Skip to content

Velociraptor#

README

Velociraptor#

This responder can be used to run a flow for a Velociraptor artifact. This could include gathering data, or performing initial response, as the artifact (or artifact "pack") could encompass any number of actions. The responder can be run on an observable type of ip, fqdn, or other, and will look for a matching client via the Velociraptor server. If a client match is found for the last seen IP, or the hostname, the responder will kick off the flow, the results will be returned, and the client ID will be added as a tag to the case and the observable.

Requirements#

The following options are required in the Velociraptor Responder configuration:

  • velociraptor_client_config: The path to the Velociraptor API client config.
    (See the following for generating an API client config: https://www.velocidex.com/docs/user-interface/api/, and ensure the appropriate ACLs are granted to the API user).
  • velociraptor_artifact: The name artifact you which to collect (as you would see it in the Velociraptor GUI).
  • upload_flow_results: Upload flow results to TheHive case (bool).
  • thehive_url: URL of your TheHive installation (e.g. 'http://127.0.0.1:9000').
  • thehive_apikey: TheHive API key used to add flow results/file(s) to a case.

Velociraptor_Flow#

Author: Wes Lambert
License: AGPL-V3
Version: 0.1
Supported data types:
- thehive:case_artifact
Registration required: N/A
Subscription required: N/A
Free subscription: N/A
Third party service: N/A

Description#

Run Velociraptor flow

Configuration#

velociraptor_client_config Path to API client config file
Default value if not configured __
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
velociraptor_artifact Artifact to collect
Default value if not configured __
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
upload_flow_results Upload the results of a flow as an observable
Default value if not configured N/A
Type of the configuration item boolean
The configuration item can contain multiple values False
Is required True
thehive_url URL pointing to your TheHive installation, e.g. 'http://127.0.0.1:9000'
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
thehive_apikey TheHive API key (used to add the downloaded file back to the alert/case)
Default value if not configured N/A
Type of the configuration item string
The configuration item can contain multiple values False
Is required True