fix: Temporarily disable artifact collection functionality with a placeholder response
taylorwalton committed
Nov 15, 2024 at 10:45 UTC
d519f1d1e8d6fdee54084d3d6ad1f235ce229965
1 file changed
+67
-61
backend/app/connectors/velociraptor/services/artifacts.py
+67
-61
@@ -179,67 +179,73 @@ async def run_file_collection(
179
RunAnalyzerResponse: A dictionary containing the success status and a message.
180
"""
181
velociraptor_service = await UniversalService.create("Velociraptor")
182
- try:
183
- # ! Can specify org_id with org_id='OL680' ! #
184
- query = create_query(
185
- (
186
- f"SELECT collect_client("
187
- f"org_id='{collect_artifact_body.velociraptor_org}', "
188
- f"client_id='{collect_artifact_body.velociraptor_id}', "
189
- f"artifacts=['{collect_artifact_body.artifact_name}'], "
190
- f"specs=[{{"
191
- f" 'artifact': '{collect_artifact_body.artifact_name}',"
192
- f" 'parameters': {{"
193
- f" 'env': ["
194
- f" {{'key': 'collectionSpec', 'value': '{collect_artifact_body.file}'}},"
195
- f" {{'key': 'Root', 'value': '{collect_artifact_body.root_disk}'}}"
196
- f" ]"
197
- f" }}"
198
- f"}}
199
- ]"
200
- f") "
201
- f"FROM scope()",
202
- ),
203
- )
204
- logger.info(f"Query: {query}")
205
- flow = velociraptor_service.execute_query(query, org_id=collect_artifact_body.velociraptor_org)
206
- logger.info(f"Successfully ran artifact collection on {flow}")
207
-
208
- artifact_key = get_artifact_key(analyzer_body=collect_artifact_body)
209
-
210
- flow_id = flow["results"][0][artifact_key]["flow_id"]
211
- logger.info(f"Extracted flow_id: {flow_id}")
212
-
213
- completed = velociraptor_service.watch_flow_completion(flow_id, org_id=collect_artifact_body.velociraptor_org)
214
- logger.info(f"Successfully watched flow completion on {completed}")
215
-
216
- results = velociraptor_service.read_collection_results(
217
- client_id=collect_artifact_body.velociraptor_id,
218
- flow_id=flow_id,
219
- org_id=collect_artifact_body.velociraptor_org,
220
- artifact=collect_artifact_body.artifact_name,
221
- )
222
-
223
- logger.info(f"Successfully read collection results on {results}")
224
-
225
- return CollectArtifactResponse(
226
- success=results["success"],
227
- message=results["message"],
228
- results=results["results"],
229
- )
230
- except HTTPException as he: # Catch HTTPException separately to propagate the original message
231
- logger.error(
232
- f"HTTPException while running artifact collection on {collect_artifact_body}: {he.detail}",
233
- )
234
- raise he
235
- except Exception as err:
236
- logger.error(
237
- f"Failed to run artifact collection on {collect_artifact_body}: {err}",
238
- )
239
- raise HTTPException(
240
- status_code=500,
241
- detail=f"Failed to run artifact collection on {collect_artifact_body}: {err}",
242
- )
182
+ return CollectArtifactResponse(
183
+ success=False,
184
+ message="Not yet implemented",
185
+ results=[],
186
+ )
187
+ # ! NOT YET READY ! #
188
+ # try:
189
+ # # ! Can specify org_id with org_id='OL680' ! #
190
+ # query = create_query(
191
+ # (
192
+ # f"SELECT collect_client("
193
+ # f"org_id='{collect_artifact_body.velociraptor_org}', "
194
+ # f"client_id='{collect_artifact_body.velociraptor_id}', "
195
+ # f"artifacts=['{collect_artifact_body.artifact_name}'], "
196
+ # f"specs=[{{"
197
+ # f" 'artifact': '{collect_artifact_body.artifact_name}',"
198
+ # f" 'parameters': {{"
199
+ # f" 'env': ["
200
+ # f" {{'key': 'collectionSpec', 'value': '{collect_artifact_body.file}'}},"
201
+ # f" {{'key': 'Root', 'value': '{collect_artifact_body.root_disk}'}}"
202
+ # f" ]"
203
+ # f" }}"
204
+ # f"}}
205
+ # ]"
206
+ # f") "
207
+ # f"FROM scope()",
208
+ # ),
209
+ # )
210
+ # logger.info(f"Query: {query}")
211
+ # flow = velociraptor_service.execute_query(query, org_id=collect_artifact_body.velociraptor_org)
212
+ # logger.info(f"Successfully ran artifact collection on {flow}")
213
+
214
+ # artifact_key = get_artifact_key(analyzer_body=collect_artifact_body)
215
+
216
+ # flow_id = flow["results"][0][artifact_key]["flow_id"]
217
+ # logger.info(f"Extracted flow_id: {flow_id}")
218
+
219
+ # completed = velociraptor_service.watch_flow_completion(flow_id, org_id=collect_artifact_body.velociraptor_org)
220
+ # logger.info(f"Successfully watched flow completion on {completed}")
221
+
222
+ # results = velociraptor_service.read_collection_results(
223
+ # client_id=collect_artifact_body.velociraptor_id,
224
+ # flow_id=flow_id,
225
+ # org_id=collect_artifact_body.velociraptor_org,
226
+ # artifact=collect_artifact_body.artifact_name,
227
+ # )
228
+
229
+ # logger.info(f"Successfully read collection results on {results}")
230
+
231
+ # return CollectArtifactResponse(
232
+ # success=results["success"],
233
+ # message=results["message"],
234
+ # results=results["results"],
235
+ # )
236
+ # except HTTPException as he: # Catch HTTPException separately to propagate the original message
237
+ # logger.error(
238
+ # f"HTTPException while running artifact collection on {collect_artifact_body}: {he.detail}",
239
+ # )
240
+ # raise he
241
+ # except Exception as err:
242
+ # logger.error(
243
+ # f"Failed to run artifact collection on {collect_artifact_body}: {err}",
244
+ # )
245
+ # raise HTTPException(
246
+ # status_code=500,
247
+ # detail=f"Failed to run artifact collection on {collect_artifact_body}: {err}",
248
+ # )
249
250
251
async def run_remote_command(run_command_body: RunCommandBody) -> RunCommandResponse: