grimoire
grimoire copied to clipboard
Don't include Stratus Red Team revert logs
For attack techniques that have a revert function in Stratus Red Team, this function is called before cleaning up: https://github.com/DataDog/stratus-red-team/blob/main/v2/pkg/stratus/runner/runner.go#L182-L192
This causes these logs to have the same UA as the detonation and be included to the logs that Grimoire pulls.
Potential solutions:
- Modify Stratus Red Team to not call
reverton cleanup (would require making sure this works for every technique) - Modify Stratus Red Team to use a slightly different UA when doing
revert(e.g.stratus-red-team_revert_UUID