| 1 | import type { |
| 2 | Artifact, |
| 3 | CollectResult, |
| 4 | CommandResult, |
| 5 | FileCollection, |
| 6 | MatchingParameter, |
| 7 | QuarantineResult, |
| 8 | Recommendation |
| 9 | } from "@/types/artifacts.d" |
| 10 | import type { OsTypesFull, OsTypesLower } from "@/types/common.d" |
| 11 | import type { FlaskBaseResponse } from "@/types/flask.d" |
| 12 | import { HttpClient } from "../httpClient" |
| 13 | |
| 14 | export interface ArtifactsQuery { |
| 15 | os?: OsTypesLower |
| 16 | hostname?: string |
| 17 | } |
| 18 | |
| 19 | export interface CollectRequest { |
| 20 | hostname: string |
| 21 | velociraptor_id?: string |
| 22 | artifact_name: string |
| 23 | data_store_only?: boolean |
| 24 | parameters?: { |
| 25 | env?: { |
| 26 | key: string |
| 27 | value: string |
| 28 | }[] |
| 29 | } |
| 30 | } |
| 31 | |
| 32 | export interface CommandRequest { |
| 33 | hostname: string |
| 34 | velociraptor_id?: string |
| 35 | command: string |
| 36 | artifact_name: "Windows.System.PowerShell" | "Windows.System.CmdShell" | "Linux.Sys.BashShell" |
| 37 | } |
| 38 | |
| 39 | export interface QuarantineRequest { |
| 40 | hostname: string |
| 41 | velociraptor_id?: string |
| 42 | action: "quarantine" | "remove_quarantine" |
| 43 | artifact_name: "Windows.Remediation.Quarantine" | "Linux.Remediation.Quarantine" |
| 44 | } |
| 45 | |
| 46 | export interface ArtifactRecommendationRequest { |
| 47 | os: OsTypesFull |
| 48 | prompt: string | object |
| 49 | } |
| 50 | |
| 51 | export interface FileCollectionByAgentRequest { |
| 52 | file: string |
| 53 | root_disk: string |
| 54 | } |
| 55 | |
| 56 | export default { |
| 57 | getAll(filters?: ArtifactsQuery) { |
| 58 | let url = "/artifacts" |
| 59 | |
| 60 | if (filters?.os) { |
| 61 | url = `/artifacts/${filters.os}` |
| 62 | } |
| 63 | if (filters?.hostname) { |
| 64 | url = `/artifacts/hostname/${filters.hostname}` |
| 65 | } |
| 66 | |
| 67 | return HttpClient.get<FlaskBaseResponse & { artifacts: Artifact[] }>(url) |
| 68 | }, |
| 69 | getByName(artifactName: string) { |
| 70 | return HttpClient.get<FlaskBaseResponse & { artifacts: Artifact[] }>(`/artifacts/artifact/${artifactName}`) |
| 71 | }, |
| 72 | collect(payload: CollectRequest) { |
| 73 | return HttpClient.post<FlaskBaseResponse & { results: CollectResult[] }>(`/artifacts/collect`, payload) |
| 74 | }, |
| 75 | command(payload: CommandRequest) { |
| 76 | return HttpClient.post<FlaskBaseResponse & { results: CommandResult[] }>(`/artifacts/command`, payload) |
| 77 | }, |
| 78 | quarantine(payload: QuarantineRequest) { |
| 79 | return HttpClient.post<FlaskBaseResponse & { results: QuarantineResult[] }>(`/artifacts/quarantine`, payload) |
| 80 | }, |
| 81 | getArtifactRecommendation(payload: ArtifactRecommendationRequest) { |
| 82 | return HttpClient.post<FlaskBaseResponse & { recommendations: Recommendation[] }>( |
| 83 | `/artifacts/velociraptor-artifact-recommendation`, |
| 84 | payload |
| 85 | ) |
| 86 | }, |
| 87 | getParameters(artifactName: string, parameterPrefix: string) { |
| 88 | return HttpClient.get< |
| 89 | FlaskBaseResponse & { |
| 90 | artifact_name: string |
| 91 | parameter_prefix: string |
| 92 | matching_parameters: MatchingParameter[] |
| 93 | total_matches: number |
| 94 | } |
| 95 | >(`/artifacts/artifact/${artifactName}/parameters/${parameterPrefix}`) |
| 96 | }, |
| 97 | collectFileByAgentId(agentId: string, payload: FileCollectionByAgentRequest) { |
| 98 | return HttpClient.post<FlaskBaseResponse & FileCollection>(`/artifacts/collect/file/agent/${agentId}`, payload) |
| 99 | } |
| 100 | } |