organization. The `` influences some features availability and private test limits.
+
+If you have multiple organizations, you can set a default from the CLI using:
+
+`$ snyk config set org=`
+
+Set a default to ensure all newly tested and monitored projects are tested and monitored under your default organization. If you need to override the default, use the `--org=` option.
+
+Default: `` that is the current preferred organization in your [Account settings](https://app.snyk.io/account)
+
+Note that you can also use `--org=`. The `ORG_ID` works in both the CLI and the API. The organization slug name works in the CLI, but not in the API.
+
+For more information see the article [How to select the organization to use in the CLI](https://docs.snyk.io/snyk-cli/test-for-vulnerabilities/how-to-select-the-organization-to-use-in-the-cli)
+
+### `--file=`
+
+For more detailed advice, include the path to the Dockerfile for the image.
+
+### `--project-name=`
+
+Specify a custom Snyk project name.
+
+### `--policy-path=`
+
+Manually pass a path to a `.snyk` policy file.
+
+### `--json`
+
+Print results in JSON format, useful for integrating with other tools
+
+Example: `$ snyk container test --json`
+
+### `--json-file-output=`
+
+Save test output in JSON format directly to the specified file, regardless of whether or not you use the `--json` option.
+
+This is especially useful if you want to display the human-readable test output using stdout and at the same time save the JSON format output to a file.
+
+Example: `$ snyk container test --json-file-output=vuln.json`
+
+### `--sarif`
+
+Return results in SARIF format. Note this requires the test to be run with `--file` as well.
+
+### `--sarif-file-output=`
+
+Save test output in SARIF format directly to the `` file, regardless of whether or not you use the `--sarif` option.
+
+This is especially useful if you want to display the human-readable test output using stdout and at the same time save the SARIF format output to a file.
+
+### `--severity-threshold=`
+
+Report only vulnerabilities at the specified level or higher.
+
+### `--fail-on=`
+
+Fail only when there are vulnerabilities that can be fixed.
+
+- `all`: fail when there is at least one vulnerability that can be either upgraded or patched.
+- `upgradable`: fail when there is at least one vulnerability that can be upgraded.
+
+To fail on any vulnerability (the default behavior), do not use the `--fail-on` option. If vulnerabilities do not have a fix and this option is being used, tests pass.
+
+### `--app-vulns`
+
+Allow detection of vulnerabilities in your application dependencies from container images, as well as from the operating system, all in one single scan.
+
+In CLI version 1.962.0 and higher, use the `--app-vulns` option with the the `--json` option to see the operating system as well as application vulnerabilities in JSON format in the results.
+
+For more information see [Detecting application vulnerabilities in container images](https://docs.snyk.io/products/snyk-container/getting-around-the-snyk-container-ui/detecting-application-vulnerabilities-in-container-images)
+
+### `--nested-jars-depth`
+
+When using `--app-vulns` use the `--nested-jars-depth` option to set how many levels of nested jars Snyk is to unpack. Depth must be a number.
+
+### `--exclude-base-image-vulns`
+
+Do not show vulnerabilities introduced only by the base image. Available when using `snyk container test` only.
+
+### `--platform=`
+
+For multi-architecture images, specify the platform to test.
+
+Supported platforms are: `linux/amd64`, `linux/arm64`, `linux/riscv64`, `linux/ppc64le`, `linux/s390x`, `linux/386`, `linux/arm/v7`, or `linux/arm/v6`
+
+### `--username=`
+
+Specify a username to use when connecting to a container registry. This is ignored in favor of local Docker binary credentials when Docker is present.
+
+### `--password=`
+
+Specify a password to use when connecting to a container registry. This is ignored in favor of local Docker binary credentials when Docker is present.
+
+## Examples for the container test command
+
+### Scan Docker images
+
+`$ snyk container test `
+
+### Option to get more information including base image remediation
+
+`--file=path/to/Dockerfile`
+
+### Scan a Docker image created using the given Dockerfile and with a specified policy path
+
+`$ snyk container test app:latest --file=Dockerfile`
+
+`$ snyk container test app:latest --file=Dockerfile --policy-path=path/to/.snyk`
+
+For more information and examples see [Advanced Snyk Container CLI usage](https://docs.snyk.io/snyk-container/snyk-cli-for-container-security/advanced-snyk-container-cli-usage)
diff --git a/help/cli-commands/container.md b/help/cli-commands/container.md
new file mode 100644
index 0000000000..f55381b712
--- /dev/null
+++ b/help/cli-commands/container.md
@@ -0,0 +1,18 @@
+# Container
+
+## Usage
+
+`snyk container [] []`
+
+## Description
+
+The `snyk container` commands test and continuously monitor container images for vulnerabilities.
+
+For more information see [Snyk CLI for container security](https://docs.snyk.io/products/snyk-container/snyk-cli-for-container-security)
+
+## `snyk container` commands and the help docs
+
+The `snyk container` commands are listed here with the help options:
+
+- ``[`container test`](container-test.md), `container test --help`: tests for any known vulnerabilities
+- ``[`container monitor`](container-monitor.md), `container monitor --help`: captures the container image layers and dependencies and monitors for vulnerabilities on [snyk.io](https://snyk.io)
diff --git a/help/cli-commands/iac-describe.md b/help/cli-commands/iac-describe.md
new file mode 100644
index 0000000000..87604e69f9
--- /dev/null
+++ b/help/cli-commands/iac-describe.md
@@ -0,0 +1,217 @@
+# IaC describe
+
+## Usage
+
+**Note:** This feature is available in Snyk CLI version v1.876.0 or greater.
+
+`snyk iac describe []`
+
+## Description
+
+The `snyk iac describe` command detects infrastructure drift and unmanaged resources. It compares resources in your Terraform state file against actual resources in your cloud provider and outputs a report.
+
+- Resources in your Terraform state files are **managed resources**.
+- Changes to managed resources not reflected in the Terraform state file are **drifts**.
+- Resources that exist but are not in your Terraform state file are **unmanaged resources**.
+
+For detailed information and examples, see [IaC describe command examples](https://docs.snyk.io/products/snyk-infrastructure-as-code/detect-drift-and-manually-created-resources/iac-describe-command-examples)
+
+For a list of related commands see the snyk [iac help](iac.md); `iac --help`
+
+## Exit codes
+
+Possible exit codes and their meaning:
+
+**0**: success, no drift found\
+**1**: drifts or unmanaged resources found\
+**2**: failure
+
+## Configure the Snyk CLI
+
+You can use environment variables and set variables for connecting with the Snyk API; see [Configure the Snyk CLI](https://docs.snyk.io/snyk-cli/configure-the-snyk-cli)
+
+## Configure the Terraform provider
+
+You can set environment variables to configure the Terraform provider used by the `describe` command; see [Configure cloud providers](https://docs.snyk.io/products/snyk-infrastructure-as-code/detect-drift-and-manually-created-resources/configure-cloud-providers)
+
+## Debug
+
+Use the `-d` option to output the debug logs.
+
+## Required options
+
+**Note:** To use the `describe` command, you **must use one of these options**:
+
+### `--only-unmanaged`
+
+Report resources not found in any Terraform states.
+
+### `--only-managed` or `--drift`
+
+Scan managed resources found in Terraform states for changes.
+
+### `--all`
+
+Scan both managed and unmanaged resources.
+
+## Optional arguments
+
+### `--org=`
+
+Specify the `` to run Snyk commands tied to a specific organization. Overrides the default `` that is the current preferred organization in your [Account settings](https://app.snyk.io/account)
+
+Note that you can also use `--org=`. The `ORG_ID` works in both the CLI and the API. The organization slug name works in the CLI, but not in the API.
+
+For more information see the article [How to select the organization to use in the CLI](https://support.snyk.io/hc/en-us/articles/360000920738-How-to-select-the-organization-to-use-in-the-CLI)
+
+### `--from=[,...]`
+
+Specify multiple Terraform state files to be read. Glob patterns are supported.
+
+For more information including **a list of supported IaC sources** and how to use them, see [IAC Sources usage](https://docs.snyk.io/products/snyk-infrastructure-as-code/detect-drift-and-manually-created-resources/iac-sources-usage)
+
+### `--to=`
+
+Specify the cloud provider to scan (default: AWS with Terraform).
+
+Supported providers:
+
+- `github+tf` (GitHub with Terraform)
+- `aws+tf` (Amazon Web Services with Terraform)
+- `gcp+tf` (Google Cloud Platform with Terraform)
+- `azure+tf` (Azure with Terraform)
+
+### `--tf-provider-version`
+
+Specify a Terraform provider version to use. If none is specified, default versions are used as follows:
+
+- aws@3.19.0
+- github@4.4.0
+- google@3.78.0
+- azurerm@2.71.0
+
+### `--tf-lockfile`
+
+Read the Terraform lock file (`.terraform.lock.hcl`) from a custom path (default: current directory).
+
+If parsing the lockfile fails, errors are logged and scan continues.
+
+**Note**: When you are using both the `--tf-lockfile` and `--tf-provider-version` options together, `--tf-provider-version` takes precedence.
+
+### `--fetch-tfstate-headers`
+
+Use a specific HTTP header or headers for the HTTP backend when fetching Terraform state.
+
+### `--tfc-token`
+
+Specify an API token to authenticate to the Terraform Cloud or Enterprise API.
+
+### `--tfc-endpoint`
+
+Read the current state for a given workspace from Terraform Enterprise by passing the `tfc-endpoint` value that is specific to your org's Terraform Enterprise installation.
+
+### `--config-dir`
+
+Change the directory path used for `iac describe` configuration (default `$HOME`). This can be useful, for example, if you want to invoke this command in an AWS Lambda function where you can only use the `/tmp` folder.
+
+## Options for including and excluding resources
+
+### `--service=[,...]`
+
+Specify the services whose resources are inspected for drift or unmanaged resources.
+
+This option cannot be used with a `.snyk` drift ignore rule; the content in `.snyk` will be ignored.
+
+Supported services: `aws_s3`, `aws_ec2`, `aws_lambda`, `aws_rds`, `aws_route53`, `aws_iam` , `aws_vpc`, `aws_api_gateway`, `aws_apigatewayv2`, `aws_sqs`, `aws_sns`, `aws_ecr`, `aws_cloudfront`, `aws_kms`, `aws_dynamodb`, `azure_base`, `azure_compute`, `azure_storage`, `azure_network`, `azure_container`, `azure_database`, `azure_loadbalancer`, `azure_private_dns`, `google_cloud_platform`, `google_cloud_storage`, `google_compute_engine`, `google_cloud_dns`, `google_cloud_bigtable`, `google_cloud_bigquery`, `google_cloud_functions`, `google_cloud_sql`, `google_cloud_run`
+
+### `--filter`
+
+Use filter rules.
+
+Filter rules allow you to build a JMESPath expression to include or exclude a set of resources from the report.
+
+To filter on resource attributes, deep mode must be enabled. Deep mode is enabled by default for `--all` and `--only-managed`. To enable deep mode while using `--only-unmanaged`, use the `--deep` option.
+
+For more information see [Filter results](https://docs.snyk.io/products/snyk-infrastructure-as-code/detect-drift-and-manually-created-resources/filter-results)
+
+### `--deep`
+
+Enable deep mode. Deep mode enables you to use the `--filter` option to include or exclude resources in the report based on their attributes.
+
+Deep mode is enabled by default for `--all` and `--only-managed`. Use `--deep` if you want to filter on attributes while using `--only-unmanaged`.
+
+For more information see [Filter results](https://docs.snyk.io/products/snyk-infrastructure-as-code/detect-drift-and-manually-created-resources/filter-results)
+
+### `--strict`
+
+Enable strict mode.
+
+The `iac describe` command ignores service-linked resources by default (like service-linked AWS IAM roles, their policies and policy attachments). To include those resources in the report you can enable **strict mode**. Note that this can create noise when used with an AWS account.
+
+## Options for policies
+
+### `--ignore-policy`
+
+Ignore all set policies, the current policy in the `.snyk` file, org level ignores, and the project policy in the Snyk Web UI.
+
+### `--policy-path=`
+
+Manually pass a path to a `.snyk` policy file.
+
+## Options for output
+
+### `--quiet`
+
+Output only the scan result to stdout.
+
+### `--json`
+
+Output the report as JSON to stdout.
+
+### `--html`
+
+Output the report as html to stdout.
+
+### `--html-file-output=`
+
+Output the report as html into a file.
+
+## Examples for snyk iac describe command
+
+For more examples, see [IaC describe command examples](https://docs.snyk.io/products/snyk-infrastructure-as-code/detect-drift-and-manually-created-resources/iac-describe-command-examples)
+
+### Detect drift and unmanaged resources on AWS with a single local Terraform state
+
+```
+$ snyk iac describe --all --from="tfstate://terraform.tfstate"
+```
+
+### Specify AWS credentials
+
+```
+$ AWS_ACCESS_KEY_ID=XXX AWS_SECRET_ACCESS_KEY=XXX snyk iac describe --all
+```
+
+### Use an AWS named profile
+
+```
+$ AWS_PROFILE=profile_name snyk iac describe --all
+```
+
+### Use a single Terraform state stored on an S3 backend
+
+```
+$ snyk iac describe --from="tfstate+s3://my-bucket/path/to/state.tfstate"
+```
+
+### Aggregate multiple Terraform states
+
+```
+$ snyk iac describe --all --from="tfstate://terraform_S3.tfstate,tfstate://terraform_VPC.tfstate"
+```
+
+### Aggregate many Terraform states, using glob pattern
+
+```
+$ snyk iac describe --all --from="tfstate://path/to/**/*.tfstate"
+```
diff --git a/help/cli-commands/iac-report.md b/help/cli-commands/iac-report.md
new file mode 100644
index 0000000000..2cf65c714f
--- /dev/null
+++ b/help/cli-commands/iac-report.md
@@ -0,0 +1,15 @@
+# IAC report
+
+## Usage
+
+`snyk iac report []`
+
+## Description
+
+Test for any known security issue and share results to the Snyk App.
+
+This is an alias for `snyk iac test --report`.
+
+For more information see the [iac test command help](iac-test.md) for the `--report` option; `iac test --help`
+
+For a list of related commands see the [snyk iac](iac.md) help; `iac --help`
diff --git a/help/cli-commands/iac-test.md b/help/cli-commands/iac-test.md
new file mode 100644
index 0000000000..10fc6a6be1
--- /dev/null
+++ b/help/cli-commands/iac-test.md
@@ -0,0 +1,246 @@
+# IaC test
+
+## Usage
+
+`snyk iac test [] []`
+
+## Description
+
+The `snyk iac test` command tests for any known security issue.
+
+For a list of related commands see the [snyk iac](iac.md) help; `iac --help`
+
+For more information see [Snyk CLI for Infrastructure as Code](https://docs.snyk.io/products/snyk-infrastructure-as-code/snyk-cli-for-infrastructure-as-code)
+
+## Exit codes
+
+Possible exit codes and their meaning:
+
+**0**: success, no vulnerabilities found\
+**1**: action_needed, vulnerabilities found\
+**2**: failure, try to re-run command\
+**3**: failure, no supported projects detected
+
+## Configure the Snyk CLI
+
+You can use environment variables to configure the Snyk CLI and set variables for connecting with the Snyk API. See [Configure the Snyk CLI](https://docs.snyk.io/snyk-cli/configure-the-snyk-cli)
+
+## Debug
+
+Use the `-d` option to output the debug logs.
+
+## Options
+
+### `--detection-depth=`
+
+Use to indicate how many subdirectories to search. `DEPTH` must be a number, 1 or greater; zero (0) is the current directory.
+
+Default: no limit.
+
+Example: `--detection-depth=3` limits search to the specified directory (or the current directory if no `` is specified) plus three levels of subdirectories; zero (0) is the current directory.
+
+### `--org=`
+
+Specify the `` to run Snyk commands tied to a specific organization. The `` influences private test limits.
+
+If you have multiple organizations, you can set a default from the CLI using:
+
+`$ snyk config set org=`
+
+Set a default to ensure all newly tested projects are tested under your default organization. If you need to override the default, use the `--org=` option.
+
+Default: `` that is the current preferred organization in your [Account settings](https://app.snyk.io/account)
+
+Note that you can also use `--org=`. The `ORG_ID` works in both the CLI and the API. The organization slug name works in the CLI, but not in the API.
+
+For more information see the article [How to select the organization to use in the CLI](https://support.snyk.io/hc/en-us/articles/360000920738-How-to-select-the-organization-to-use-in-the-CLI)
+
+### `--ignore-policy`
+
+Ignore all set policies, the current policy in the `.snyk` file, org level ignores, and the project policy on snyk.io.
+
+### `--policy-path=`
+
+Manually pass a path to a `.snyk` policy file.
+
+### `--json`
+
+Print results in JSON format.
+
+Example: `$ snyk iac test --json`
+
+### `--json-file-output=`
+
+Save test output in JSON format directly to the specified file, regardless of whether or not you use the `--json` option.
+
+This is especially useful if you want to display the human-readable test output using stdout and at the same time save the JSON format output to a file.
+
+Example: `$ snyk iac test --json-file-output=vuln.json`
+
+### `--sarif`
+
+Return results in SARIF format.
+
+### `--sarif-file-output=`
+
+Save test output in SARIF format directly to the \ file, regardless of whether or not you use the `--sarif` option.
+
+This is especially useful if you want to display the human-readable test output using stdout and at the same time save the SARIF format output to a file.
+
+### `--project-business-criticality=[,]...>`
+
+This can be used in combination with the `--report` option.
+
+Set the project business criticality project attribute to one or more values (comma-separated). To clear the project business criticality set `--project-business-criticality=`
+
+Allowed values: `critical, high, medium, low`
+
+For more information see [Project attributes](https://docs.snyk.io/getting-started/introduction-to-snyk-projects/view-project-information/project-attributes)
+
+### `--project-environment=[,]...>`
+
+This can be used in combination with the `--report` option.
+
+Set the project environment project attribute to one or more values (comma-separated). To clear the project environment set `--project-environment=`
+
+Allowed values: `frontend`, `backend`, `internal`, `external`, `mobile`, `saas`, `onprem`, `hosted`, `distributed`
+
+For more information see [Project attributes](https://docs.snyk.io/getting-started/introduction-to-snyk-projects/view-project-information/project-attributes)
+
+### `--project-lifecycle=[,]...>`
+
+This can be used in combination with the `--report` option.
+
+Set the project lifecycle project attribute to one or more values (comma-separated). To clear the project lifecycle set `--project-lifecycle=`
+
+Allowed values: `production`, `development`, `sandbox`
+
+For more information see [Project attributes](https://docs.snyk.io/getting-started/introduction-to-snyk-projects/view-project-information/project-attributes)
+
+### `--project-tags=[,]...>`
+
+This can be used in combination with the `--report` option.
+
+Set the project tags to one or more values (comma-separated key value pairs with an "=" separator).
+
+Example: `--project-tags=department=finance,team=alpha`
+
+To clear the project tags set `--project-tags=`
+
+### `--remote-repo-url=`
+
+This can be used in combination with the `--report` option.
+
+Set or override the remote URL for the repository.
+
+### `--report`
+
+**NEW** option: Share results with the Snyk Web UI.
+
+This creates a project in your Snyk account with a snapshot of the current configuration issues. After using this option, log in to the Snyk website and view your projects to see the monitor.
+
+Example: `$ snyk iac test --report`
+
+Note: This option cannot be used in combination with the `--rules` option.
+
+### `--rules=`
+
+Use this dedicated option for Custom Rules scanning to enable the IaC scans to use a custom rules bundle generated with the `snyk-iac-rules` SDK. See [`snyk-iac-rules` SDK](https://github.com/snyk/snyk-iac-rules#readme)
+
+This option cannot be used if the custom rules settings were configured with the Snyk UI. Default: If the `--rules` flag is not specified, scan the configuration files using the internal Snyk rules only.
+
+Example: Scan the configuration files using custom rules and internal Snyk rules.
+
+`--rules=bundle.tar.gz`
+
+Note: This option can not be used in combination with the `--report` option.
+
+### `--severity-threshold=`
+
+Report only vulnerabilities at the specified level or higher.
+
+### `--scan=`
+
+Use this dedicated option for Terraform plan scanning modes to control whether the scan analyzes the full final state (for example, `planned-values`), or the proposed changes only (for example, `resource-changes`).
+
+Default: If the `--scan` option is not specified, scan the proposed changes only by default. Example 1: `--scan=planned-values` (full state scan)\
+Example 2: `--scan=resource-changes` (proposed changes scan)
+
+### `--target-name=`
+
+This can be used in combination with the `--report` option.
+
+Set or override the project name for the repository.
+
+Note: This flag will supersede the `--remote-repo-url`, if used together.
+
+### `--target-reference=`
+
+This can be used in combination with the `--report` option.
+
+Specify a reference which differentiates this project, for example, a branch name or version. Projects having the same reference can be grouped based on that reference.
+
+Example, setting to the current Git branch:
+
+`snyk iac test myproject/ --report --target-reference="$(git branch --show-current)"`
+
+\
+Example, setting to the latest Git tag:
+
+`snyk iac test myproject/ --report --target-reference="$(git describe --tags --abbrev=0)"`
+
+### `--var-file=`
+
+Use this option to load a terraform variable definitions file that is located in a different directory from the scanned one.
+
+Example:
+
+`$ snyk iac test myproject/staging/networking --var-file=myproject/vars.tf`
+
+## Examples for snyk iac test command
+
+For more information see [Snyk CLI for Infrastructure as Code](https://docs.snyk.io/products/snyk-infrastructure-as-code/snyk-cli-for-infrastructure-as-code)
+
+### Test a CloudFormation file
+
+```
+$ snyk iac test /path/to/cloudformation_file.yaml
+```
+
+### Test a Kubernetes file
+
+```
+$ snyk iac test /path/to/kubernetes_file.yaml
+```
+
+### Test a Terraform file
+
+```
+$ snyk iac test /path/to/terraform_file.tf
+```
+
+### Test a Terraform plan file
+
+```
+$ terraform plan -out=tfplan.binary
+$ terraform show -json tfplan.binary > tf-plan.json
+$ snyk iac test tf-plan.json
+```
+
+### Test an ARM file
+
+```
+$ snyk iac test /path/to/arm_file.json
+```
+
+### Test matching files in a directory
+
+```
+$ snyk iac test /path/to/directory
+```
+
+### Test matching files in a directory using a local custom rules bundle
+
+```
+$ snyk iac test /path/to/directory --rules=bundle.tar.gz
+```
diff --git a/help/cli-commands/iac-update-exclude-policy.md b/help/cli-commands/iac-update-exclude-policy.md
new file mode 100644
index 0000000000..4d296accec
--- /dev/null
+++ b/help/cli-commands/iac-update-exclude-policy.md
@@ -0,0 +1,48 @@
+# IAC update-exclude-policy
+
+## Usage
+
+`snyk iac update-exclude-policy []`
+
+## Description
+
+The `snyk iac update-exclude-policy` generates exclude policy rules to be used by `snyk iac describe`.
+
+For a list of related commands see the [snyk iac](iac.md) help; `iac --help`
+
+For more information see [Ignore resources](https://docs.snyk.io/products/snyk-infrastructure-as-code/detect-drift-and-manually-created-resources/ignore-resources)
+
+## Exit codes
+
+Possible exit codes and their meaning:
+
+**0**: success, exclude rules generated successfully\
+**1**: error, something wrong happened during exclude rules generation
+
+## Configure the Snyk CLI
+
+You can use environment variables to configure the Snyk CLI and set variables for connecting with the Snyk API. See [Configure the Snyk CLI](https://docs.snyk.io/snyk-cli/configure-the-snyk-cli)
+
+## Debug
+
+Use the `-d` option to output the debug logs.
+
+## Options
+
+### `--exclude-changed`
+
+Exclude resources that changed on cloud provider.
+
+### `--exclude-missing`
+
+Exclude missing resources.
+
+### `--exclude-unmanaged`
+
+Exclude resources not managed by IaC.
+
+## Example
+
+```
+$ snyk iac describe --json --all | snyk iac update-exclude-policy
+```
diff --git a/help/cli-commands/iac.md b/help/cli-commands/iac.md
new file mode 100644
index 0000000000..882275b33c
--- /dev/null
+++ b/help/cli-commands/iac.md
@@ -0,0 +1,21 @@
+# IaC
+
+## Usage
+
+`snyk iac [] []`
+
+## Description
+
+The `snyk iac` commands find and report security issues in Infrastructure as Code files; detect, track, and alert on infrastructure drift and unmanaged resources; and create a .driftigore file.
+
+For more information see [Snyk CLI for Infrastructure as Code](https://docs.snyk.io/products/snyk-infrastructure-as-code/snyk-cli-for-infrastructure-as-code)
+
+## `snyk iac` commands and the help docs
+
+All the `snyk iac` commands are listed here with the help options:
+
+- [iac test](iac-test.md); `iac test --help`: tests for any known security issue
+- [iac update-exclude-policy](iac-update-exclude-policy.md); `iac update-exclude-policy --help`: auto-generates `.snyk` exclusions for cloud resources\
+ Example: `snyk iac describe --json --all | snyk iac update-exclude-policy`
+- [iac describe](iac-describe.md); `iac describe --help`: detects infrastructure drift and unmanaged cloud resources\
+ Example: `snyk iac describe --only-unmanaged`
diff --git a/help/cli-commands/ignore.md b/help/cli-commands/ignore.md
new file mode 100644
index 0000000000..51d73025cb
--- /dev/null
+++ b/help/cli-commands/ignore.md
@@ -0,0 +1,144 @@
+# Ignore
+
+## Usage
+
+`snyk ignore --id= [--expiry=] [--reason=] [--policy-path=] [--path=] [OPTIONS]`
+
+OR
+
+`snyk ignore [--expiry=] [--reason=] [--policy-path=] --file-path=] [OPTIONS]`
+
+## Description
+
+The `snyk ignore` command modifies the `.snyk` policy file to ignore a stated issue according to its snyk ID for all occurrences, its expiry date, a reason, or according to paths in the filesystem.
+
+This updates your local `.snyk` file to contain a block similar to the following:
+
+```yaml
+ignore:
+ '':
+ - '*':
+ reason:
+ expires:
+```
+
+When you use the `--path` option the block is similar to this:
+
+```yaml
+ignore:
+ '':
+ - '':
+ reason:
+ expires:
+```
+
+When you use the `--file-path` option the block is similar to this:
+
+```yaml
+exclude:
+ '':
+ -
+ - :
+ reason:
+ expires:
+ created:
+```
+
+## Debug
+
+Use the `-d` option to output the debug logs.
+
+## Options
+
+### `--id=`
+
+Snyk ID for the issue to ignore, omitted if used with `--file-path`; required by other use cases.
+
+### `--expiry=`
+
+Expiry date in `YYYY-MM-DD` format.
+
+Supported formats:
+
+[ISO 8601](https://www.iso.org/iso-8601-date-and-time-format.html)
+
+[RFC 2822](https://tools.ietf.org/html/rfc2822)
+
+Default: 30 days or none if used with `--file-path`
+
+### `--reason=`
+
+Human-readable `` to ignore this issue.
+
+Default: none
+
+### `--policy-path=`
+
+Path to a `.snyk` policy file to pass manually.
+
+Default: none
+
+### `--path=`
+
+Path to resource inside the depgraph for which to ignore the issue.
+
+Use to narrow the scope of the ignore rule. When no resource path is specified, all resources are ignored.
+
+If used, follows the `--policy-path` option.
+
+Default: all
+
+### `--file-path=`
+
+Filesystem for which to ignore the issue. Used by `snyk code` and `snyk test --unmanaged`
+
+Default: none
+
+### `--file-path-group=[global|code|iac-drift]`
+
+Grouping used in combination with `--file-path`, otherwise omitted.
+
+Default: global
+
+## Examples for snyk ignore command
+
+### Ignore a specific vulnerability
+
+```
+$ snyk ignore --id='npm:qs:20170213' --expiry='2021-01-10' --reason='Module not affected by this vulnerability'
+```
+
+### Ignore a specific vulnerability with a resource path specified
+
+```
+$ snyk ignore --id='SNYK-JS-PATHPARSE-1077067' --expiry='2021-01-10' --path='nyc@11.9.0 > istanbul-lib-report@1.1.3 > path-parse@1.0.5' --reason='Module not affected by this vulnerability'
+```
+
+### Ignore a specific vulnerability for 30 days
+
+```
+$ snyk ignore --id=npm:tough-cookie:20160722
+```
+
+### Ignore a specific file until 2031-01-20
+
+Ignore a specific file, used by `snyk test --unmanaged` until 2031-01-20, with a description as a reference for the future.
+
+```
+$ snyk ignore --file-path='./deps/curl-7.58.0/src/tool_msgs.c' --expiry='2031-01-20' --reason='patched file'
+```
+
+### Ignore files or folders using glob expression
+
+Ignore files matching a glob expression by adding them to a specific group. Applies to Snyk Code; does not apply to Snyk Open Source, Container, or Infrastructure as Code.
+
+```
+$ snyk ignore --file-path='./**/vendor/**/*.cpp' --file-path-group='global'
+```
+
+## More information about snyk ignore command
+
+For more information see:
+
+- [Ignore vulnerabilities using Snyk CLI](https://docs.snyk.io/snyk-cli/test-for-vulnerabilities/ignore-vulnerabilities-using-snyk-cli)
+- [IaC ignores using the .snyk policy file](https://docs.snyk.io/products/snyk-infrastructure-as-code/snyk-cli-for-infrastructure-as-code/iac-ignores-using-the-.snyk-policy-file)
diff --git a/help/cli-commands/log4shell.md b/help/cli-commands/log4shell.md
new file mode 100644
index 0000000000..a54e213edb
--- /dev/null
+++ b/help/cli-commands/log4shell.md
@@ -0,0 +1,31 @@
+# Log4shell
+
+## Usage
+
+`snyk log4shell`
+
+## Description
+
+The `snyk log4shell` command finds traces of the Log4J library that are affected by the Log4Shell vulnerability [CVE-2021-44228](https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720)
+
+The command finds traces of the Log4J library even if it is not declared in the manifest files (such as pom.xml or build.gradle).
+
+## Managed projects
+
+To test for Log4Shell vulnerabilities in Java projects using their package manager manifest files, use the `snyk test` command. See the [test command help](test.md) (`snyk test --help`) and [Snyk for Java and Kotlin](https://docs.snyk.io/products/snyk-open-source/language-and-package-manager-support/snyk-for-java-gradle-maven)
+
+To test unmanaged files, use `snyk test --scan-all-unmanaged`
+
+See the Maven options section of the [test command help](test.md); `snyk test --help`
+
+## Exit codes
+
+Possible exit codes and their meaning:
+
+**0**: success, Log4Shell not found\
+**1**: action_needed, Log4Shell found\
+**2**: failure, try to re-run command
+
+## Debug
+
+Use the `-d` option to output the debug logs.
diff --git a/help/cli-commands/monitor.md b/help/cli-commands/monitor.md
new file mode 100644
index 0000000000..1beacc1dbc
--- /dev/null
+++ b/help/cli-commands/monitor.md
@@ -0,0 +1,341 @@
+# Monitor
+
+## Usage
+
+`snyk monitor []`
+
+## Description
+
+The `snyk monitor` command creates a project in your Snyk account to be continuously monitored for open source vulnerabilities and license issues. After running this command, log in to the Snyk website and view your projects to see the monitor.
+
+For Snyk Container see [`snyk container` help](https://docs.snyk.io/snyk-cli/commands/container)
+
+The `monitor` command is not supported for Snyk Code.
+
+For Snyk Infrastructure as Code follow the instructions in "Regularly testing IaC files" on [Snyk CLI for Infrastructure as Code](https://docs.snyk.io/products/snyk-infrastructure-as-code/snyk-cli-for-infrastructure-as-code)
+
+## Exit codes
+
+Possible exit codes and their meaning:
+
+**0**: success, snapshot created\
+**2**: failure, try to re-run command\
+**3**: failure, no supported projects detected
+
+## Configure the Snyk CLI
+
+You can use environment variables to configure the Snyk CLI and and set variables for connecting with the Snyk API. See [Configure the Snyk CLI](https://docs.snyk.io/features/snyk-cli/configure-the-snyk-cli)
+
+## Debug
+
+Use the `-d` option to output the debug logs.
+
+## Options
+
+See also subsequent sections for options for specific build environments, package managers, languages and `[]` which you specify last.
+
+### `--all-projects`
+
+Auto-detect all projects in the working directory (including Yarn workspaces).
+
+For more information see the article [Does the Snyk CLI support monorepos or multiple manifest files?](https://support.snyk.io/hc/en-us/articles/360000910577-Does-the-Snyk-CLI-support-monorepos-or-multiple-manifest-files-)
+
+### `--fail-fast`
+
+Use with `--all-projects` to cause scans to be interrupted when errors occur and to report these errors back to the user.
+
+The exit code is 2 and the scan ends. No vulnerability information is reported for projects that did not produce errors.
+
+To perform the scan, resolve the error and scan again.
+
+Note: If you do not use `--fail-fast`, Snyk scans all the projects but does not report any vulnerabilities for projects it could not scan due to misconfiguration or another error.
+
+### `--detection-depth=`
+
+Use with `--all-projects` or `--yarn-workspaces` to indicate how many subdirectories to search. `DEPTH` must be a number, `1` or greater; zero (0) is the current directory.
+
+Default: 4, the current working directory (0) and 4 subdirectories.
+
+Example: `--detection-depth=3` limits search to the specified directory (or the current directory if no `` is specified) plus three levels of subdirectories; zero (0) is the current directory.
+
+### `--exclude=[,]...>`
+
+Can be used with `--all-projects` and `--yarn-workspaces` to indicate directory names and file names to exclude. Must be comma separated.
+
+Example: `$ snyk test --all-projects --exclude=dir1,file2`
+
+This will exclude any directories and files named "dir1" and "file2" when scanning for project manifest files. Such as: "./dir1", "./src/dir1", "./file2", "./src/file2", and so on.
+
+### `--prune-repeated-subdependencies`, `-p`
+
+Prune dependency trees, removing duplicate sub-dependencies.
+
+Continues to find all vulnerabilities, but may not find all of the vulnerable paths.
+
+### `--print-deps`
+
+Print the dependency tree before sending it for analysis.
+
+### `--remote-repo-url=`
+
+Set or override the remote URL for the repository that you would like to monitor.
+
+### `--dev`
+
+Include development-only dependencies. Applicable only for some package managers, for example, `devDependencies` in npm or `:development` dependencies in Gemfile.
+
+Default: scan only production dependencies.
+
+### `--org=`
+
+Specify the `` to run Snyk commands tied to a specific organization. The `` influences some features availability and private test limits.
+
+If you have multiple organizations, you can set a default from the CLI using:
+
+`$ snyk config set org=`
+
+Set a default to ensure all newly monitored projects are created under your default organization. If you need to override the default, use the `--org=` option.
+
+Default: `` that is the current preferred organization in your [Account settings](https://app.snyk.io/account)
+
+Note that you can also use `--org=`. The `ORG_ID` works in both the CLI and the API. The organization slug name works in the CLI, but not in the API.
+
+For more information see the article [How to select the organization to use in the CLI](https://support.snyk.io/hc/en-us/articles/360000920738-How-to-select-the-organization-to-use-in-the-CLI)
+
+### `--file=`
+
+Specify a package file.
+
+When testing locally or monitoring a project, you can specify the file that Snyk should inspect for package information. When the file is not specified, Snyk tries to detect the appropriate file for your project.
+
+### `--package-manager=`
+
+Specify the name of the package manager when the filename specified with the `--file=` option is not standard. This allows Snyk to find the file.
+
+Example: `$ snyk monitor --file=req.txt --package-manager=pip`
+
+### `--unmanaged`
+
+For C++ only, scan all files for known open source dependencies.
+
+For options you can use with `--unmanaged` see [Options for scanning using `--unmanaged`](https://docs.snyk.io/snyk-cli/commands/monitor#options-for-scanning-using-unmanaged)
+
+For more information see [Snyk for C/C++](https://docs.snyk.io/products/snyk-open-source/language-and-package-manager-support/snyk-for-c-c++)
+
+### `--ignore-policy`
+
+Ignore all set policies, the current policy in the `.snyk` file, org level ignores, and the project policy on snyk.io.
+
+### `--trust-policies`
+
+Apply and use ignore rules from the Snyk policies in your dependencies; otherwise ignore rules in the dependencies are only shown as a suggestion.
+
+### `--project-name=`
+
+Specify a custom Snyk project name.
+
+Example: `$ snyk monitor --project-name=my-project`
+
+### `--target-reference=`
+
+Specify a reference which differentiates this project, for example, a branch name or version. Projects having the same reference can be grouped based on that reference. Supported for Snyk Open Source and use with `--unmanaged`.
+
+For more information see [Separating projects by branch or version](https://docs.snyk.io/snyk-cli/secure-your-projects-in-the-long-term/grouping-projects-by-branch-or-version)
+
+### `--policy-path=`
+
+Manually pass a path to a `.snyk` policy file.
+
+### `--json`
+
+Print results in JSON format.
+
+### `--project-environment=[,]...>`
+
+Set the project environment project attribute to one or more values (comma-separated). To clear the project environment set `--project-environment=`
+
+Allowed values: `frontend, backend, internal, external, mobile, saas, onprem, hosted, distributed`
+
+For more information see [Project attributes](https://docs.snyk.io/getting-started/introduction-to-snyk-projects/view-project-information/project-attributes)
+
+### `--project-lifecycle=[,]...>`
+
+Set the project lifecycle project attribute to one or more values (comma-separated). To clear the project lifecycle set `--project-lifecycle=`
+
+Allowed values: `production, development, sandbox`
+
+For more information see [Project attributes](https://docs.snyk.io/getting-started/introduction-to-snyk-projects/view-project-information/project-attributes)
+
+### `--project-business-criticality=[,]...>`
+
+Set the project business criticality project attribute to one or more values (comma-separated). To clear the project business criticality set `--project-business-criticality=`
+
+Allowed values: `critical, high, medium, low`
+
+For more information see [Project attributes](https://docs.snyk.io/getting-started/introduction-to-snyk-projects/view-project-information/project-attributes)
+
+### `--project-tags=[,]...>`
+
+Set the project tags to one or more values (comma-separated key value pairs with an "=" separator), for example, `--project-tags=department=finance,team=alpha` To clear the project tags set `--project-tags=`
+
+### `--tags=[,]...>`
+
+This is an alias for `--project-tags`
+
+## Options for Maven projects
+
+For more information about Maven CLI options see [Snyk for Java and Kotlin](https://docs.snyk.io/products/snyk-open-source/language-and-package-manager-support/snyk-for-java-gradle-maven)
+
+### `--maven-aggregate-project`
+
+Use `--maven-aggregate-project` instead of `--all-projects` when scanning Maven aggregate projects, that is, ones that use modules and inheritance.
+
+When scanning these types of projects, Snyk performs a compile to ensure all modules are resolvable by the Maven reactor.
+
+Be sure to run the scan in the same directory as the root pom.xml file.
+
+Snyk reports test results per pom.xml file.
+
+### `--scan-all-unmanaged`
+
+Auto-detect maven jars, aars, and wars in given directory. To monitor individually use `--file=`
+
+**Note**: Custom-built jar files, even with open source dependencies, are out of scope.
+
+## Options for Gradle projects
+
+For more information about Gradle CLI options see [Snyk for Java and Kotlin](https://docs.snyk.io/products/snyk-open-source/language-and-package-manager-support/snyk-for-java-gradle-maven)
+
+### `--sub-project=`, `--gradle-sub-project=`
+
+For Gradle "multi project" configurations, monitor a specific sub-project.
+
+### `--all-sub-projects`
+
+For "multi project" configurations, monitor all sub-projects.
+
+### `--configuration-matching=`
+
+Resolve dependencies using only configuration(s) that match the specified Java regular expression.
+
+Example: `^releaseRuntimeClasspath$`
+
+### `--configuration-attributes=[,]...`
+
+Select certain values of configuration attributes to install dependencies and perform dependency resolution.
+
+Example: `buildtype:release,usage:java-runtime`
+
+### `--init-script=`
+
+When monitoring a .NET project, use this option to add a custom prefix to the name of files inside a project along with any desired separators.
+
+Example: `snyk monitor --file=my-project.sln --project-name-prefix=my-group/`
+
+This is useful when you have multiple projects with the same name in other `.sln` files.
+
+## Option for npm projects
+
+### `--strict-out-of-sync=true|false`
+
+Control monitoring out-of-sync lockfiles.
+
+Default: true
+
+## Options for Yarn projects
+
+### `--strict-out-of-sync=true|false`
+
+Control monitoring out-of-sync lockfiles.
+
+Default: true
+
+### `--yarn-workspaces`
+
+Detect and scan Yarn workspaces. You can specify how many sub-directories to search using `--detection-depth` and exclude directories and files using `--exclude`. Alternatively scan Yarn workspaces with other projects using `--all-projects`
+
+## Option for CocoaPods projects
+
+### `--strict-out-of-sync=true|false`
+
+Control monitoring out-of-sync lockfiles.
+
+Default: false
+
+## Options for Python projects
+
+### `--command=`
+
+Indicate which specific Python commands to use based on Python version. The default is `python` which executes your default python version. Run 'python -V' to find out what version it is. If you are using multiple Python versions, use this parameter to specify the correct Python command for execution.
+
+Default: `python` Example: `--command=python3`
+
+### `--skip-unresolved=true|false`
+
+Allow skipping packages that are not found in the environment.
+
+## Options for scanning using `--unmanaged`
+
+The following `snyk monitor` options can be used with `--unmanaged` as documented in this help.
+
+`--org=`
+
+`--json`
+
+`--remote-repo-url=`
+
+`--target-reference=`
+
+There are also special options.
+
+### `--target-dir`
+
+Scan the path specified in the argument instead of the current directory.
+
+Alternatively, run `snyk test --unmanaged`
+
+### `--max-depth`
+
+Specify the maximum level of archive extraction.
+
+Usage: `--max-depth=1`
+
+Use 0 to disable archive extraction completely.
+
+### `--print-dep-paths`
+
+Display dependencies.
+
+Use use this option to see what files contributed to each dependency identified.
+
+To see how confident Snyk is about the identified dependency and its version, use the `--print-deps` or `--print-dep-paths` option.
+
+For more information on uses of CLI options for C/C++ projects see [Snyk for C / C++](https://docs.snyk.io/products/snyk-open-source/language-and-package-manager-support/snyk-for-c-c++)
+
+### `--project-name=c-project`
+
+Use with the `snyk monitor --unmanaged` command to override the default name Snyk gives your snapshots by entering the desired name.
+
+## Options for build tools
+
+### `-- []`
+
+Use a double dash (`--`) after the complete Snyk command to pass options (arguments, flags) that follow directly to the build tool, for example Gradle or Maven.
+
+The format is `snyk -- []`
+
+Example: `snyk monitor -- --build-cache`
diff --git a/help/cli-commands/policy.md b/help/cli-commands/policy.md
new file mode 100644
index 0000000000..b22cf245e5
--- /dev/null
+++ b/help/cli-commands/policy.md
@@ -0,0 +1,17 @@
+# Policy
+
+## Usage
+
+`snyk policy [] []`
+
+## Description
+
+The `snyk policy` command displays the `.snyk` policy file for a package.
+
+## Argument: ``
+
+Manually pass a path to a `.snyk` policy file.
+
+## Debug
+
+Use `-d` option to output the debug logs.
diff --git a/help/cli-commands/test.md b/help/cli-commands/test.md
new file mode 100644
index 0000000000..6097cd69b4
--- /dev/null
+++ b/help/cli-commands/test.md
@@ -0,0 +1,366 @@
+# Test
+
+## Usage
+
+`snyk test []`
+
+## Description
+
+The `snyk test` command checks projects for open source vulnerabilities and license issues. The test command tries to auto-detect supported manifest files with dependencies and test those.
+
+## Exit codes
+
+Possible exit codes and their meaning:
+
+**0**: success, no vulnerabilities found\
+**1**: action_needed, vulnerabilities found\
+**2**: failure, try to re-run command\
+**3**: failure, no supported projects detected
+
+## Configure the Snyk CLI
+
+You can use environment variables to configure the Snyk CLI and set variables for connecting with the Snyk API. See [Configure the Snyk CLI](https://docs.snyk.io/features/snyk-cli/configure-the-snyk-cli)
+
+## Debug
+
+Use the `-d` option to output the debug logs.
+
+## Options
+
+See also subsequent sections for options for specific build environments, package managers, languages, and `[]` which you specify last.
+
+### `--all-projects`
+
+Auto-detect all projects in the working directory (including Yarn workspaces).
+
+For more information see the article [Does the Snyk CLI support monorepos or multiple manifest files?](https://support.snyk.io/hc/en-us/articles/360000910577-Does-the-Snyk-CLI-support-monorepos-or-multiple-manifest-files-)
+
+### `--fail-fast`
+
+Use with `--all-projects` to cause scans to be interrupted when errors occur and to report these errors back to the user.
+
+The exit code is 2 and the scan ends. No vulnerability information is reported for projects that did not produce errors.
+
+To perform the scan, resolve the error and scan again.
+
+Note: If you do not use `--fail-fast`, Snyk scans all the projects but does not report any vulnerabilities for projects it could not scan due to misconfiguration or another error.
+
+### `--detection-depth=`
+
+Use with `--all-projects` or `--yarn-workspaces` to indicate how many subdirectories to search. `DEPTH` must be a number, 1 or greater; zero (0) is the current directory.
+
+Default: 4 , the current working directory (0) and 4 subdirectories.
+
+Example: `--detection-depth=3` limits search to the specified directory (or the current directory if no `` is specified) plus three levels of subdirectories; zero (0) is the current directory.
+
+### `--exclude=[,]...>`
+
+Can be used with `--all-projects` and `--yarn-workspaces` to indicate directory names and file names to exclude. Must be comma separated.
+
+Example: `$ snyk test --all-projects --exclude=dir1,file2`
+
+This will exclude any directories and files named "dir1" and "file2" when scanning for project manifest files. Such as: "./dir1", "./src/dir1", "./file2", "./src/file2", and so on.
+
+### `--prune-repeated-subdependencies`, `-p`
+
+Prune dependency trees, removing duplicate sub-dependencies.
+
+Continues to find all vulnerabilities, but may not find all of the vulnerable paths.
+
+### `--print-deps`
+
+Print the dependency tree before sending it for analysis.
+
+### `--remote-repo-url=`
+
+Set or override the remote URL for the repository that you would like to monitor.
+
+### `--dev`
+
+Include development-only dependencies. Applicable only for some package managers, for example, `devDependencies` in npm or `:development` dependencies in Gemfile.
+
+Default: scan only production dependencies.
+
+### `--org=`
+
+Specify the `` to run Snyk commands tied to a specific organization. The `` influences some features availability and private test limits.
+
+If you have multiple organizations, you can set a default from the CLI using:
+
+`$ snyk config set org=
-
- 
-
-
+
+
+
+