search

Velocidex / velociraptor

Digging Deeper....
https://docs.velociraptor.app/
Other
2.86k stars 478 forks source link

artifactset parameter GUI component can't handle large volume of artifacts #3621

Closed predictiple closed 1 month ago

predictiple commented 1 month ago

When there are too many artifacts in an artifact_type then the artifactset GUI component breaks with "Error: grpc: received message larger than max".

This will occur if you've imported the Exchange artifact set and/or very large artifacts such as Windows.Hayabusa.Rules. It is the total size of the artifacts that matter, not the number of artifacts.

The following simple artifact can be used to produce/test the error. With just the default built-ins it is fine, but after importing the Exchange or Windows.Hayabusa.Rules it is not.

name: Custom.ArtifactSet
parameters:
   - name: AvailableArtifacts
     type: artifactset
     artifact_type: CLIENT
     default: |
       Artifact
       Windows.Forensics.RecycleBin
       Demo.Plugins.GUI
sources:
  - query: |
        SELECT Artifact FROM AvailableArtifacts

Maybe it can be made to not read the artifacts in their entireity? As far as I can tell it really only needs to have the artifact name, description, and source names to operate.

Another suggestion is to have a regex filter on the list of available artifacts. The default values field allows us to specify which artifacts are pre-selected, but for artifact_type: CLIENT the list is so long that finding a specific artifact is not easy. If the list can be filtered that might solve the issue as well as making this feature more usable.

predictiple commented 1 month ago

Fixed in #3636