Create velociraptor.py
taylor_socfortress committed
Jul 10, 2023 at 16:41 UTC
259a0f12e0a11f8d5a6e6ad3764c3268c8d93f36
1 file changed
+85
backend/app/routes/velociraptor.py
new
+85
@@ -0,0 +1,85 @@
1
+from flask import Blueprint, jsonify, request
2
+from loguru import logger
3
+from app.models.connectors import Connector, WazuhManagerConnector
4
+
5
+from app.services.agents.agents import AgentService, AgentSyncService
6
+from app.services.Velociraptor.artifacts import ArtifactsService
7
+from app.services.Velociraptor.universal import UniversalService
8
+
9
+bp = Blueprint("velociraptor", __name__)
10
+
11
+@bp.route("/velociraptor/artifacts", methods=["GET"])
12
+def get_artifacts():
13
+ """
14
+ Endpoint to list all available artifacts.
15
+ It processes each artifact to verify the connection and returns the results.
16
+
17
+ Returns:
18
+ json: A JSON response containing the list of all available artifacts along with their connection verification status.
19
+ """
20
+ service = ArtifactsService()
21
+ artifacts = service.collect_artifacts()
22
+ return artifacts
23
+
24
+@bp.route("/velociraptor/artifacts/linux", methods=["GET"])
25
+def get_artifacts_linux():
26
+ """
27
+ Endpoint to list all available artifacts.
28
+ It processes each artifact to verify the connection and returns the results where the name
29
+ begins with `Linux`.
30
+
31
+ Returns:
32
+ json: A JSON response containing the list of all available artifacts along with their connection verification status.
33
+ """
34
+ service = ArtifactsService()
35
+ linux_artifacts = service.collect_artifacts_linux()
36
+ return linux_artifacts
37
+
38
+@bp.route("/velociraptor/artifacts/windows", methods=["GET"])
39
+def get_artifacts_windows():
40
+ """
41
+ Endpoint to list all available artifacts.
42
+ It processes each artifact to verify the connection and returns the results where the name
43
+ begins with `Windows`.
44
+
45
+ Returns:
46
+ json: A JSON response containing the list of all available artifacts along with their connection verification status.
47
+ """
48
+ service = ArtifactsService()
49
+ windows_artifacts = service.collect_artifacts_windows()
50
+ return windows_artifacts
51
+
52
+@bp.route("/velociraptor/artifacts/mac", methods=["GET"])
53
+def get_artifacts_mac():
54
+ """
55
+ Endpoint to list all available artifacts.
56
+ It processes each artifact to verify the connection and returns the results where the name
57
+ begins with `MacOS`.
58
+
59
+ Returns:
60
+ json: A JSON response containing the list of all available artifacts along with their connection verification status.
61
+ """
62
+ service = ArtifactsService()
63
+ mac_artifacts = service.collect_artifacts_macos()
64
+ return mac_artifacts
65
+
66
+@bp.route("/velociraptor/artifacts/collection", methods=["POST"])
67
+def collect_artifact():
68
+ """
69
+ Endpoint to collect an artifact.
70
+ It collects the artifact name and client name from the request body and returns the results.
71
+
72
+ Returns:
73
+ json: A JSON response containing the list of all available artifacts along with their connection verification status.
74
+ """
75
+ req_data = request.get_json()
76
+ artifact_name = req_data["artifact_name"]
77
+ client_name = req_data["client_name"]
78
+ service = UniversalService()
79
+ client_id = service.get_client_id(client_name=client_name)["results"][0]["client_id"]
80
+ if client_id is None:
81
+ return jsonify({"message": f"{client_name} has not been seen in the last 30 seconds and may not be online with the Velociraptor server.", "success": False}), 500
82
+
83
+ artifact_service = ArtifactsService()
84
+ artifact_results = artifact_service.run_artifact_collection(client_id=client_id, artifact=artifact_name)
85
+ return artifact_results