Where communities thrive

Join over 1.5M+ people
Join over 100K+ communities
Free without limits
Create your own community

Explore more communities

google/grr

GRR Rapid Response: remote live forensics for incident response

People

Repo info

Activity

Hilko Bengen

@hillu

thank you, that was the information I was looking for.

briareosiso

@briareosiso

Hey all, i have a question for the authentication with GRR

can i use LDAP ?

Hilko Bengen

@hillu

not out of the box. You'd have to add your own webauth manager. See "Authentication to the Admin UI" in the documentation.

Shion

@ShionAt

I shamelessly show ShionKeys to everyone
https://vimeo.com/250953988

gohelravi99

@gohelravi99

Installed grr properly in windows system, but how to run?

GalacticMaster

@GalacticMaster

Hey , I am using client API to capture last_seen_at, but it is giving me 16 digit number

API doc shows it is RDFdatetime data type

how to convert it to normal date time ?

Flipthemouse

@flipthemouse_twitter

Hi folks. I need your help. How can I get the memory with AnalyzeClientMemory and Memory Collector on the GRR Server?Saw it in several videos but missing some component I think. As well is there a way to enable or get "volatility" running on the GRR server ? Many thanks

Andreas Moser

@grrrrrrrrr

what is the actual issue you see? In order to make Rekall (so AnalyzeClientMemory and MemoryCollector) work, you need to enable it during installation or with the config_updater. Note that Rekall is not supported in GRR at this time

jayboyY1

@jayboyY1

file:///storage/emulated/0/Download/images.jpeg

Braz

@b2az

Hi Guys, is here somebody who deployed grr agents on > 100k clients?

Sanh Phan Van

@SanhPhanVan1_twitter

hi everyone, I had just installed grr on Centos 7 by using PIP packages, but where is grr_client_build ?

mbushkov

@mbushkov

@SanhPhanVan1_twitter , you need to install grr-response-client package in order to have grr_client_build.

Sanh Phan Van

@SanhPhanVan1_twitter

Thank for you response @mbushkov. However, I had followed this link https://grr-doc.readthedocs.io/en/v3.2.1/installing-grr-server/from-released-pip.html, and didn't see anything about grr-response-client package.

mbushkov

@mbushkov

@SanhPhanVan1_twitter , you're right. Thing is - you don't need to grr-response-client and grr_client_build unless you want to build GRR clients yourself. GRR is shipped with a few prebuilt client templates that are downloaded when you run "grr_config_updater initialize". I guess we should update the docs and mention, that you need grr-response-client if your also need to build clients from scratch.

Sanh Phan Van

@SanhPhanVan1_twitter

thank you so much @mbushkov

I wanna use Recall for remoting memory forensics, however Recall is disabled on my configuration

Sanh Phan Van

@SanhPhanVan1_twitter

How can I enable it? There are not much resources about GRR.

Sanh Phan Van

@SanhPhanVan1_twitter

what is the actual issue you see? In order to make Rekall (so AnalyzeClientMemory and MemoryCollector) work, you need to enable it during installation or with the config_updater. Note that Rekall is not supported in GRR at this time

@grrrrrrrrr How to "enable it during installation or with the config_updater" ?

Andreas Moser

@grrrrrrrrr

have you gone through the installation process? It will ask you a few questions at some point, one is about Rekall.

Sanh Phan Van

@SanhPhanVan1_twitter

I had followed this link https://grr-doc.readthedocs.io/en/v3.2.1/installing-grr-server/from-released-pip.html

Screen Shot 2018-09-28 at 7.50.55 PM.png

Andreas Moser

@grrrrrrrrr

right, there is this step: "After installation, you will need to initialize the GRR configuration with grr_config_updater initialize"

Sanh Phan Van

@SanhPhanVan1_twitter

Screen Shot 2018-09-28 at 7.52.48 PM.png

There is nothing about Rekall.

Andreas Moser

@grrrrrrrrr

you are running a super old version there. Are you using the 3.2.3.post2 that is current on pip?

Sanh Phan Van

@SanhPhanVan1_twitter

oh, I don't understand ".post2" there. The lastest release is 3.2.3.2 (https://github.com/google/grr/releases). What is the difference between them?

Andreas Moser

@grrrrrrrrr

don't worry about that, it's just the second or third upload of the 3.2.3.2 version

is that the one you are using?

Sanh Phan Van

@SanhPhanVan1_twitter

Yes

Screen Shot 2018-09-28 at 8.02.46 PM.png

Andreas Moser

@grrrrrrrrr

you can always just edit the config and set Rekall.enabled: True

Sanh Phan Van

@SanhPhanVan1_twitter

Screen Shot 2018-09-28 at 8.10.24 PM.png

where is the config file you are talking about?

Andreas Moser

@grrrrrrrrr

https://grr-doc.readthedocs.io/en/latest/maintaining-and-tuning/configuration/file-organization.html

e6e5psj

@zsinba

anybody here

linoonphan

@Linoonphan

How to install grr client on Windows10, I did not succeed according to the documentation, can you give me some help? Thank you!

foreignsikhs

@foreignsikhs

hie...all, i have installed the latest version of grr using the link https://grr-doc.readthedocs.io/en/latest/installing-grr-server/from-release-deb.html im very much new to this, though interested. I have instaslled the binaries in windows and linux machines but both the machines are not shown in grrr. grr is running in windows as i can see in task manager. kindly support.

anyone send me a link of any video that can give the details of installation procedure,

Ghareeb elsonny

@GhareebElsonny

hi beloved ones

may i ask how to install GRR On Ubuntu please :) ?

thiruspark

@thiruspark

For windows installation, by referring to the document (https://grr-doc.readthedocs.io/en/latest/deploying-grr-clients/on-windows.html?highlight=windows), i cannot find the client.exe file, from git i can only find python source. Please anyone show the steps for installing GRR release 3.2.4.6 client and server. And how to run the same.

on windows

Chat via Matrix