Rename host?

[Xavier Mertens]

Hi *,

Another issue that I’m facing…
A customer deployed Velociraptor on multiple hosts on his side. They joined my server but… many clients have the same Hostname!?
Is there a way to rename a hostname in the server?

[Mike Cohen]

The hostname is what is reported by the client itself. Are you saying that they are actually different machines but have the same hostname? or maybe it really is the same host but velociraptor is re-enrolling all the time with a different client id?

We dont use the hostname to identify machines internally for this reason - the hostname is not a sufficiently unique identifier. If you really have multiple hosts with the same name you may be able to just label them differently so you can distinguish them in the GUI

Thanks

Mike

Mike Cohen  Digital Paleontologist,  Velocidex Enterprises E mi...@velocidex.com

--
You received this message because you are subscribed to the Google Groups "velociraptor-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to velociraptor-dis...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/velociraptor-discuss/AE17B243-7803-4BA0-B38C-357266DEBC22%40gmail.com.

[Xavier Mertens]

Hi Mike,

Sorry for the late reply, I was pretty busy the last days.

Yes, multiple machines with the Velociraptor client deployed are joining my server with the same name but, hopefully, with different Client.ID’s.

This means that I need to lookup the internet IP address to be able to communicate with the customer when we discuss about a host :-)

/x

[Mike Cohen]

You could use a MAC address to uniquely identify the machine.

The local IP address is also reported in Generic.Client.Info/WindowsInfo

Mike Cohen  Digital Paleontologist,  Velocidex Enterprises E mi...@velocidex.com