meta data for this page
  •  

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
soc:tools:velociraptor [2026/06/12 09:06] – titannetsoc:tools:velociraptor [2026/06/12 10:53] (current) – titannet
Line 17: Line 17:
 docker exec -it ir-velociraptor /opt/velociraptor/linux/velociraptor config client --org="root" --config /velociraptor/config/server.config.yaml > client.config.yaml docker exec -it ir-velociraptor /opt/velociraptor/linux/velociraptor config client --org="root" --config /velociraptor/config/server.config.yaml > client.config.yaml
  
 +#test
 +./velociraptor --config client.config.yaml client -v
 +velociraptor.exe --config client.config.yaml client -v
  
  
 +# run plaso
 +docker run -it --rm --entrypoint=/bin/bash -v ./:/data log2timeline/plaso
 +
 +log2timeline.py --storage-file /tmp/out.plaso /data/<folder>
 +psort.py -o json_line -w /data/out.jsonl /tmp/out.plaso
 +
 +# psort.py -o json_line -w /data/out.jsonl /data/out.plaso
 +#
 +docker exec -it ir-velociraptor /opt/velociraptor/linux/velociraptor config repack --msi /velociraptor/msi/#.msi client.config.yaml /velociraptor/msi/velociraptor-repack.msi
 +
 +
 +
 +
 +# sudo chmod -R a+rwX ./splunk/
 +sudo cp props.conf etc/system/local/props.conf
 +
 +docker image load -i ./splunk.tar
 +docker compose up
 +
 +# settings -> add -> monitor -> plaso.conf -> ...
 +
 +index="pc_plaso"
  
 </code> </code>
Line 38: Line 63:
  
 </code> </code>
 +
 +<file yaml docker-compose.yml>
 +services:
 +  velociraptor:
 +    image: ir-velociraptor
 +    container_name: ir-velociraptor
 +    restart: always
 +    ports:
 +      - "20000:20000"  # Port für die Agents (Clients)
 +      - "20001:20001"  # Port für die Web-Oberfläche (GUI)
 +    volumes:
 +      - ./config:/velociraptor/config
 +      - ./logs:/velociraptor/logs
 +      - ./store:/velociraptor/store
 +      - ./clients:/velociraptor/clients
 +
 +</file>