Server Side

Velociraptor provides complete control of the server within VQL queries. On the server, the VQL engine contains the following plugins and functions. You can use this functionality to manage and automate the server by writing VQL queries.

To reuse server side artifacts, simply create an artifact with type: SERVER and launch it from the “Server Artifacts” screen in the GUI.

Plugin/FunctionTypeDescription
add_client_monitoringFunctionAdds a new artifact to the client monitoring table
add_server_monitoringFunctionAdds a new artifact to the server monitoring table
artifact_definitionsPluginDump artifact definitions from the internal repository
artifact_deleteFunctionDeletes an artifact from the global repository
artifact_setFunctionSets an artifact into the global repository
cancel_flowFunctionCancels the flow
cidr_containsFunctionCalculates if an IP address falls within a range of CIDR specified
client_deletePluginDelete all information related to a client from the filestore
client_infoFunctionReturns client info (like the fqdn) from the datastore
client_metadataFunctionReturns client metadata from the datastore
client_set_metadataFunctionSets client metadata
clientsPluginRetrieve the list of clients
collect_clientFunctionLaunch an artifact collection against a client
compressFunctionCompress a file
create_flow_downloadFunctionCreates a download pack for the flow
create_hunt_downloadFunctionCreates a download pack for a hunt
elastic_uploadPluginUpload rows to elastic
enumerate_flowPluginEnumerate all the files that make up a flow
favorites_deleteFunctionDelete a favorite
favorites_saveFunctionSave a collection into the favorites
file_storeFunctionResolves file store paths into full filesystem paths
file_store_deleteFunctionDelete file store paths
flow_resultsPluginRetrieve the results of a flow
flowsPluginRetrieve the flows launched on each client
gcs_pubsub_publishFunctionPublish a message to Google PubSub
geoipFunctionLookup an IP Address using the MaxMind GeoIP database
get_client_monitoringFunctionRetrieve the current client monitoring state
get_server_monitoringFunctionRetrieve the current server monitoring state
gui_usersPluginRetrieve the list of users on the server
huntFunctionCreate and launch a hunt
hunt_addFunctionAssign a client to a hunt
hunt_flowsPluginRetrieve the flows launched by a hunt
hunt_resultsPluginRetrieve the results of a hunt
huntsPluginRetrieve the list of hunts
import_collectionFunctionImports an offline collection zip file (experimental)
inventoryPluginRetrieve the tools inventory
inventory_addFunctionAdd or reconfigure a tool into the inventory
inventory_getFunctionGet tool info from inventory service
labelFunctionAdd the labels to the client
mailPluginSend Email to a remote server
monitoringPluginExtract monitoring log from a client
notebook_deletePluginDelete a notebook with all its cells
parallelizePluginRuns query on result batches in parallel
patchFunctionPatch a JSON object with a json patch or merge
rateFunctionCalculates the rate (derivative) between two quantities
rm_client_monitoringFunctionRemove an artifact from the client monitoring table
rm_server_monitoringFunctionRemove an artifact from the server monitoring table
samplePluginExecutes ‘query’ and samples every n’th row
server_metadataFunctionReturns server metadata from the datastore
server_set_metadataFunctionSets server metadata
set_client_monitoringFunctionSets the current client monitoring state
set_server_monitoringFunctionSets the current server monitoring state
sourcePluginRetrieve rows from an artifact’s source
splunk_uploadPluginUpload rows to splunk
timelinePluginRead a timeline
timeline_addFunctionAdd a new query to a timeline
upload_directoryFunctionUpload a file to an upload directory
uploadsPluginRetrieve information about a flow’s uploads
user_createFunctionCreates a new user from the server, or updates their permissions or reset their password
user_deleteFunctionDeletes a user from the server