VQL and API - MSI creation

[Paolo Leoni Work]

Hi everyone, I have a question about API and VQL integration.

With this query, the org config param is read from the selected scope on frontend:

LET Build(Target) = repack(
    upload_name=format(
      format='Org_%v_%v',
      args=[org().name, inventory_get(tool=Target).Definition.filename]),
    target=Target,
    config=serialize(format='yaml', item=org()._client_config))

SELECT *
FROM chain(
  a={
    SELECT Build(Target="VelociraptorWindowsMSI")
    FROM scope()
  },
  b={
    SELECT Build(Target="VelociraptorWindows_x86MSI")
    FROM scope()
    WHERE AlsoBuild_x86
  })


How can I refer to a specific ORG using API when I run this server artifact (Server.Utils.CreateMSI)?

Thank you.

~p

[Mike Cohen]

You just pass the org id in the API call itself

https://github.com/Velocidex/pyvelociraptor/blob/a7a3fb8467c8fc6740d96d30d4aca3c1731f82f6/pyvelociraptor/client_example.py#L71

The API runs a query in the context of the caller on the specified org. The user must have appropriate permissions in that org to run

Thanks

Mike

Mike Cohen  Digital Paleontologist,  Velocidex Enterprises E mi...@velocidex.com

--
You received this message because you are subscribed to the Google Groups "velociraptor-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to velociraptor-dis...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/velociraptor-discuss/CA%2Br9BfKwcE5c%2BHrtrYXQ40zRsE5hFnKvQ%2BGtsgqSt7jj6UULEg%40mail.gmail.com.

[Paolo Leoni Work]

Thank you for the help Mike.

Can I pass org_id argument also to velociraptor-v0.XY.Z-windows-amd64.exe?

e.g. adding org_id arg to this command:

.\velociraptor-v0.XY.Z-windows-amd64.exe  --api_config "api_config.yaml" query "<QUERY>" --format jsonl

I ask because on my env I can't use Python.

Thanks in advance.

~p

[Mike Cohen]

You should be able to specify the target org using the `--org ORGID` flag.

You can see all the options you can set with the query command using the -h flag for help

Mike Cohen  Digital Paleontologist,  Velocidex Enterprises E mi...@velocidex.com

[Paolo Leoni Work]

Now It's ok. 

Thank you Mike for your great support.

~p