pool/velociraptor
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6b715abe43
velociraptor/velociraptor.changes
Jeff Mahoney 6b715abe43 Accepting request 976815 from home:jeff_mahoney:branches:security:sensor 
- Update to version 0.6.4~git26.4407b9b7:
  * Add artifact for chattrsnoop plugin
  * bpflib: ensure it's built only on linux and when requesting bpf
  * Add chattrsnoop plugin
  * tcpsnoop: Properly close module in case of attach error
  * Add artifacts for dns/tcp snoop plugins
  * tcpsnoop: Add timestamp to generated events
  * dnssnoop: Add timestamp to generated events

- Update to version 0.6.4~git26.4407b9b7:
  * Add artifact for chattrsnoop plugin
  * bpflib: ensure it's built only on linux and when requesting bpf
  * Add chattrsnoop plugin
  * tcpsnoop: Properly close module in case of attach error
  * Add artifacts for dns/tcp snoop plugins
  * tcpsnoop: Add timestamp to generated events
  * dnssnoop: Add timestamp to generated events

OBS-URL: https://build.opensuse.org/request/show/976815
OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=15
2022-05-12 17:50:00 +00:00

414 lines
20 KiB
Plaintext
Raw Blame History

-------------------------------------------------------------------
Thu May 12 13:30:42 UTC 2022 - jeffm@suse.com
- Update to version 0.6.4~git26.4407b9b7:
* Add artifact for chattrsnoop plugin
* bpflib: ensure it's built only on linux and when requesting bpf
* Add chattrsnoop plugin
* tcpsnoop: Properly close module in case of attach error
* Add artifacts for dns/tcp snoop plugins
* tcpsnoop: Add timestamp to generated events
* dnssnoop: Add timestamp to generated events
-------------------------------------------------------------------
Tue May 3 20:35:57 UTC 2022 - Jeff Mahoney <jeffm@suse.com>
- Fix error handling in tcpsnoop and dnssnoop.
* If BTF information is unavailable, there is no indication that the
query has failed.
-------------------------------------------------------------------
Tue May 3 13:45:09 UTC 2022 - Jeff Mahoney <jeffm@suse.com>
- Rebase on 0.6.4:
* Updated dependencies
* Bugfix: startup bugs (#1680)
* bugfix: Server event notebook not correctly created (#1737)
* Bugfix: Start a dummy indexing service (#1736)
* Add bugfix which would return no rows if the user removed whitelist (#1735)
* Fixed bug in read_reg_key (#1734)
* BUGFIX: Do not include config flag when darwin installer is repacked (#1733)
* Refactored index into its own service. (#1730)
* Bugfix: Write one index item per JSONL record. (#1727)
* Bugfix: Estimating client impact should consider last active status (#1726)
* Add complete ntfs metadata option to MFT output (#1725)
* Various bugfixes. (#1724)
* Update Usn.yaml (#1723)
* Fixed a bug in hunt download preparation. (#1722)
* Add Windows.Forensics.Usn filter and presentation updates (#1720)
* Optimize writing event monitoring records (#1721)
* Add Generic.Detection.Yara.Zip (#1718)
* Fixed crash on master-pong response. (#1719)
* Remove _type option from elastic. (#1715)
* Opportunistically update directly connected client's ping times (#1713)
* Fixed a bug in hunt download preparation. (#1722)
* Add Windows.Forensics.Usn filter and presentation updates (#1720)
* Optimize writing event monitoring records (#1721)
* Add Generic.Detection.Yara.Zip (#1718)
* Fixed crash on master-pong response. (#1719)
* Remove _type option from elastic. (#1715)
* Opportunistically update directly connected client's ping times (#1713)
* Fixed bug in VQL cell splitting. (#1712)
* artifact for parsing macos packages (#1706)
* Bugfix: Create a cell for each collected source (#1710)
* artifact for parsing macos packages (#1706)
* Bugfix: Create a cell for each collected source (#1710)
* Added Server.Utils.CollectClient to simplify direct collections (#1708)
* fix: gui/velociraptor/package.json & gui/velociraptor/package-lock.json to reduce vulnerabilities (#1705)
* Fix build on Go 1.18 (#1704)
* build(deps): bump minimist from 1.2.5 to 1.2.6 in /gui/velociraptor (#1703)
* Mft update - add uSecZeros (#1701)
* Server monitoring service will reload if an artifact is modified (#1702)
* Refactor client info manager (#1700)
* A number of bugfixes (#1699)
* Update Windows.NTFS.MFT (#1698)
* Actually export HumanString attribute on OSPath (#1689)
* RHEL/CentOS/Fedora dnf packages (#1684)
* Implemented Human Readable OSPath method. (#1688)
* Added lazy MFT attributes (#1685)
* Maintain OSPath in mft artifacts (#1683)
* Fix bug in deaddisk remapping of directories. (#1682)
* Bugfix: startup bugs (#1680)
* Updated SQLECmd artifacts (#1677)
* Artifact repository needs to watch for changes across nodes. (#1676)
* Update auto accessor to re-open file with ntfs if read failed (#1674)
* Fix MacOS.System.Plist artifact (#1673)
* Error collection based on VQL logs (#1672)
* Add memory limiting to offline collector (#1666)
* Allow mount overlays (#1664)
* build(deps): bump node-forge from 1.2.1 to 1.3.0 in /gui/velociraptor (#1661)
* Fixed bugs in remapping logic. (#1660)
* Fixed bug in the windows auto accessor. (#1658)
* Elastic.Events.Clients: synchronize parameters with Elastic.Flows.Upload (#1657)
* Add initial commit for Windows.NTFS.ExtendedAttributes (#1656)
* Added a shadow remapping type (#1655)
* Implemented an event notebook (#1654)
* Add Windows.System.WMIQuery (#1651)
* Fixed data race in progress throttler. (#1653)
* Implemented timeout and cpu limits on offline collector. (#1650)
* Added an rpm server command. (#1647)
* Artifacts can now define suggestions for notebook cells. (#1646)
* Allow multiple OIDC authenticators to be specified. (#1645)
* Added a multi authenticator. (#1644)
* Add HashHunter hash() update for performance (#1643)
* Change the DNSCache Artifact to WMI (#1640)
* Added an uploader for notebooks. (#1639)
* Added hashselect arg option to hash() (#1637)
* Add Generic.Detection.HashHunter and tests (#1638)
* Added Generic.Collectors.SQLECmd (#1635)
* Add BinaryHunter (#1634)
* String artifact parameters can now have validator regex (#1628)
* Implemented CPU rate limited for better control (#1622)
* Added a client nanny to detect deadlocks (#1621)
* Linux.Sys.Services artifact, parse services from systemctl (#1619)
* Collect MAC addresses during interrogation and index them (#1611)
* Allow parse_ntfs() to operate on an image file. (#1610)
* Fix regression in VFSGetBuffer (#1605)
* Added rekey() VQL function (#1604)
* switch to uninstall string (#1603)
* freebsd /etc/rc.d/velociraptor service script (#1602)
* Add Windows.Registry.BackupRestore (#1601)
* Optimized NTFS code for better speed and added more fields to parse_mft (#1599)
* Update BinaryRename.yaml (#1598)
* Added LinuxM1 (#1597)
* Add explicit check of sticky keys (#1592)
* Remote data store should identify retryable errors (#1590)
* fix: gui/velociraptor/package.json & gui/velociraptor/package-lock.json to reduce vulnerabilities (#1588)
* Add test improvement clear system log (#18) (#1586)
* Modified Windows.Forensics.Prefetch to use VQL binary parser (#1585)
* add Windows.NTFS.ADSHunter first commit (#17) (#1583)
* Resolves Velocidex/velociraptor#1543 Create new VQL entropy() function (#1574)
* Remove C time and updating naming (#1546)
* fix: gui/velociraptor/package.json & gui/velociraptor/package-lock.json to reduce vulnerabilities (#1568)
* Update OSPath protocols to support slices. (#1575)
* Implement array slice notation in VQL and Server.Import.PreviousReleases (#1573)
* add rtf TemplateInjection to Windows.Detection.TemplateInjection (#1572)
* Change accessors API to deal with OSPath objects directly. (#1570)
* Bump follow-redirects from 1.14.4 to 1.14.8 in /gui/velociraptor (#1567)
* Added a deaddisk command to generate config (#1564)
* Fix bug in Windows.System.Services (#1565)
* Fixed glob expand braces order of operations. (#1560)
* Added an offset and raw_file accessors (#1559)
* Update CertUtil.yaml (#1558)
* remove users to include the system path (#1536)
* Implement remap() VQL function and remapping config (#1555)
* Make GitHub actions more flexible on Windows (#1549)
* Bump normalize-url from 4.5.0 to 4.5.1 in /gui/velociraptor (#1548)
* Fix typo (#1547)
* Refractor of accessors and path manipulations (#1545)
* Dns etw update (#1544)
* add PowershellProfile (#1542)
* Added dynamic pubsub attributes (#1540)
* Fix Windows.Applications.Chrome.History (#1539)
* windows.application to windows.applications merge. New firefox history artefact (#1534)
* Fixed race condition in zip accessor reference counting. (#1531)
* Added Windows.Persistence.SilentProcessExit (#1530)
* Add limitations section and lastwrite timestamp (#1529)
* Offline collector FetchBinary should respect the IsExecutable flag (#1528)
* update description, order by, and hidden keypath (#1527)
* add limitations section (#1520)
* Avoid holding index lock for too long. (#1519)
* re-introduce Windows.Collectors.File with deprecation note (#1516)
* add limitations to description and key path to query (#1514)
* Retry remote datastore connections (#1513)
* Write minion log files and autocert in its own dir. (#1512)
* Synced KapeFiles artifacts (#1511)
* Added data retention server artifacts (#1510)
* Set an upper limit for ttl in memcache (#1508)
* Add updates to Windows.System.Services (#15) (#1509)
* Ensure collector container is properly closed when interrupted. (#1507)
* Continually rebuild the index at runtime. (#1506)
* Harder vacuum - directly move client task directories to the attic. (#1505)
* add limitation disclaimer (#1504)
* Reduce critial section to avoid deadlock in repository manager (#1503)
* Implemented a vacuum command to remove old tasks from client queues. (#1501)
* Better format profile metrics output. (#1495)
* Cap size of directories and report large directories. (#1493)
* Set ACE completers per editor to avoid global state. (#1492)
* Add HttpOnly flag to all cookies. (#1491)
* Refactor completion routine calls (#1490)
* Limit size of cached directories. (#1483)
* Add more instrumentation to memory caches. (#1482)
* Fixed chart resizing bug (#1481)
* Removed the old queries: list from artifacts. (#1480)
* [Snyk] Fix for 9 vulnerabilities (#1479)
* Remove lock around critical section. (#1478)
* Added MacOS.Forensics.AppleDoubleZip (#1476)
* Update Windows.Persistence.PermanentWMIEvents to add blind custom namespace detection (#13) (#1475)
* Make index snapshot frequency configurable (#1474)
* Bugfix: Setting notebook index did not escape username (#1471)
* Flush index from memory to disk (#1470)
* Fixed 2 bugs with the memcache file store (#1469)
* Update flow active time when the result set is completed (#1468)
* Tag artifacts as built ins (#1467)
* Fixed bug in the pathspec() VQL function. (#1465)
* fix APIConfigLoader not applying command line args (#1463)
-------------------------------------------------------------------
Mon May 02 14:55:07 UTC 2022 - jeffm@suse.com
- Resync with git repository:
* Add artifact to monitor user group updates (#24)
* Add dnssnoop plugin (#15)
* Log Sudo/root command by auditd
* Add custom artifacts for login and logout attempts recorded by auditd
-------------------------------------------------------------------
Fri Mar 18 14:12:59 UTC 2022 - jeffm@suse.com
- Update to version 0.6.3~git19.640f7a1c:
* Add tcpsnoop plugin
-------------------------------------------------------------------
Tue Mar 15 13:31:21 UTC 2022 - jeffm@suse.com
- Update to version 0.6.3~git17.741ebb59:
* kafka-humio-gateway: update README.md
* kafka-humio-gateway: Fix missing variable rename
* Add Kafka-Humio Gateway [Depends on PR#10] (#8)
-------------------------------------------------------------------
Tue Mar 15 01:04:29 UTC 2022 - jeffm@suse.com
- Update to version 0.6.3~git13.af7fdb00:
* SUSE: Add SSHLogin artifacts
* Add a Kafka export plugin
* SUSE: Do build tests on every pull request
* Add systemd-dev as build dependency for github workflow
-------------------------------------------------------------------
Fri Feb 18 00:52:01 UTC 2022 - jeffm@suse.com
- Update to version 0.6.3~git6.d95ed32e:
* Update the Linux.Events.SSHLogin artifact to scan the systemd journal
* Update the Linux.Syslog.SSHLogin artifact to scan the systemd journal
* Add parser to read systemd journal on Linux
* Add an artifact to enumerate immutable files under a path
* Add chattr function support for linux
* Make GitHub actions more flexible on Windows
-------------------------------------------------------------------
Thu Feb 10 02:12:54 UTC 2022 - Jeff Mahoney <jeffm@suse.com>
- Add simple default configs and provide dirs in /var/lib for client
and server.
-------------------------------------------------------------------
Mon Feb 7 14:40:47 UTC 2022 - Jeff Mahoney <jeffm@suse.com>
- Temporarily re-enable Windows artifacts (LSS#4).
-------------------------------------------------------------------
Wed Feb 2 18:10:19 UTC 2022 - Jeff Mahoney <jeffm@suse.com>
- Added systemd unit file and placeholder config file.
-------------------------------------------------------------------
Thu Jan 27 17:33:45 UTC 2022 - jeffm@suse.com
- Update to version 0.6.3~git0.69e0fffa:
* Prepare for 0.6.3 release (#1515)
* add limitations to description and key path to query (#1514)
* Retry remote datastore connections (#1513)
* Write minion log files and autocert in its own dir. (#1512)
* Synced KapeFiles artifacts (#1511)
* Added data retention server artifacts (#1510)
* Set an upper limit for ttl in memcache (#1508)
* Add updates to Windows.System.Services (#15) (#1509)
* Ensure collector container is properly closed when interrupted. (#1507)
* Continually rebuild the index at runtime. (#1506)
* Harder vacuum - directly move client task directories to the attic. (#1505)
* add limitation disclaimer (#1504)
* Reduce critial section to avoid deadlock in repository manager (#1503)
* Implemented a vacuum command to remove old tasks from client queues. (#1501)
* Better format profile metrics output. (#1495)
* Cap size of directories and report large directories. (#1493)
* Set ACE completers per editor to avoid global state. (#1492)
* Add HttpOnly flag to all cookies. (#1491)
* Refactor completion routine calls (#1490)
* fix: upgrade react-bootstrap from 1.3.0 to 1.6.4 (#1486)
* fix: upgrade http-proxy-middleware from 1.0.5 to 1.3.1 (#1485)
* fix: upgrade react-ace from 9.1.3 to 9.5.0 (#1487)
* fix: upgrade recharts from 2.0.9 to 2.1.8 (#1488)
* fix: upgrade react-datetime-picker from 3.0.4 to 3.4.3 (#1489)
* Limit size of cached directories. (#1483)
* Add more instrumentation to memory caches. (#1482)
* Fixed chart resizing bug (#1481)
* Removed the old queries: list from artifacts. (#1480)
* [Snyk] Fix for 9 vulnerabilities (#1479)
* Remove lock around critical section. (#1478)
* Added MacOS.Forensics.AppleDoubleZip (#1476)
* Update Windows.Persistence.PermanentWMIEvents to add blind custom namespace detection (#13) (#1475)
* Make index snapshot frequency configurable
* fix APIConfigLoader not applying command line args (#1463)
* Flush index from memory to disk (#1470)
* Prepare RC2 (#1473)
* Bugfix: Setting notebook index did not escape username (#1471)
* Fixed 2 bugs with the memcache file store (#1469)
* Update flow active time when the result set is completed (#1468)
* Tag artifacts as built ins (#1467)
* Fixed bug in the pathspec() VQL function. (#1465)
* Update PrivateKeys.yaml (#1459)
* Added recursion_callback option to the glob plugin (#1461)
* Added config wizard for multi-frontend configuration (#1460)
* Calculate the sha256 hash of the offline container. (#1458)
* Artifact inspection GUI now allows pivot. (#1457)
* Client certs can now be specified in the config file. (#1456)
* New Upload File Form element (#1455)
* Added a sparse accessor (#1453)
* Hunt wizard estimates clients affected (#1452)
* Make the interrogation process customizable. (#1451)
* Update Info.yaml (#1427)
* Improved Lnk parser to include additional fields. (#1449)
* Added a Yara GUI element editor. (#1447)
* Added patch and merge to `config show` and `config generate` (#1445)
* Remove usage of FatalIfError from main module (#1443)
* Introduced a dedicated pathspec object (#1440)
* Bump is-svg from 4.2.2 to 4.3.0 in /gui/velociraptor (#1437)
* Only pass client config in the client VQL scope. (#1436)
* rework protobuf message generator (#1435)
* Update Autoruns.yaml
* Added test for filefinder (#1431)
* fix filters in filefinder artifact (#1430)
* Add Artifact to collect KapeFile targets on Linux (#1426)
* Enabled lazy quotes on csv parser (#1424)
* Fixed bug in client comms. (#1423)
* Add document filter for better usability (#1421)
* Added resource information to the output of parse_pe() (#1420)
* Low latency client connectivity discovery (#1419)
* Add RecentDocs collection (#1416)
* Update Amcache artifact for clarity (#1415)
* Added extra parameters to parse_csv() (#1413)
* Added netcat plugin to read from socket (#1412)
* Updated SRUM with Network Usage and Upload option (#1408)
* Synced darwin and freebsd file accessor with the linux one. (#1409)
* Added Windows.Forensics.SAM artifact (#1404)
* Initial artifacts can be specified in config (#1403)
* Add conhost.exe to binary rename (#1402)
* Add update Prefetch Btime execution fix (#1398)
* Update Prefetch timeline (#1397)
* Cleanup search API (#1396)
* Update protobuf dependencies. (#1394)
* More multi-frontend optimizations (#1393)
* Client info manager now keeps track of scheduled tasks. (#1392)
* add sid and lookupsid plugin (#1388)
* Add Mutant whitelist (#1387)
* Notify currently connected clients on new hunts (#1386)
* Index rebuild command loads new index service. (#1385)
* Changes to support distributed architecture. (#1384)
* Added procdump and procdump64 (#1382)
* Fixed heavy mutex contention in the labeler. (#1375)
* Add shellcode to CobaltStrike carver (#10) (#1373)
* Added an index rebuild command. (#1369)
* GUI artifact form was ignoring the friendly name attribute (#1368)
* Added a specialized form element for regex parameters. (#1367)
* Added a gRPC based remote datastore (#1366)
* Display all subauthorities for GUID in SRUM (#1365)
* Verify all gRPC peer certificates were signed by the Velociraptor CA (#1362)
* Implemented MemcacheFileDatastore - memory caching with file backend (#1361)
* Added new plugins to manipulate event tables easier. (#1355)
* Refactored in memory datastore to be more efficient. (#1353)
* Sync vfilter (#1351)
* Add both fqdn and hostname to the client search table (#1350)
* BUGFIX: Datastore on windows is unable to represent files with . (#1348)
* Added buffer_size parameter to parse_records_with_regex() (#1347)
* Propagate column types from artifact to flow notebook. (#1346)
* Cobalt parser update (#1345)
* Allow listener to not use file buffer. (#1344)
* Fix Deployment documentation link in README (#1343)
* Preserve uint64 types across Listener (#1341)
* Fix spelling (#1339)
* Refactored queue listener to preserve order. (#1340)
* Added a magic() VQL function (#1338)
* Fixed bug in CSS (#1337)
-------------------------------------------------------------------
Thu Jan 27 17:27:42 UTC 2022 - jeffm@suse.com
- Update to version 0.6.2~git0.8dd598b2:
* Update ese parser to fix timestamp bug
* Prepare final 0.6.2 release (#1363)
* Verify all gRPC peer certificates were signed by the Velociraptor CA
* Removed search index parallelism (#1358)
* Added new plugins to manipulate event tables easier. (#1355)
* Sync vfilter (#1351)
* Add both fqdn and hostname to the client search table (#1350)
* BUGFIX: Datastore on windows is unable to represent files with . (#1348)
* Added buffer_size parameter to parse_records_with_regex() (#1347)
* Propagate column types from artifact to flow notebook. (#1346)
-------------------------------------------------------------------
Thu Jan 06 20:14:39 UTC 2022 - jeffm@suse.com
- Update to version 0.6.2~git73.dc02b45e:
* Update PrivateKeys.yaml (#1459)
* Added recursion_callback option to the glob plugin (#1461)
* Added config wizard for multi-frontend configuration (#1460)
* Calculate the sha256 hash of the offline container. (#1458)
* Artifact inspection GUI now allows pivot. (#1457)
* Client certs can now be specified in the config file. (#1456)
* New Upload File Form element (#1455)
* Added a sparse accessor (#1453)
* Hunt wizard estimates clients affected (#1452)
* Make the interrogation process customizable. (#1451)
-------------------------------------------------------------------
Tue Dec 21 20:25:43 UTC 2021 - Jeff Mahoney <jeffm@suse.com>
- Disable Windows artifacts. We don't target Windows endpoints and
the queries clutter the GUI.
-------------------------------------------------------------------
Thu Dec 16 14:12:05 UTC 2021 - Jeff Mahoney <jeffm@suse.com>
- Switch to using master branch via service files.
- Added update-vendoring.sh to update the nodejs and go dependencies
after version update.
- Patch the version string to reflect the package version instead
of an indistinguishable <next-tag>-dev.
-------------------------------------------------------------------
Thu Dec 2 01:46:34 UTC 2021 - Jeff Mahoney <jeffm@suse.com>
- Initial packaging.
Reference in New Issue View Git Blame Copy Permalink