Velociraptor

README

Velociraptor

This responder can be used to run a flow for a Velociraptor artifact. This could include gathering data, or performing initial response, as the artifact (or artifact "pack") could encompass any number of actions. The responder can be run on an observable type of ip, fqdn, or other, and will look for a matching client via the Velociraptor server. If a client match is found for the last seen IP, or the hostname, the responder will kick off the flow, the results will be returned, and the client ID will be added as a tag to the case and the observable.

Requirements

The following options are required in the Velociraptor Responder configuration:

API Client Configuration (choose one): - velociraptor_client_config: The path to the Velociraptor API client config file. - velociraptor_client_config_content_base64: Base64-encoded API client config (recommended for SaaS/containerized deployments).

To generate an API client config, see: https://www.velocidex.com/docs/user-interface/api/ Ensure the appropriate ACLs are granted to the API user.

For SaaS deployments, encode your API client config:

cat api_client.yaml | base64

Then paste the output into the velociraptor_client_config_content_base64 parameter.

Other Parameters: - velociraptor_artifact: The name of the artifact you wish to collect (as you would see it in the Velociraptor GUI). Required. - query_max_duration: Max query duration in seconds (default: 600). Optional.

Velociraptor

Author: Wes Lambert, @therealwlambert
License: AGPL-V3
Version: 0.2
Supported data types:
- thehive:case_artifact
Registration required: N/A
Subscription required: N/A
Free subscription: N/A
Third party service: N/A

Description

Run Velociraptor artifact collection

Configuration

velociraptor_client_config	Path to API client config file
Default value if not configured	N/A
Type of the configuration item	string
The configuration item can contain multiple values	False
Is required	False

velociraptor_client_config_content_base64	Base64-encoded API client config file (YAML format). Recommended for SaaS/containerized deployments to preserve multiline YAML structure. Generate with: cat api_client.yaml | base64
Default value if not configured	N/A
Type of the configuration item	string
The configuration item can contain multiple values	False
Is required	False

velociraptor_artifact	Artifact to collect
Default value if not configured	__
Type of the configuration item	string
The configuration item can contain multiple values	False
Is required	True

query_max_duration	Max query duration (in seconds)
Default value if not configured	600
Type of the configuration item	number
The configuration item can contain multiple values	False
Is required	False