Offline Collection Import to VR Server | Server.Util.ImportCollection

[Walishaha]

Hi Mike,

I collected a zip file with an offline collector configured and imported that zip file on the VR server using "Server.Util.ImportCollection" server artifacts. The import was successful and the image got a client ID.

Now my question is, since this emulates now as a client, why the hunt artifacts do not execute on those imported files (Clients)?

Can you please guide me on the post-processing methods that could be used for the imported files processing?

[scudette]

Hunts are just a group of collections. The imported collection is just another collection. Velociraptor does not know if they should or should not be part of an existing hunt so it just imports it as a collection.

You can manually add the collection to an existing hunt using the add to hunt button in the collection page

[Walishaha]

Hi Mike,

Thank you for your response. Sorry, but seems my question was not very clear.

What I mean was that I used the offline collector with Kape target artifacts. Once I executed the offline collector on a machine, it created a zip file with all the requested raw files. Then I copied the zip file to the VR server and used the server artifact "Server.Utils.ImportCollection" to import that collection. I can see the zip file was unzipped and copied to the newly created folder with the folder name as the client ID.

My assumption was, when we import that zip file, and the VR server creates a client ID for this, that may mean that when we run on hun on the clients from the VR server, that hunt will include those imported clients as well, but I can see on on the real clients, the hunt executed but not on the imported files.

[scudette]

No a hunt is just a collection of artifacts. I think you actually wanted to post process the kape collection on the server as if you are collecting from the client? This is not a great idea but it's possible to simulate it to some extent

See https://docs.velociraptor.app/blog/2022/2022-08-04-post-processing/