Where communities thrive

Join over 1.5M+ people
Join over 100K+ communities
Free without limits
Create your own community

Explore more communities

google/grr

GRR Rapid Response: remote live forensics for incident response

People

Repo info

Activity

Greg Castle

@destijl

@bobbypistol https://github.com/google/grr/blob/master/api_client/python/README.md

bobbypistol

@bobbypistol

yeah i found it thkx :)

Hilko Bengen

@hillu

are you aware of anyone working on API client libs for other languages?

Andreas Moser

@grrrrrrrrr

yes, laetita our intern (for Go)

Hilko Bengen

@hillu

will that code also be added to the grr repository?

Andreas Moser

@grrrrrrrrr

yeah totally, expect code in ~1 month

presentation from today: https://drive.google.com/file/d/0Bzniab0ILSg6RkdyUGZYOGtuX1U/view?usp=sharing

Keith Tyler

@keithtyler

thanks for the info today GRR folks, keep up the awesome work!

Hilko Bengen

@hillu

Not sure if I missed that -- what's the expected timeframe for the fleetspeak feature? Will that be part of the next stable release?

Andreas Moser

@grrrrrrrrr

we are not sure yet. we have a Linux POC almost done, once we can test it we will see how much effort porting the rest (windows!, mac) is

Kishan Bhashyam

@kishanbhashyam

I am aware of the below:

In [1]: aff4.FACTORY.Delete(rdf_client.ClientURN('C.28fd23102959d17f')) ◄ ----- (C.28fd23102959d17f is the client ID)

What is the best way to delete multiple clients? (say 50 or so).. Can i do something along the lines of:
In [1]: aff4.FACTORY.Delete(rdf_client.ClientURN('C.28fd23102959d17f,C.456fd2456562959d17f,C.34fd231023459d17f'))
Thanks in advance.
Kishan.

ric026

@ric026

Hapus

free4talk

@free4talk1_twitter

https://www.youtube.com/watch?v=yAWKtdyq_U4
http://www.free4talk.com/

DaivikDave

@DaivikDave

I just installed ubuntu along with windows . Everything works fine except internet is not working in ubuntu .can someone help me?

Phalanx Security

@PhalanxSecurity

Has anyone run into an issue with the new install where the csv output plugin is missing?

Keith Tyler

@keithtyler

@PhalanxSecurity yes >> https://groups.google.com/forum/#!topic/grr-users/xxK4dBhFdDY

Phalanx Security

@PhalanxSecurity

Awesome. Ok thanks. Sorry about the silly question. Wasn't able to find that on google

What about a way have hunts export to an elk server? I found that someone was using logstashnans the csv output. Any other methods available?

Andreas Moser

@grrrrrrrrr

sorry we realized we have no sound

Keith Tyler

@keithtyler

if it helps, i heard audio in the beginning

Andreas Moser

@grrrrrrrrr

yeah but then the usb disconnected and screwed up the machine :)

new link: https://www.youtube.com/watch?v=xqyFD8tW_TU

Hilko Bengen

@hillu

I always assumed that using HTTP + the GRR-specific protocol instead of HTTPS for client/server communication was about avoiding trouble with middle-boxes that MITM TLS connections. (Was that not the main design choice there?) Why are you switching away from that model for fleetspeak?

Keith Tyler

@keithtyler

With ~30K the mysql backend doesn't seem to work for enterprise hunts, are you planning on making this a bit more scalable?

Hilko Bengen

@hillu

will there be a tool for migrating the existing data to the new DS?

Keith Tyler

@keithtyler

memory imaging is pretty useful, any possibility of keeping in that functionality ?

Hilko Bengen

@hillu

keeping rekall around would probably need somebody who wants to take care of it.

(somebody outside Google?)

(Is Michael Cohen no longer working on Rekall?)

or on pmem for that matter?

thank you, that was the information I was looking for.

briareosiso

@briareosiso

Hey all, i have a question for the authentication with GRR

can i use LDAP ?

Hilko Bengen

@hillu

not out of the box. You'd have to add your own webauth manager. See "Authentication to the Admin UI" in the documentation.

Shion

@ShionAt

I shamelessly show ShionKeys to everyone
https://vimeo.com/250953988

gohelravi99

@gohelravi99

Installed grr properly in windows system, but how to run?

GalacticMaster

@GalacticMaster

Hey , I am using client API to capture last_seen_at, but it is giving me 16 digit number

API doc shows it is RDFdatetime data type

how to convert it to normal date time ?

Flipthemouse

@flipthemouse_twitter

Hi folks. I need your help. How can I get the memory with AnalyzeClientMemory and Memory Collector on the GRR Server?Saw it in several videos but missing some component I think. As well is there a way to enable or get "volatility" running on the GRR server ? Many thanks

Andreas Moser

@grrrrrrrrr

what is the actual issue you see? In order to make Rekall (so AnalyzeClientMemory and MemoryCollector) work, you need to enable it during installation or with the config_updater. Note that Rekall is not supported in GRR at this time

jayboyY1

@jayboyY1

file:///storage/emulated/0/Download/images.jpeg

Braz

@b2az

Hi Guys, is here somebody who deployed grr agents on > 100k clients?

Sanh Phan Van

@SanhPhanVan1_twitter

hi everyone, I had just installed grr on Centos 7 by using PIP packages, but where is grr_client_build ?

mbushkov

@mbushkov

@SanhPhanVan1_twitter , you need to install grr-response-client package in order to have grr_client_build.

Sanh Phan Van

@SanhPhanVan1_twitter

Thank for you response @mbushkov. However, I had followed this link https://grr-doc.readthedocs.io/en/v3.2.1/installing-grr-server/from-released-pip.html, and didn't see anything about grr-response-client package.

mbushkov

@mbushkov

@SanhPhanVan1_twitter , you're right. Thing is - you don't need to grr-response-client and grr_client_build unless you want to build GRR clients yourself. GRR is shipped with a few prebuilt client templates that are downloaded when you run "grr_config_updater initialize". I guess we should update the docs and mention, that you need grr-response-client if your also need to build clients from scratch.

Sanh Phan Van

@SanhPhanVan1_twitter

thank you so much @mbushkov

I wanna use Recall for remoting memory forensics, however Recall is disabled on my configuration

Chat via Matrix