search

socfortress / CoPilot

SOCFortress CoPilot
https://www.socfortress.co
GNU Affero General Public License v3.0
155 stars 25 forks source link

Copilot Not Executing Queries Against Velociraptor Orgs #253

Closed ccben87 closed 1 week ago

ccben87 commented 1 week ago

Describe the bug Copilot does not connect to Velociraptor orgs, it only connects to root org. This is the case even after manually applying a Velociraptor ID to an agent. When executing a Velociraptor query it runs in the root org and therefore fails to work.

To Reproduce Steps to reproduce the behavior:

  1. Create Org in Velociraptor and assign copilot user to it
  2. Add Velociraptor client to new Velociraptor org
  3. Configure agent in Copilot to set the Velociraptor ID.
  4. Run an Artifact in Copilot which times out
  5. Check Velociraptor to find the Artifact ran in root org

Expected behavior Artifact should run on the Velociraptor org that matches the customer code.

Screenshots N/A

**Container Logs N/A

ccben87 commented 1 week ago

Looks like the current code doesn't use orgs at all in Velociraptor. @taylorwalton it would be good to know what you would use to match on (customer code or customer name) so that I can make sure that when this is implemented that it all works.

taylorwalton commented 1 week ago

Addressed in https://github.com/socfortress/CoPilot/pull/257/commits/b49a45a1be282b72e34dae187ab666561392009b