- Print
- DarkLight
Overview
Velociraptor is an open source endpoint visibility tool that includes power digital forensic, incident response, and incident triage capabilities. LimaCharlie can be used to deploy Velociraptor at scale, allowing for easy artifact collection and incident analysis.
The interface defines 3 main actions:
- The
list
action to list all possible Velociraptor artifacts (we always run the latest version). - The
show
action to show the arguments and general usage information for a given Velociraptor artifact type. - The
collect
action to run the Velociraptor artifact collection on a number of endpoints.
Velociraptor will generate a ZIP file with all collected data, which is automatically ingested into LimaCharlie's Artifact system for download.
The download from LimaCharlie process can also be automated using an Output with the Artifact stream tipping you off whenever a velociraptor
Artifact is ingested into LimaCharlie. You can then export the Artifact using a REST API call.
Actions
list
This action takes no parameters and it returns the list of velociraptor artifacts synchronously.
show
This action requires the artifact_name
parameter to be specified. It returns the artifact's usage synchronously.
collect
This action requires an artifact specification and an endpoint specification.
An optional ttl
parameter will define how long (in seconds) the service will wait for a targeted endpoint to come online and be processed for collection.
Artifact Spec
One of the artifact_name
, artifact_list
or custom_artifact
needs to be specified. The artifact_name
is the exact name as defined by Velociraptor. The artifact_list
is a comma-separated list of Velociraptor artifacts to collect.
The custom_artifact
is the content of a custom Velociraptor YAML artifact definition to execute instead of a pre-defined Velociraptor artifact.
Note that the resulting artifact zip file is only automatically collected when you specify the artifact_name
parameter since we can not predict where/how the custom_artifact
will store its output.
An args
parameter specifies a comma-separated list of arguments in the format ARG_NAME=ARG_VALUE
given to Velociraptor at collection time.
Endpoint Spec
One of sid
or tag
needs to be specified. If sid
is specified, the sensor with the Sensor ID specified will
be targetted for collection. If tag
is specified, all sensors with the given tag
will be targetted.
REST
collect
{
"action": "collect",
"artifact_name": "Windows.Applications.Chrome.Extensions",
"tag": "server",
"ttl": 86400
}