grimoire icon indicating copy to clipboard operation
grimoire copied to clipboard

Don't include Stratus Red Team revert logs

Open christophetd opened this issue 1 year ago • 0 comments

For attack techniques that have a revert function in Stratus Red Team, this function is called before cleaning up: https://github.com/DataDog/stratus-red-team/blob/main/v2/pkg/stratus/runner/runner.go#L182-L192

This causes these logs to have the same UA as the detonation and be included to the logs that Grimoire pulls.

Potential solutions:

  • Modify Stratus Red Team to not call revert on cleanup (would require making sure this works for every technique)
  • Modify Stratus Red Team to use a slightly different UA when doing revert (e.g. stratus-red-team_revert_UUID

christophetd avatar Aug 02 '24 19:08 christophetd