valitydev/Cortex-Analyzers
14
0
Fork 0
mirror of https://github.com/valitydev/Cortex-Analyzers.git synced 2024-11-06 00:55:17 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
master
Cortex-Analyzers/responders/Velociraptor
History
Jérôme Leonard 44392c64d6 #803 include documentation
2020-08-12 09:45:44 +00:00
..
README.md #803 include documentation 2020-08-12 09:45:44 +00:00
requirements.txt Add grpcio-tools 2020-07-25 09:31:59 -04:00
velociraptor_flow.json Initial Velociraptor Responder 2020-06-23 02:57:41 +00:00
velociraptor_flow.py Initial Velociraptor Responder 2020-06-23 02:57:41 +00:00

README.md

Velociraptor

This responder can be used to run a flow for a Velociraptor artifact. This could include gathering data, or performing initial response, as the artifact (or artifact "pack") could encompass any number of actions. The responder can be run on an observable type of ip, fqdn, or other, and will look for a matching client via the Velociraptor server. If a client match is found for the last seen IP, or the hostname, the responder will kick off the flow, the results will be returned, and the client ID will be added as a tag to the case and the observable.

Requirements

The following options are required in the Velociraptor Responder configuration:

  • velociraptor_client_config: The path to the Velociraptor API client config.
    (See the following for generating an API client config: https://www.velocidex.com/docs/user-interface/api/, and ensure the appropriate ACLs are granted to the API user).
  • velociraptor_artifact: The name artifact you which to collect (as you would see it in the Velociraptor GUI)