Package request: velociraptor

[felbinger]

Project description

Velociraptor is an advanced digital forensic and incident response tool. It helps to collect host based state information using The Velociraptor Query Language (VQL) queries.

It was developed by Digital Forensic and Incident Response professionals who needed a powerful and efficient way to hunt for specific artifacts and monitor activities across fleets of endpoints. Velociraptor provides you with the ability to more effectively respond to a wide range of digital forensic and cyber incident response investigations and data breaches:

• Reconstruct attacker activities through digital forensic analysis
• Hunt for evidence of sophisticated adversaries
• Investigate malware outbreaks and other suspicious network activities
• Monitory continuously for suspicious user activities, such as files copied to USB devices
• Discover whether disclosure of confidential information occurred outside the network
• Gather endpoint data over time for use in threat hunting and future investigations

It would be nice to have both: the package for gui usage and a service for webservers (velociraptor frontend, as in the docker deployment).

Metadata

• homepage URL: https://docs.velociraptor.app/
• source URL: https://github.com/Velocidex/velociraptor
• license: AGPL-3.0
• platforms: unix, linux, darwin, ...

---

Add a :+1: reaction to issues you find important.

[ByteSudoer]

Hello @felbinger. here is the derivation so far:

{ lib
, buildGoModule
, buildNpmPackage
, fetchFromGitHub
, makeWrapper
}:

let
  pname = "velociraptor";
  version = "0.7.1";

  src = fetchFromGitHub {
    repo = "velociraptor";
    owner = "Velocidex";
    rev = "refs/tags/v${version}";
    hash = "sha256-NjWhfSTW1Uh9hSCXHEBLTIY/uUG4d3k/aWzjJpg1tas=";
  };

  gui = buildNpmPackage {
    inherit pname version;
    src = "${src}/gui/velociraptor";
    npmDepsHash = "sha256-7WFnv++pjpqLxMpFUAG5PZ75htTbyw28Re0JbmOl+1U=";

    buildPhase = ''
      runHook preBuild
        npm install
        make build
      runHook postBuild
    '';
    installPhase = ''
    runHook preInstall
      mkdir $out
      mv build $out
    runHook postInstall
    '';
  };
in

buildGoModule rec {
  inherit src pname version gui;

  vendorHash = "sha256-P0X5fHs4HsJCj7vOWZVkiyEuWz9p3lQoWyPPuQRrrBY=";

  preBuild = ''
    cp -r ${gui}/build gui/velociraptor
  '';

  nativeBuildInputs = [
    makeWrapper
  ];

  meta = with lib;{

  };
}

when building the package I get the following errors: If you are more familiar with GO you might find a solution because cloning the upstream repo and building it manually results in no errors. Thx