diff --git a/artifacts/definitions/Demo/Plugins/GUI.yaml b/artifacts/definitions/Demo/Plugins/GUI.yaml index 9b84f673e71..c47291a57ac 100755 --- a/artifacts/definitions/Demo/Plugins/GUI.yaml +++ b/artifacts/definitions/Demo/Plugins/GUI.yaml @@ -265,6 +265,7 @@ sources: {{ define "Q" }} SELECT _ts, CPUPercent FROM monitoring( + client_id="server", artifact="Server.Monitor.Health/Prometheus", start_time=now() - 10 * 60) LIMIT 100 @@ -283,6 +284,7 @@ sources: */ SELECT timestamp(epoch=_ts) AS Timestamp, CPUPercent FROM monitoring( + client_id="server", source="Prometheus", artifact="Server.Monitor.Health", start_time=now() - 10 * 60) @@ -291,6 +293,7 @@ sources: timestamp(epoch=_ts) AS Timestamp, dict(X=CPUPercent, Y=1) AS Dict FROM monitoring( + client_id="server", source="Prometheus", artifact="Server.Monitor.Health", start_time=now() - 10 * 60) diff --git a/artifacts/definitions/Windows/Packs/Persistence.yaml b/artifacts/definitions/Windows/Packs/Persistence.yaml index 3ceaad07d55..f559d3040de 100644 --- a/artifacts/definitions/Windows/Packs/Persistence.yaml +++ b/artifacts/definitions/Windows/Packs/Persistence.yaml @@ -7,26 +7,13 @@ precondition: sources: - name: WMI Event Filters - description: | - {{ DocFrom "Windows.Persistence.PermanentWMIEvents" }} - query: | SELECT * FROM Artifact.Windows.Persistence.PermanentWMIEvents() - name: Startup Items - description: | - {{ DocFrom "Windows.Sys.StartupItems" }} - query: | SELECT * FROM Artifact.Windows.Sys.StartupItems() - name: Debug Bootstraping - description: | - {{ DocFrom "Windows.Persistence.Debug" }} - - If there are any rows in the table below then executing the - program will also launch the program listed under the Debugger - column. - query: | SELECT * FROM Artifact.Windows.Persistence.Debug() diff --git a/bin/fuse_unix.go b/bin/fuse_unix.go index 3e349e1ba1d..15717be3628 100644 --- a/bin/fuse_unix.go +++ b/bin/fuse_unix.go @@ -1,5 +1,5 @@ -//go:build !windows -// +build !windows +//go:build !windows && !freebsd +// +build !windows,!freebsd package main diff --git a/docs/references/server.config.yaml b/docs/references/server.config.yaml index 655ca7ca19c..54ca3d6bb29 100644 --- a/docs/references/server.config.yaml +++ b/docs/references/server.config.yaml @@ -304,6 +304,19 @@ Client: - Label1 - Label1 + ## The client normally does not write any logs on the + ## endpoint. However this makes it hard to debug any issues so you + ## can choose to have the client write its logs in a file on the + ## endpoint. The file will be written in an encrypted form which can + ## only be decrypted by the Generic.Client.LocalLogsRetrieve + ## artifact. + + ## Path relative to the relevant tmpdir above where client side logs + ## are kept. These logs are encrypted client side and need to be + ## decrypted on the server to read. + logfile_name: "logfile.log" + logfile_size: 10000000 + ## Velociraptor keeps a local buffer file to store query results ## while they are being shipped across the network. There are two ## types of buffers - an in memory buffer and a local file based @@ -1158,6 +1171,10 @@ defaults: # Minion.notebook_number_of_local_workers to 5. notebook_number_of_local_workers: 5 + # Wait this long for a worker to become available before giving + # up. The default is 10 seconds. + notebook_wait_time_for_worker_ms: 10000 + # The default priority of notebook processors (Higher priority will # receive jobs over lower priority). notebook_worker_priority: 10 @@ -1254,6 +1271,12 @@ defaults: # Maximum length of the line that will be parsed (16kb) watch_plugin_buffer_size: 16384 + # Period in seconds when to produce a backup. Velociraptor will + # generate a backup of important metadata about the server. By + # default this happens daily but you can change it here (set to -1) + # to disable backups. + backup_period_seconds: 86400 + # The Velociraptor server may be placed into "lockdown" mode. While in # lockdown mode certain permissions are denied - even for # administrators. This additional protection mode helps to mitigate diff --git a/docs/references/vql.yaml b/docs/references/vql.yaml index 4a8ad7fdd43..7832a0fff62 100644 --- a/docs/references/vql.yaml +++ b/docs/references/vql.yaml @@ -3696,15 +3696,10 @@ - name: client_id type: string description: The client id to extract - - name: flow_id - type: string - description: A flow ID (client or server artifacts) - - name: hunt_id - type: string - description: Retrieve sources from this hunt (combines all results from all clients) + required: true - name: artifact type: string - description: The name of the artifact collection to fetch + description: The name of the event artifact to read - name: source type: string description: An optional named source within the artifact @@ -3714,29 +3709,12 @@ - name: end_time type: Any description: Stop end events reach this time (event sources). - - name: notebook_id - type: string - description: The notebook to read from (should also include cell id) - - name: notebook_cell_id - type: string - description: The notebook cell read from (should also include notebook id) - - name: notebook_cell_version - type: string - description: The notebook cell version to read from (should also include notebook - id and notebook cell) - - name: notebook_cell_table - type: int64 - description: A notebook cell can have multiple tables.) - name: start_row type: int64 description: Start reading the result set from this row - name: count type: int64 description: Maximum number of clients to fetch (default unlimited)' - - name: orgs - type: string - description: Run the query over these orgs. If empty use the current org.' - repeated: true category: server metadata: permissions: READ_RESULTS @@ -5131,7 +5109,6 @@ This plugin is useful for evaluating a query in a different environment or context, or turning a string into a query. - type: Plugin args: - name: query @@ -7068,6 +7045,7 @@ - name: artifact type: string description: The artifact to watch + required: true category: event metadata: permissions: READ_RESULTS @@ -7378,3 +7356,4 @@ category: plugin metadata: permissions: FILESYSTEM_READ + diff --git a/docs/wix/velociraptor_amd64.xml b/docs/wix/velociraptor_amd64.xml index f7430f1415f..a797b8beeed 100644 --- a/docs/wix/velociraptor_amd64.xml +++ b/docs/wix/velociraptor_amd64.xml @@ -3,7 +3,7 @@ - + - + = 0 { + last_record, _ = self.getIndex(last_idx) + } if first_record == nil || last_record == nil { return &timelines_proto.Timeline{Id: self.id} diff --git a/utils/errors.go b/utils/errors.go index e71c53b9a91..630d3d31b73 100644 --- a/utils/errors.go +++ b/utils/errors.go @@ -18,6 +18,7 @@ var ( InvalidConfigError = errors.New("InvalidConfigError") NotFoundError = Wrap(os.ErrNotExist, "NotFoundError") InvalidArgError = errors.New("InvalidArgError") + IOError = errors.New("IOError") ) // This is a custom error type that wraps an inner error but does not diff --git a/utils/read_seek_reader_adapter.go b/utils/read_seek_reader_adapter.go index f159fad2167..f84448fc7f6 100644 --- a/utils/read_seek_reader_adapter.go +++ b/utils/read_seek_reader_adapter.go @@ -33,6 +33,10 @@ func (self ReadSeekReaderAdapter) Close() error { } func (self *ReadSeekReaderAdapter) Read(buf []byte) (int, error) { + if self.offset < 0 { + return 0, IOError + } + n, err := self.reader.ReadAt(buf, self.offset) self.offset += int64(n) return n, err diff --git a/vql/server/flows/monitoring.go b/vql/server/flows/monitoring.go index e9fb2295c13..b0db4e3536a 100644 --- a/vql/server/flows/monitoring.go +++ b/vql/server/flows/monitoring.go @@ -38,7 +38,7 @@ import ( type MonitoringPluginArgs struct { ClientId string `vfilter:"required,field=client_id,doc=The client id to extract"` - Artifact string `vfilter:"optional,field=artifact,doc=The name of the event artifact to read"` + Artifact string `vfilter:"required,field=artifact,doc=The name of the event artifact to read"` Source string `vfilter:"optional,field=source,doc=An optional named source within the artifact"` StartTime vfilter.Any `vfilter:"optional,field=start_time,doc=Start return events from this date (for event sources)"`