velociraptor icon indicating copy to clipboard operation
velociraptor copied to clipboard

Make inventory_add() parameters equivalent to artifact definitions

Open scudette opened this issue 4 years ago • 1 comments
trafficstars

Currently there are a number of ways to add items to the tool inventory:

  1. Using Inventory_add() VQL
  2. Using the velocirpator tools upload
  3. Define a tool in the artifact definition
  4. Using the AJAX API in the GUI tool-viewer.js

These ways have slight inconsistencies

We need to standardize all these methods so they are consistent

scudette avatar Sep 02 '21 12:09 scudette

It would also be great if serve_url could be respected if set. Currently the serve_url can be specified in an artifact definition, but gets replaced by the filestore_path when 'materialize' happens. This would also mean that the file in the public folder would need to be named according to the serve_url path, i.e. if the serve_url is specified as https://server.xyz.com/velociraptor_i386.exe then the file should be stored in public as velociraptor_i386.exe. If server_url is not specified then 'materialize' should generate the serve_url using the filestore_path.

The serve_url field and "Set Serve URL" button in the GUI currently doesn't seem to serve a purpose since it tries to download the file from the server_url value instead of the upstream URL.

predictiple avatar Sep 02 '21 13:09 predictiple