google / google/grr

Adding more artifacts into Interrogate doesn't work

Open
#549 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
5.1k
Forks
796
PR merge metrics
No merged PRs in 30d

Description

Hello,

I wanted to add some artifacts into Interrogate so that when new client enrolls it will be interrogated for slightly more info than what the default interrogate asks for. I looked at `grr/config/artifacts.py` and found out that this should be possible fairly easily with options provided by this config definitions. So I tried to add those artifacts i want as part of interrogate to both (one at a time) `Artifacts.knowledge_base_additions` and `Artifacts.interrogate_store_in_aff4_additions` but neither works.

When i add them to the `interrogate_store_in_aff4_additions` then i get following errors:

```
Traceback (most recent call last):
File "/usr/local/grr/grr/server/flow_runner.py", line 589, in RunStateMethod
direct_response=direct_response, request=request, responses=responses)
File "/usr/local/grr/grr/server/flow.py", line 301, in Decorated
res = f(*args[:f.func_code.co_argcount])
File "/usr/local/grr/grr/server/flows/general/collectors.py", line 617, in ProcessCollected
aff4_output_map, output_collection_map)
File "/usr/local/grr/grr/server/flows/general/collectors.py", line 776, in _ParseResponses
aff4_output_map)
File "/usr/local/grr/grr/server/flows/general/collectors.py", line 823, in _WriteResultToMappedAFF4Location
self.GetAFF4PathForArtifactResponses(result_type))
File "/usr/local/grr/grr/server/flows/general/collectors.py", line 873, in GetAFF4PathForArtifactResponses
(output_type, artifact.GRRArtifactMappings.rdf_map.keys()))
ArtifactProcessingError: No defined RDF type for ExecuteResponse. See the description for the store_results_in_aff4 option, you probably want it set to false. Supported types are: [\'Volume\', \'HardwareInfo\', \'SoftwarePackage\']
```
where `ExecuteResponse` is different for different artifacts (sometimes i get `Dict` etc...).

When i add them to the `knowledge_base_additions` list then the whole GRR will get broken while grr_worker is cycling incredibly fast in something along following lines:
![image](https://user-images.githubusercontent.com/3751422/32991465-6e07a90c-cd3c-11e7-8737-05ebfa558829.png)

Did i misunderstand those config options and they are in fact not for adding artifacts into interrogate process or is there something else wrong? Those artifacts I am adding are working perfectly fine outside interrogate (when called normally by ArtifactCollector flow).

Thanks for any input!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.