Initial Velociraptor Responder

[weslambert]

No description provided.

[dadokkio]

I'm trying to run the responder but I'm having some issues.
Some of the key of config yaml file your code is trying to access (ca_certificate, client_private_key, client_cert) in my case are nested under Client. I'm actually missing client_private and client_cert cause I'm running it locally I believe.

The error:

Traceback (most recent call last):  File "/opt/Cortex-Analyzers/responders/Velociraptor/velociraptor_flow.py", line 127, in <module>    Velociraptor().run()  File "/opt/Cortex-Analyzers/responders/Velociraptor/velociraptor_flow.py", line 24, in run    root_certificates=self.config["ca_certificate"].encode("utf8"),KeyError: 'ca_certificate'

My actual status:

>>> a = yaml.load(open('/tmp/client.config.yaml').read(), Loader=yaml.FullLoader)
>>> a.keys()
dict_keys(['version', 'Client'])
>>> a['Client'].keys()
dict_keys(['server_urls', 'ca_certificate', 'nonce', 'writeback_darwin', 'writeback_linux', 'writeback_windows', 'max_poll', 'windows_installer', 'darwin_installer', 'version', 'use_self_signed_ssl', 'pinned_server_name', 'max_upload_size', 'local_buffer'])

If it could be useful I'm using version 0.4.6, commit 1edf062

[weslambert]

Thanks for testing! Not sure at the moment -- I'll take a look at this and get back with you.

[weslambert]

@dadokkio , Did you make sure to generate the API client config like so?

velociraptor --config server.config.yaml config api_client --name Fred > api_client.yaml

or were you trying to use a normal client config (sounds like it from your mention of the nested Client entries)?

https://www.velocidex.com/docs/user-interface/api/

[dadokkio]

I didn't see that! I was using the basic config generate -i command.
I'm going to do a new test later 😃

[dadokkio]

Ok, after adding also API configuration everything works as expected.
Probably a readme with some indication could be useful.

[weslambert]

Awesome, will get on that as soon as I can!

[jeromeleonard]

Thanks @weslambert. FYI I included your PR from CortexDocs in a README.md file to support our new documentation (https://thehive-project.github.io/Cortex-Analyzers/)