<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="17">
<package pkgid="34c129357e6f0cb28f57d50503c5e28c714a56887a68c4d0246abdecbdea331e" name="fileb0x" arch="src">
  <version epoch="0" ver="v1.1.1~git10.d54f404" rel="lp154.1.7"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1639569600">- Initial packaging.</changelog>
</package>
<package pkgid="e9e3b6d84be638f0cf318564f52d056f99c7f51b63b6ccfd86840b6cd8791df5" name="fileb0x" arch="x86_64">
  <version epoch="0" ver="v1.1.1~git10.d54f404" rel="lp154.1.7"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1639569600">- Initial packaging.</changelog>
</package>
<package pkgid="38a50a9966a57afdee0e71e5845e4f2584d2f898923c4a3b0b9bc74943ca1e26" name="libprotobuf-devel" arch="x86_64">
  <version epoch="0" ver="3.19.3" rel="lp154.1.2"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1643198400">- Initial packaging.</changelog>
</package>
<package pkgid="4a3eb584049ea0590fde4ab85087920450796219b3304c50f8f54e0173faaca9" name="libprotobuf-lite-devel" arch="x86_64">
  <version epoch="0" ver="3.19.3" rel="lp154.1.2"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1643198400">- Initial packaging.</changelog>
</package>
<package pkgid="b43d05f0c614569a55f684c9265b4c50d95daacedfa56e7b78c7561fec849257" name="libprotobuf-lite30" arch="x86_64">
  <version epoch="0" ver="3.19.3" rel="lp154.1.2"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1643198400">- Initial packaging.</changelog>
</package>
<package pkgid="377784f0589919e331616ab2dc2356f6d40f8aa3b33a0cee8bd385e7026ecccb" name="libprotobuf30" arch="x86_64">
  <version epoch="0" ver="3.19.3" rel="lp154.1.2"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1643198400">- Initial packaging.</changelog>
</package>
<package pkgid="e7d926e19644485f945b7fb195b6a3fa373b962e5655fa654199c2d1c09d1938" name="libprotoc-devel" arch="x86_64">
  <version epoch="0" ver="3.19.3" rel="lp154.1.2"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1643198400">- Initial packaging.</changelog>
</package>
<package pkgid="53541d81db5668bee3fe4d3c87a7a8ebf0ea2d98e4b748549e3309a5ca36832f" name="libprotoc30" arch="x86_64">
  <version epoch="0" ver="3.19.3" rel="lp154.1.2"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1643198400">- Initial packaging.</changelog>
</package>
<package pkgid="2eb134be434a1578c84d19a199947a2ec48cf9865f030c4a15fc9ca3da60cea1" name="mage" arch="src">
  <version epoch="0" ver="v1.11.0~git0.07afc7d" rel="lp154.7.21"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1639569600">- Initial packaging.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1641556800">- Reduce go dependency to &gt;= 1.12 as that's all mage requires.</changelog>
</package>
<package pkgid="76a3a26bfcb2bd1fa8e22099cd6605eef5cb29a7e886ca9ed8faaa26cb77f824" name="mage" arch="x86_64">
  <version epoch="0" ver="v1.11.0~git0.07afc7d" rel="lp154.7.21"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1639569600">- Initial packaging.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1641556800">- Reduce go dependency to &gt;= 1.12 as that's all mage requires.</changelog>
</package>
<package pkgid="3a500dec08cda861c2d92b65ed78286eaa682b33b440f441a76b80ea2ab15e43" name="protobuf" arch="src">
  <version epoch="0" ver="3.19.3" rel="lp154.1.2"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1643198400">- Initial packaging.</changelog>
</package>
<package pkgid="d1081e0d34884827ff18851aad6c92bf87e576fac59c68dd7d16d55685166d07" name="protobuf-compiler" arch="x86_64">
  <version epoch="0" ver="3.19.3" rel="lp154.1.2"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1643198400">- Initial packaging.</changelog>
</package>
<package pkgid="b0dee69911d43360dc90246b209b112ef5cfc527e110b8af02462f1601541d30" name="velociraptor" arch="src">
  <version epoch="0" ver="0.6.4~git17.cb7dfd49" rel="lp154.4.4"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1638446400">- Initial packaging.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1639656000">- Switch to using master branch via service files.
  - Added update-vendoring.sh to update the nodejs and go dependencies
    after version update.
  - Patch the version string to reflect the package version instead
    of an indistinguishable &lt;next-tag&gt;-dev.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1640088000">- Disable Windows artifacts.  We don't target Windows endpoints and
  the queries clutter the GUI.</changelog>
  <changelog author="jeffm@suse.com" date="1641470400">- Update to version 0.6.2~git73.dc02b45e:
  * Update PrivateKeys.yaml (#1459)
  * Added recursion_callback option to the glob plugin (#1461)
  * Added config wizard for multi-frontend configuration (#1460)
  * Calculate the sha256 hash of the offline container. (#1458)
  * Artifact inspection GUI now allows pivot. (#1457)
  * Client certs can now be specified in the config file. (#1456)
  * New Upload File Form element (#1455)
  * Added a sparse accessor (#1453)
  * Hunt wizard estimates clients affected (#1452)
  * Make the interrogation process customizable. (#1451)</changelog>
  <changelog author="jeffm@suse.com" date="1643284800">- Update to version 0.6.2~git0.8dd598b2:
  * Update ese parser to fix timestamp bug
  * Prepare final 0.6.2 release (#1363)
  * Verify all gRPC peer certificates were signed by the Velociraptor CA
  * Removed search index parallelism (#1358)
  * Added new plugins to manipulate event tables easier. (#1355)
  * Sync vfilter (#1351)
  * Add both fqdn and hostname to the client search table (#1350)
  * BUGFIX: Datastore on windows is unable to represent files with . (#1348)
  * Added buffer_size parameter to parse_records_with_regex() (#1347)
  * Propagate column types from artifact to flow notebook. (#1346)</changelog>
  <changelog author="jeffm@suse.com" date="1643284801">- Update to version 0.6.3~git0.69e0fffa:
  * Prepare for 0.6.3 release (#1515)
  * add limitations to description and key path to query (#1514)
  * Retry remote datastore connections (#1513)
  * Write minion log files and autocert in its own dir.  (#1512)
  * Synced KapeFiles artifacts (#1511)
  * Added data retention server artifacts (#1510)
  * Set an upper limit for ttl in memcache (#1508)
  * Add updates to Windows.System.Services (#15) (#1509)
  * Ensure collector container is properly closed when interrupted. (#1507)
  * Continually rebuild the index at runtime. (#1506)
  * Harder vacuum - directly move client task directories to the attic. (#1505)
  * add limitation disclaimer (#1504)
  * Reduce critial section to avoid deadlock in repository manager (#1503)
  * Implemented a vacuum command to remove old tasks from client queues. (#1501)
  * Better format profile metrics output. (#1495)
  * Cap size of directories and report large directories. (#1493)
  * Set ACE completers per editor to avoid global state. (#1492)
  * Add HttpOnly flag to all cookies. (#1491)
  * Refactor completion routine calls (#1490)
  * fix: upgrade react-bootstrap from 1.3.0 to 1.6.4 (#1486)
  * fix: upgrade http-proxy-middleware from 1.0.5 to 1.3.1 (#1485)
  * fix: upgrade react-ace from 9.1.3 to 9.5.0 (#1487)
  * fix: upgrade recharts from 2.0.9 to 2.1.8 (#1488)
  * fix: upgrade react-datetime-picker from 3.0.4 to 3.4.3 (#1489)
  * Limit size of cached directories. (#1483)
  * Add more instrumentation to memory caches. (#1482)
  * Fixed chart resizing bug (#1481)
  * Removed the old queries: list from artifacts. (#1480)
  * [Snyk] Fix for 9 vulnerabilities (#1479)
  * Remove lock around critical section. (#1478)
  * Added MacOS.Forensics.AppleDoubleZip (#1476)
  * Update Windows.Persistence.PermanentWMIEvents to add blind custom namespace detection (#13) (#1475)
  * Make index snapshot frequency configurable
  * fix APIConfigLoader not applying command line args (#1463)
  * Flush index from memory to disk  (#1470)
  * Prepare RC2 (#1473)
  * Bugfix: Setting notebook index did not escape username (#1471)
  * Fixed 2 bugs with the memcache file store (#1469)
  * Update flow active time when the result set is completed (#1468)
  * Tag artifacts as built ins (#1467)
  * Fixed bug in the pathspec() VQL function. (#1465)
  * Update PrivateKeys.yaml (#1459)
  * Added recursion_callback option to the glob plugin (#1461)
  * Added config wizard for multi-frontend configuration (#1460)
  * Calculate the sha256 hash of the offline container. (#1458)
  * Artifact inspection GUI now allows pivot. (#1457)
  * Client certs can now be specified in the config file. (#1456)
  * New Upload File Form element (#1455)
  * Added a sparse accessor (#1453)
  * Hunt wizard estimates clients affected (#1452)
  * Make the interrogation process customizable. (#1451)
  * Update Info.yaml (#1427)
  * Improved Lnk parser to include additional fields. (#1449)
  * Added a Yara GUI element editor. (#1447)
  * Added patch and merge to `config show` and `config generate` (#1445)
  * Remove usage of FatalIfError from main module (#1443)
  * Introduced a dedicated pathspec object (#1440)
  * Bump is-svg from 4.2.2 to 4.3.0 in /gui/velociraptor (#1437)
  * Only pass client config in the client VQL scope. (#1436)
  * rework protobuf message generator (#1435)
  * Update Autoruns.yaml
  * Added test for filefinder (#1431)
  * fix filters in filefinder artifact (#1430)
  * Add Artifact to collect KapeFile targets on Linux (#1426)
  * Enabled lazy quotes on csv parser (#1424)
  * Fixed bug in client comms. (#1423)
  * Add document filter for better usability (#1421)
  * Added resource information to the output of parse_pe() (#1420)
  * Low latency client connectivity discovery (#1419)
  * Add RecentDocs collection (#1416)
  * Update Amcache artifact for clarity (#1415)
  * Added extra parameters to parse_csv() (#1413)
  * Added netcat plugin to read from socket (#1412)
  * Updated SRUM with Network Usage and Upload option (#1408)
  * Synced darwin and freebsd file accessor with the linux one. (#1409)
  * Added Windows.Forensics.SAM artifact (#1404)
  * Initial artifacts can be specified in config (#1403)
  * Add conhost.exe to binary rename (#1402)
  * Add update Prefetch Btime execution fix (#1398)
  * Update Prefetch timeline (#1397)
  * Cleanup search API (#1396)
  * Update protobuf dependencies. (#1394)
  * More multi-frontend optimizations (#1393)
  * Client info manager now keeps track of scheduled tasks. (#1392)
  * add sid and lookupsid plugin (#1388)
  * Add Mutant whitelist (#1387)
  * Notify currently connected clients on new hunts (#1386)
  * Index rebuild command loads new index service. (#1385)
  * Changes to support distributed architecture. (#1384)
  * Added procdump and procdump64 (#1382)
  * Fixed heavy mutex contention in the labeler. (#1375)
  * Add shellcode to CobaltStrike carver (#10) (#1373)
  * Added an index rebuild command. (#1369)
  * GUI artifact form was ignoring the friendly name attribute (#1368)
  * Added a specialized form element for regex parameters. (#1367)
  * Added a gRPC based remote datastore (#1366)
  * Display all subauthorities for GUID in SRUM (#1365)
  * Verify all gRPC peer certificates were signed by the Velociraptor CA (#1362)
  * Implemented MemcacheFileDatastore - memory caching with file backend (#1361)
  * Added new plugins to manipulate event tables easier. (#1355)
  * Refactored in memory datastore to be more efficient. (#1353)
  * Sync vfilter (#1351)
  * Add both fqdn and hostname to the client search table (#1350)
  * BUGFIX: Datastore on windows is unable to represent files with . (#1348)
  * Added buffer_size parameter to parse_records_with_regex() (#1347)
  * Propagate column types from artifact to flow notebook. (#1346)
  * Cobalt parser update (#1345)
  * Allow listener to not use file buffer. (#1344)
  * Fix Deployment documentation link in README (#1343)
  * Preserve uint64 types across Listener (#1341)
  * Fix spelling (#1339)
  * Refactored queue listener to preserve order. (#1340)
  * Added a magic() VQL function (#1338)
  * Fixed bug in CSS (#1337)</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1643803200">- Added systemd unit file and placeholder config file.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1644235200">- Temporarily re-enable Windows artifacts (LSS#4).</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1644494400">- Add simple default configs and provide dirs in /var/lib for client
  and server.</changelog>
  <changelog author="jeffm@suse.com" date="1645185600">- Update to version 0.6.3~git6.d95ed32e:
  * Update the Linux.Events.SSHLogin artifact to scan the systemd journal
  * Update the Linux.Syslog.SSHLogin artifact to scan the systemd journal
  * Add parser to read systemd journal on Linux
  * Add an artifact to enumerate immutable files under a path
  * Add chattr function support for linux
  * Make GitHub actions more flexible on Windows</changelog>
  <changelog author="jeffm@suse.com" date="1647345600">- Update to version 0.6.3~git13.af7fdb00:
  * SUSE: Add SSHLogin artifacts
  * Add a Kafka export plugin
  * SUSE: Do build tests on every pull request
  * Add systemd-dev as build dependency for github workflow</changelog>
  <changelog author="jeffm@suse.com" date="1647345601">- Update to version 0.6.3~git17.741ebb59:
  * kafka-humio-gateway: update README.md
  * kafka-humio-gateway: Fix missing variable rename
  * Add Kafka-Humio Gateway [Depends on PR#10] (#8)</changelog>
  <changelog author="jeffm@suse.com" date="1647604800">- Update to version 0.6.3~git19.640f7a1c:
  * Add tcpsnoop plugin</changelog>
  <changelog author="jeffm@suse.com" date="1651492800">- Resync with git repository:
  * Add artifact to monitor user group updates (#24)
  * Add dnssnoop plugin (#15)
  * Log Sudo/root command by auditd
  * Add custom artifacts for login and logout attempts recorded by auditd</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1651579200">- Rebase on 0.6.4:
  * Updated dependencies
  * Bugfix: startup bugs (#1680)
  * bugfix: Server event notebook not correctly created (#1737)
  * Bugfix: Start a dummy indexing service (#1736)
  * Add bugfix which would return no rows if the user removed whitelist (#1735)
  * Fixed bug in read_reg_key (#1734)
  * BUGFIX: Do not include config flag when darwin installer is repacked (#1733)
  * Refactored index into its own service. (#1730)
  * Bugfix: Write one index item per JSONL record. (#1727)
  * Bugfix: Estimating client impact should consider last active status (#1726)
  * Add complete ntfs metadata option to MFT output (#1725)
  * Various bugfixes. (#1724)
  * Update Usn.yaml (#1723)
  * Fixed a bug in hunt download preparation. (#1722)
  * Add Windows.Forensics.Usn filter and presentation updates (#1720)
  * Optimize writing event monitoring records (#1721)
  * Add Generic.Detection.Yara.Zip (#1718)
  * Fixed crash on master-pong response. (#1719)
  * Remove _type option from elastic. (#1715)
  * Opportunistically update directly connected client's ping times (#1713)
  * Fixed a bug in hunt download preparation. (#1722)
  * Add Windows.Forensics.Usn filter and presentation updates (#1720)
  * Optimize writing event monitoring records (#1721)
  * Add Generic.Detection.Yara.Zip (#1718)
  * Fixed crash on master-pong response. (#1719)
  * Remove _type option from elastic. (#1715)
  * Opportunistically update directly connected client's ping times (#1713)
  * Fixed bug in VQL cell splitting. (#1712)
  * artifact for parsing macos packages (#1706)
  * Bugfix: Create a cell for each collected source (#1710)
  * artifact for parsing macos packages (#1706)
  * Bugfix: Create a cell for each collected source (#1710)
  * Added Server.Utils.CollectClient to simplify direct collections (#1708)
  * fix: gui/velociraptor/package.json &amp; gui/velociraptor/package-lock.json to reduce vulnerabilities (#1705)
  * Fix build on Go 1.18 (#1704)
  * build(deps): bump minimist from 1.2.5 to 1.2.6 in /gui/velociraptor (#1703)
  * Mft update - add uSecZeros (#1701)
  * Server monitoring service will reload if an artifact is modified (#1702)
  * Refactor client info manager (#1700)
  * A number of bugfixes (#1699)
  * Update Windows.NTFS.MFT (#1698)
  * Actually export HumanString attribute on OSPath (#1689)
  * RHEL/CentOS/Fedora dnf packages (#1684)
  * Implemented Human Readable OSPath method. (#1688)
  * Added lazy MFT attributes (#1685)
  * Maintain OSPath in mft artifacts (#1683)
  * Fix bug in deaddisk remapping of directories. (#1682)
  * Bugfix: startup bugs (#1680)
  * Updated SQLECmd artifacts (#1677)
  * Artifact repository needs to watch for changes across nodes. (#1676)
  * Update auto accessor to re-open file with ntfs if read failed (#1674)
  * Fix MacOS.System.Plist artifact (#1673)
  * Error collection based on VQL logs (#1672)
  * Add memory limiting to offline collector (#1666)
  * Allow mount overlays (#1664)
  * build(deps): bump node-forge from 1.2.1 to 1.3.0 in /gui/velociraptor (#1661)
  * Fixed bugs in remapping logic. (#1660)
  * Fixed bug in the windows auto accessor. (#1658)
  * Elastic.Events.Clients: synchronize parameters with Elastic.Flows.Upload (#1657)
  * Add initial commit for Windows.NTFS.ExtendedAttributes (#1656)
  * Added a shadow remapping type (#1655)
  * Implemented an event notebook (#1654)
  * Add Windows.System.WMIQuery (#1651)
  * Fixed data race in progress throttler. (#1653)
  * Implemented timeout and cpu limits on offline collector. (#1650)
  * Added an rpm server command. (#1647)
  * Artifacts can now define suggestions for notebook cells. (#1646)
  * Allow multiple OIDC authenticators to be specified. (#1645)
  * Added a multi authenticator. (#1644)
  * Add HashHunter hash() update for performance (#1643)
  * Change the DNSCache Artifact to WMI (#1640)
  * Added an uploader for notebooks.  (#1639)
  * Added hashselect arg option to hash() (#1637)
  * Add Generic.Detection.HashHunter and tests (#1638)
  * Added Generic.Collectors.SQLECmd (#1635)
  * Add BinaryHunter (#1634)
  * String artifact parameters can now have validator regex (#1628)
  * Implemented CPU rate limited for better control (#1622)
  * Added a client nanny to detect deadlocks (#1621)
  * Linux.Sys.Services artifact, parse services from systemctl (#1619)
  * Collect MAC addresses during interrogation and index them (#1611)
  * Allow parse_ntfs() to operate on an image file. (#1610)
  * Fix regression in VFSGetBuffer (#1605)
  * Added rekey() VQL function (#1604)
  * switch to uninstall string (#1603)
  * freebsd /etc/rc.d/velociraptor service script (#1602)
  * Add Windows.Registry.BackupRestore (#1601)
  * Optimized NTFS code for better speed and added more fields to parse_mft (#1599)
  * Update BinaryRename.yaml (#1598)
  * Added LinuxM1 (#1597)
  * Add explicit check of sticky keys (#1592)
  * Remote data store should identify retryable errors (#1590)
  * fix: gui/velociraptor/package.json &amp; gui/velociraptor/package-lock.json to reduce vulnerabilities (#1588)
  * Add test improvement clear system log (#18) (#1586)
  * Modified Windows.Forensics.Prefetch to use VQL binary parser (#1585)
  * add Windows.NTFS.ADSHunter first commit (#17) (#1583)
  * Resolves Velocidex/velociraptor#1543 Create new VQL entropy() function (#1574)
  * Remove C time and updating naming (#1546)
  * fix: gui/velociraptor/package.json &amp; gui/velociraptor/package-lock.json to reduce vulnerabilities (#1568)
  * Update OSPath protocols to support slices. (#1575)
  * Implement array slice notation in VQL and Server.Import.PreviousReleases (#1573)
  * add rtf TemplateInjection to Windows.Detection.TemplateInjection  (#1572)
  * Change accessors API to deal with OSPath objects directly.  (#1570)
  * Bump follow-redirects from 1.14.4 to 1.14.8 in /gui/velociraptor (#1567)
  * Added a deaddisk command to generate config (#1564)
  * Fix bug in Windows.System.Services (#1565)
  * Fixed glob expand braces order of operations. (#1560)
  * Added an offset and raw_file accessors (#1559)
  * Update CertUtil.yaml (#1558)
  * remove users to include the system path (#1536)
  * Implement remap() VQL function and remapping config (#1555)
  * Make GitHub actions more flexible on Windows (#1549)
  * Bump normalize-url from 4.5.0 to 4.5.1 in /gui/velociraptor (#1548)
  * Fix typo (#1547)
  * Refractor of accessors and path manipulations (#1545)
  * Dns etw update (#1544)
  * add PowershellProfile (#1542)
  * Added dynamic pubsub attributes (#1540)
  * Fix Windows.Applications.Chrome.History (#1539)
  * windows.application to windows.applications merge. New firefox history artefact (#1534)
  * Fixed race condition in zip accessor reference counting. (#1531)
  * Added Windows.Persistence.SilentProcessExit (#1530)
  * Add limitations section and lastwrite timestamp (#1529)
  * Offline collector FetchBinary should respect the IsExecutable flag (#1528)
  * update description, order by, and hidden keypath (#1527)
  * add limitations section (#1520)
  * Avoid holding index lock for too long. (#1519)
  * re-introduce Windows.Collectors.File with deprecation note (#1516)
  * add limitations to description and key path to query (#1514)
  * Retry remote datastore connections (#1513)
  * Write minion log files and autocert in its own dir.  (#1512)
  * Synced KapeFiles artifacts (#1511)
  * Added data retention server artifacts (#1510)
  * Set an upper limit for ttl in memcache (#1508)
  * Add updates to Windows.System.Services (#15) (#1509)
  * Ensure collector container is properly closed when interrupted. (#1507)
  * Continually rebuild the index at runtime. (#1506)
  * Harder vacuum - directly move client task directories to the attic. (#1505)
  * add limitation disclaimer (#1504)
  * Reduce critial section to avoid deadlock in repository manager (#1503)
  * Implemented a vacuum command to remove old tasks from client queues. (#1501)
  * Better format profile metrics output. (#1495)
  * Cap size of directories and report large directories. (#1493)
  * Set ACE completers per editor to avoid global state. (#1492)
  * Add HttpOnly flag to all cookies. (#1491)
  * Refactor completion routine calls (#1490)
  * Limit size of cached directories. (#1483)
  * Add more instrumentation to memory caches. (#1482)
  * Fixed chart resizing bug (#1481)
  * Removed the old queries: list from artifacts. (#1480)
  * [Snyk] Fix for 9 vulnerabilities (#1479)
  * Remove lock around critical section. (#1478)
  * Added MacOS.Forensics.AppleDoubleZip (#1476)
  * Update Windows.Persistence.PermanentWMIEvents to add blind custom namespace detection (#13) (#1475)
  * Make index snapshot frequency configurable (#1474)
  * Bugfix: Setting notebook index did not escape username (#1471)
  * Flush index from memory to disk  (#1470)
  * Fixed 2 bugs with the memcache file store (#1469)
  * Update flow active time when the result set is completed (#1468)
  * Tag artifacts as built ins (#1467)
  * Fixed bug in the pathspec() VQL function. (#1465)
  * fix APIConfigLoader not applying command line args (#1463)</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1651579201">- Fix error handling in tcpsnoop and dnssnoop.
  * If BTF information is unavailable, there is no indication that the
    query has failed.</changelog>
</package>
<package pkgid="db415e3c5efd9acd3463accca42a5251872fcf0525a8de03587f4a6962310750" name="velociraptor" arch="x86_64">
  <version epoch="0" ver="0.6.4~git17.cb7dfd49" rel="lp154.4.4"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1638446400">- Initial packaging.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1639656000">- Switch to using master branch via service files.
  - Added update-vendoring.sh to update the nodejs and go dependencies
    after version update.
  - Patch the version string to reflect the package version instead
    of an indistinguishable &lt;next-tag&gt;-dev.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1640088000">- Disable Windows artifacts.  We don't target Windows endpoints and
  the queries clutter the GUI.</changelog>
  <changelog author="jeffm@suse.com" date="1641470400">- Update to version 0.6.2~git73.dc02b45e:
  * Update PrivateKeys.yaml (#1459)
  * Added recursion_callback option to the glob plugin (#1461)
  * Added config wizard for multi-frontend configuration (#1460)
  * Calculate the sha256 hash of the offline container. (#1458)
  * Artifact inspection GUI now allows pivot. (#1457)
  * Client certs can now be specified in the config file. (#1456)
  * New Upload File Form element (#1455)
  * Added a sparse accessor (#1453)
  * Hunt wizard estimates clients affected (#1452)
  * Make the interrogation process customizable. (#1451)</changelog>
  <changelog author="jeffm@suse.com" date="1643284800">- Update to version 0.6.2~git0.8dd598b2:
  * Update ese parser to fix timestamp bug
  * Prepare final 0.6.2 release (#1363)
  * Verify all gRPC peer certificates were signed by the Velociraptor CA
  * Removed search index parallelism (#1358)
  * Added new plugins to manipulate event tables easier. (#1355)
  * Sync vfilter (#1351)
  * Add both fqdn and hostname to the client search table (#1350)
  * BUGFIX: Datastore on windows is unable to represent files with . (#1348)
  * Added buffer_size parameter to parse_records_with_regex() (#1347)
  * Propagate column types from artifact to flow notebook. (#1346)</changelog>
  <changelog author="jeffm@suse.com" date="1643284801">- Update to version 0.6.3~git0.69e0fffa:
  * Prepare for 0.6.3 release (#1515)
  * add limitations to description and key path to query (#1514)
  * Retry remote datastore connections (#1513)
  * Write minion log files and autocert in its own dir.  (#1512)
  * Synced KapeFiles artifacts (#1511)
  * Added data retention server artifacts (#1510)
  * Set an upper limit for ttl in memcache (#1508)
  * Add updates to Windows.System.Services (#15) (#1509)
  * Ensure collector container is properly closed when interrupted. (#1507)
  * Continually rebuild the index at runtime. (#1506)
  * Harder vacuum - directly move client task directories to the attic. (#1505)
  * add limitation disclaimer (#1504)
  * Reduce critial section to avoid deadlock in repository manager (#1503)
  * Implemented a vacuum command to remove old tasks from client queues. (#1501)
  * Better format profile metrics output. (#1495)
  * Cap size of directories and report large directories. (#1493)
  * Set ACE completers per editor to avoid global state. (#1492)
  * Add HttpOnly flag to all cookies. (#1491)
  * Refactor completion routine calls (#1490)
  * fix: upgrade react-bootstrap from 1.3.0 to 1.6.4 (#1486)
  * fix: upgrade http-proxy-middleware from 1.0.5 to 1.3.1 (#1485)
  * fix: upgrade react-ace from 9.1.3 to 9.5.0 (#1487)
  * fix: upgrade recharts from 2.0.9 to 2.1.8 (#1488)
  * fix: upgrade react-datetime-picker from 3.0.4 to 3.4.3 (#1489)
  * Limit size of cached directories. (#1483)
  * Add more instrumentation to memory caches. (#1482)
  * Fixed chart resizing bug (#1481)
  * Removed the old queries: list from artifacts. (#1480)
  * [Snyk] Fix for 9 vulnerabilities (#1479)
  * Remove lock around critical section. (#1478)
  * Added MacOS.Forensics.AppleDoubleZip (#1476)
  * Update Windows.Persistence.PermanentWMIEvents to add blind custom namespace detection (#13) (#1475)
  * Make index snapshot frequency configurable
  * fix APIConfigLoader not applying command line args (#1463)
  * Flush index from memory to disk  (#1470)
  * Prepare RC2 (#1473)
  * Bugfix: Setting notebook index did not escape username (#1471)
  * Fixed 2 bugs with the memcache file store (#1469)
  * Update flow active time when the result set is completed (#1468)
  * Tag artifacts as built ins (#1467)
  * Fixed bug in the pathspec() VQL function. (#1465)
  * Update PrivateKeys.yaml (#1459)
  * Added recursion_callback option to the glob plugin (#1461)
  * Added config wizard for multi-frontend configuration (#1460)
  * Calculate the sha256 hash of the offline container. (#1458)
  * Artifact inspection GUI now allows pivot. (#1457)
  * Client certs can now be specified in the config file. (#1456)
  * New Upload File Form element (#1455)
  * Added a sparse accessor (#1453)
  * Hunt wizard estimates clients affected (#1452)
  * Make the interrogation process customizable. (#1451)
  * Update Info.yaml (#1427)
  * Improved Lnk parser to include additional fields. (#1449)
  * Added a Yara GUI element editor. (#1447)
  * Added patch and merge to `config show` and `config generate` (#1445)
  * Remove usage of FatalIfError from main module (#1443)
  * Introduced a dedicated pathspec object (#1440)
  * Bump is-svg from 4.2.2 to 4.3.0 in /gui/velociraptor (#1437)
  * Only pass client config in the client VQL scope. (#1436)
  * rework protobuf message generator (#1435)
  * Update Autoruns.yaml
  * Added test for filefinder (#1431)
  * fix filters in filefinder artifact (#1430)
  * Add Artifact to collect KapeFile targets on Linux (#1426)
  * Enabled lazy quotes on csv parser (#1424)
  * Fixed bug in client comms. (#1423)
  * Add document filter for better usability (#1421)
  * Added resource information to the output of parse_pe() (#1420)
  * Low latency client connectivity discovery (#1419)
  * Add RecentDocs collection (#1416)
  * Update Amcache artifact for clarity (#1415)
  * Added extra parameters to parse_csv() (#1413)
  * Added netcat plugin to read from socket (#1412)
  * Updated SRUM with Network Usage and Upload option (#1408)
  * Synced darwin and freebsd file accessor with the linux one. (#1409)
  * Added Windows.Forensics.SAM artifact (#1404)
  * Initial artifacts can be specified in config (#1403)
  * Add conhost.exe to binary rename (#1402)
  * Add update Prefetch Btime execution fix (#1398)
  * Update Prefetch timeline (#1397)
  * Cleanup search API (#1396)
  * Update protobuf dependencies. (#1394)
  * More multi-frontend optimizations (#1393)
  * Client info manager now keeps track of scheduled tasks. (#1392)
  * add sid and lookupsid plugin (#1388)
  * Add Mutant whitelist (#1387)
  * Notify currently connected clients on new hunts (#1386)
  * Index rebuild command loads new index service. (#1385)
  * Changes to support distributed architecture. (#1384)
  * Added procdump and procdump64 (#1382)
  * Fixed heavy mutex contention in the labeler. (#1375)
  * Add shellcode to CobaltStrike carver (#10) (#1373)
  * Added an index rebuild command. (#1369)
  * GUI artifact form was ignoring the friendly name attribute (#1368)
  * Added a specialized form element for regex parameters. (#1367)
  * Added a gRPC based remote datastore (#1366)
  * Display all subauthorities for GUID in SRUM (#1365)
  * Verify all gRPC peer certificates were signed by the Velociraptor CA (#1362)
  * Implemented MemcacheFileDatastore - memory caching with file backend (#1361)
  * Added new plugins to manipulate event tables easier. (#1355)
  * Refactored in memory datastore to be more efficient. (#1353)
  * Sync vfilter (#1351)
  * Add both fqdn and hostname to the client search table (#1350)
  * BUGFIX: Datastore on windows is unable to represent files with . (#1348)
  * Added buffer_size parameter to parse_records_with_regex() (#1347)
  * Propagate column types from artifact to flow notebook. (#1346)
  * Cobalt parser update (#1345)
  * Allow listener to not use file buffer. (#1344)
  * Fix Deployment documentation link in README (#1343)
  * Preserve uint64 types across Listener (#1341)
  * Fix spelling (#1339)
  * Refactored queue listener to preserve order. (#1340)
  * Added a magic() VQL function (#1338)
  * Fixed bug in CSS (#1337)</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1643803200">- Added systemd unit file and placeholder config file.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1644235200">- Temporarily re-enable Windows artifacts (LSS#4).</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1644494400">- Add simple default configs and provide dirs in /var/lib for client
  and server.</changelog>
  <changelog author="jeffm@suse.com" date="1645185600">- Update to version 0.6.3~git6.d95ed32e:
  * Update the Linux.Events.SSHLogin artifact to scan the systemd journal
  * Update the Linux.Syslog.SSHLogin artifact to scan the systemd journal
  * Add parser to read systemd journal on Linux
  * Add an artifact to enumerate immutable files under a path
  * Add chattr function support for linux
  * Make GitHub actions more flexible on Windows</changelog>
  <changelog author="jeffm@suse.com" date="1647345600">- Update to version 0.6.3~git13.af7fdb00:
  * SUSE: Add SSHLogin artifacts
  * Add a Kafka export plugin
  * SUSE: Do build tests on every pull request
  * Add systemd-dev as build dependency for github workflow</changelog>
  <changelog author="jeffm@suse.com" date="1647345601">- Update to version 0.6.3~git17.741ebb59:
  * kafka-humio-gateway: update README.md
  * kafka-humio-gateway: Fix missing variable rename
  * Add Kafka-Humio Gateway [Depends on PR#10] (#8)</changelog>
  <changelog author="jeffm@suse.com" date="1647604800">- Update to version 0.6.3~git19.640f7a1c:
  * Add tcpsnoop plugin</changelog>
  <changelog author="jeffm@suse.com" date="1651492800">- Resync with git repository:
  * Add artifact to monitor user group updates (#24)
  * Add dnssnoop plugin (#15)
  * Log Sudo/root command by auditd
  * Add custom artifacts for login and logout attempts recorded by auditd</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1651579200">- Rebase on 0.6.4:
  * Updated dependencies
  * Bugfix: startup bugs (#1680)
  * bugfix: Server event notebook not correctly created (#1737)
  * Bugfix: Start a dummy indexing service (#1736)
  * Add bugfix which would return no rows if the user removed whitelist (#1735)
  * Fixed bug in read_reg_key (#1734)
  * BUGFIX: Do not include config flag when darwin installer is repacked (#1733)
  * Refactored index into its own service. (#1730)
  * Bugfix: Write one index item per JSONL record. (#1727)
  * Bugfix: Estimating client impact should consider last active status (#1726)
  * Add complete ntfs metadata option to MFT output (#1725)
  * Various bugfixes. (#1724)
  * Update Usn.yaml (#1723)
  * Fixed a bug in hunt download preparation. (#1722)
  * Add Windows.Forensics.Usn filter and presentation updates (#1720)
  * Optimize writing event monitoring records (#1721)
  * Add Generic.Detection.Yara.Zip (#1718)
  * Fixed crash on master-pong response. (#1719)
  * Remove _type option from elastic. (#1715)
  * Opportunistically update directly connected client's ping times (#1713)
  * Fixed a bug in hunt download preparation. (#1722)
  * Add Windows.Forensics.Usn filter and presentation updates (#1720)
  * Optimize writing event monitoring records (#1721)
  * Add Generic.Detection.Yara.Zip (#1718)
  * Fixed crash on master-pong response. (#1719)
  * Remove _type option from elastic. (#1715)
  * Opportunistically update directly connected client's ping times (#1713)
  * Fixed bug in VQL cell splitting. (#1712)
  * artifact for parsing macos packages (#1706)
  * Bugfix: Create a cell for each collected source (#1710)
  * artifact for parsing macos packages (#1706)
  * Bugfix: Create a cell for each collected source (#1710)
  * Added Server.Utils.CollectClient to simplify direct collections (#1708)
  * fix: gui/velociraptor/package.json &amp; gui/velociraptor/package-lock.json to reduce vulnerabilities (#1705)
  * Fix build on Go 1.18 (#1704)
  * build(deps): bump minimist from 1.2.5 to 1.2.6 in /gui/velociraptor (#1703)
  * Mft update - add uSecZeros (#1701)
  * Server monitoring service will reload if an artifact is modified (#1702)
  * Refactor client info manager (#1700)
  * A number of bugfixes (#1699)
  * Update Windows.NTFS.MFT (#1698)
  * Actually export HumanString attribute on OSPath (#1689)
  * RHEL/CentOS/Fedora dnf packages (#1684)
  * Implemented Human Readable OSPath method. (#1688)
  * Added lazy MFT attributes (#1685)
  * Maintain OSPath in mft artifacts (#1683)
  * Fix bug in deaddisk remapping of directories. (#1682)
  * Bugfix: startup bugs (#1680)
  * Updated SQLECmd artifacts (#1677)
  * Artifact repository needs to watch for changes across nodes. (#1676)
  * Update auto accessor to re-open file with ntfs if read failed (#1674)
  * Fix MacOS.System.Plist artifact (#1673)
  * Error collection based on VQL logs (#1672)
  * Add memory limiting to offline collector (#1666)
  * Allow mount overlays (#1664)
  * build(deps): bump node-forge from 1.2.1 to 1.3.0 in /gui/velociraptor (#1661)
  * Fixed bugs in remapping logic. (#1660)
  * Fixed bug in the windows auto accessor. (#1658)
  * Elastic.Events.Clients: synchronize parameters with Elastic.Flows.Upload (#1657)
  * Add initial commit for Windows.NTFS.ExtendedAttributes (#1656)
  * Added a shadow remapping type (#1655)
  * Implemented an event notebook (#1654)
  * Add Windows.System.WMIQuery (#1651)
  * Fixed data race in progress throttler. (#1653)
  * Implemented timeout and cpu limits on offline collector. (#1650)
  * Added an rpm server command. (#1647)
  * Artifacts can now define suggestions for notebook cells. (#1646)
  * Allow multiple OIDC authenticators to be specified. (#1645)
  * Added a multi authenticator. (#1644)
  * Add HashHunter hash() update for performance (#1643)
  * Change the DNSCache Artifact to WMI (#1640)
  * Added an uploader for notebooks.  (#1639)
  * Added hashselect arg option to hash() (#1637)
  * Add Generic.Detection.HashHunter and tests (#1638)
  * Added Generic.Collectors.SQLECmd (#1635)
  * Add BinaryHunter (#1634)
  * String artifact parameters can now have validator regex (#1628)
  * Implemented CPU rate limited for better control (#1622)
  * Added a client nanny to detect deadlocks (#1621)
  * Linux.Sys.Services artifact, parse services from systemctl (#1619)
  * Collect MAC addresses during interrogation and index them (#1611)
  * Allow parse_ntfs() to operate on an image file. (#1610)
  * Fix regression in VFSGetBuffer (#1605)
  * Added rekey() VQL function (#1604)
  * switch to uninstall string (#1603)
  * freebsd /etc/rc.d/velociraptor service script (#1602)
  * Add Windows.Registry.BackupRestore (#1601)
  * Optimized NTFS code for better speed and added more fields to parse_mft (#1599)
  * Update BinaryRename.yaml (#1598)
  * Added LinuxM1 (#1597)
  * Add explicit check of sticky keys (#1592)
  * Remote data store should identify retryable errors (#1590)
  * fix: gui/velociraptor/package.json &amp; gui/velociraptor/package-lock.json to reduce vulnerabilities (#1588)
  * Add test improvement clear system log (#18) (#1586)
  * Modified Windows.Forensics.Prefetch to use VQL binary parser (#1585)
  * add Windows.NTFS.ADSHunter first commit (#17) (#1583)
  * Resolves Velocidex/velociraptor#1543 Create new VQL entropy() function (#1574)
  * Remove C time and updating naming (#1546)
  * fix: gui/velociraptor/package.json &amp; gui/velociraptor/package-lock.json to reduce vulnerabilities (#1568)
  * Update OSPath protocols to support slices. (#1575)
  * Implement array slice notation in VQL and Server.Import.PreviousReleases (#1573)
  * add rtf TemplateInjection to Windows.Detection.TemplateInjection  (#1572)
  * Change accessors API to deal with OSPath objects directly.  (#1570)
  * Bump follow-redirects from 1.14.4 to 1.14.8 in /gui/velociraptor (#1567)
  * Added a deaddisk command to generate config (#1564)
  * Fix bug in Windows.System.Services (#1565)
  * Fixed glob expand braces order of operations. (#1560)
  * Added an offset and raw_file accessors (#1559)
  * Update CertUtil.yaml (#1558)
  * remove users to include the system path (#1536)
  * Implement remap() VQL function and remapping config (#1555)
  * Make GitHub actions more flexible on Windows (#1549)
  * Bump normalize-url from 4.5.0 to 4.5.1 in /gui/velociraptor (#1548)
  * Fix typo (#1547)
  * Refractor of accessors and path manipulations (#1545)
  * Dns etw update (#1544)
  * add PowershellProfile (#1542)
  * Added dynamic pubsub attributes (#1540)
  * Fix Windows.Applications.Chrome.History (#1539)
  * windows.application to windows.applications merge. New firefox history artefact (#1534)
  * Fixed race condition in zip accessor reference counting. (#1531)
  * Added Windows.Persistence.SilentProcessExit (#1530)
  * Add limitations section and lastwrite timestamp (#1529)
  * Offline collector FetchBinary should respect the IsExecutable flag (#1528)
  * update description, order by, and hidden keypath (#1527)
  * add limitations section (#1520)
  * Avoid holding index lock for too long. (#1519)
  * re-introduce Windows.Collectors.File with deprecation note (#1516)
  * add limitations to description and key path to query (#1514)
  * Retry remote datastore connections (#1513)
  * Write minion log files and autocert in its own dir.  (#1512)
  * Synced KapeFiles artifacts (#1511)
  * Added data retention server artifacts (#1510)
  * Set an upper limit for ttl in memcache (#1508)
  * Add updates to Windows.System.Services (#15) (#1509)
  * Ensure collector container is properly closed when interrupted. (#1507)
  * Continually rebuild the index at runtime. (#1506)
  * Harder vacuum - directly move client task directories to the attic. (#1505)
  * add limitation disclaimer (#1504)
  * Reduce critial section to avoid deadlock in repository manager (#1503)
  * Implemented a vacuum command to remove old tasks from client queues. (#1501)
  * Better format profile metrics output. (#1495)
  * Cap size of directories and report large directories. (#1493)
  * Set ACE completers per editor to avoid global state. (#1492)
  * Add HttpOnly flag to all cookies. (#1491)
  * Refactor completion routine calls (#1490)
  * Limit size of cached directories. (#1483)
  * Add more instrumentation to memory caches. (#1482)
  * Fixed chart resizing bug (#1481)
  * Removed the old queries: list from artifacts. (#1480)
  * [Snyk] Fix for 9 vulnerabilities (#1479)
  * Remove lock around critical section. (#1478)
  * Added MacOS.Forensics.AppleDoubleZip (#1476)
  * Update Windows.Persistence.PermanentWMIEvents to add blind custom namespace detection (#13) (#1475)
  * Make index snapshot frequency configurable (#1474)
  * Bugfix: Setting notebook index did not escape username (#1471)
  * Flush index from memory to disk  (#1470)
  * Fixed 2 bugs with the memcache file store (#1469)
  * Update flow active time when the result set is completed (#1468)
  * Tag artifacts as built ins (#1467)
  * Fixed bug in the pathspec() VQL function. (#1465)
  * fix APIConfigLoader not applying command line args (#1463)</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1651579201">- Fix error handling in tcpsnoop and dnssnoop.
  * If BTF information is unavailable, there is no indication that the
    query has failed.</changelog>
</package>
<package pkgid="a014f01a83c31fa599943679be3fcaba972f69b522c60e639e355292e8ad5547" name="velociraptor-client" arch="src">
  <version epoch="0" ver="0.6.4~git17.cb7dfd49" rel="lp154.4.3"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1638446400">- Initial packaging.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1639656000">- Switch to using master branch via service files.
  - Added update-vendoring.sh to update the nodejs and go dependencies
    after version update.
  - Now building with linux_bare target that disables the GUI for
    endpoint usage.
  - Patch the version string to reflect the package version instead
    of an indistinguishable &lt;next-tag&gt;-dev.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1640088000">- Disable Windows artifacts.  We don't target Windows endpoints and
  the queries clutter the GUI.</changelog>
  <changelog author="jeffm@suse.com" date="1641470400">- Update to version 0.6.2~git73.dc02b45e:
  * Update PrivateKeys.yaml (#1459)
  * Added recursion_callback option to the glob plugin (#1461)
  * Added config wizard for multi-frontend configuration (#1460)
  * Calculate the sha256 hash of the offline container. (#1458)
  * Artifact inspection GUI now allows pivot. (#1457)
  * Client certs can now be specified in the config file. (#1456)
  * New Upload File Form element (#1455)
  * Added a sparse accessor (#1453)
  * Hunt wizard estimates clients affected (#1452)
  * Make the interrogation process customizable. (#1451)</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1641470401">- Remove dependencies on nodejs since we don't use it in client mode.</changelog>
  <changelog author="jeffm@suse.com" date="1643284800">- Update to version 0.6.2~git0.8dd598b2:
  * Update ese parser to fix timestamp bug
  * Prepare final 0.6.2 release (#1363)
  * Verify all gRPC peer certificates were signed by the Velociraptor CA
  * Removed search index parallelism (#1358)
  * Added new plugins to manipulate event tables easier. (#1355)
  * Sync vfilter (#1351)
  * Add both fqdn and hostname to the client search table (#1350)
  * BUGFIX: Datastore on windows is unable to represent files with . (#1348)
  * Added buffer_size parameter to parse_records_with_regex() (#1347)
  * Propagate column types from artifact to flow notebook. (#1346)</changelog>
  <changelog author="jeffm@suse.com" date="1643284801">- Update to version 0.6.3~git0.69e0fffa:
  * Prepare for 0.6.3 release (#1515)
  * add limitations to description and key path to query (#1514)
  * Retry remote datastore connections (#1513)
  * Write minion log files and autocert in its own dir.  (#1512)
  * Synced KapeFiles artifacts (#1511)
  * Added data retention server artifacts (#1510)
  * Set an upper limit for ttl in memcache (#1508)
  * Add updates to Windows.System.Services (#15) (#1509)
  * Ensure collector container is properly closed when interrupted. (#1507)
  * Continually rebuild the index at runtime. (#1506)
  * Harder vacuum - directly move client task directories to the attic. (#1505)
  * add limitation disclaimer (#1504)
  * Reduce critial section to avoid deadlock in repository manager (#1503)
  * Implemented a vacuum command to remove old tasks from client queues. (#1501)
  * Better format profile metrics output. (#1495)
  * Cap size of directories and report large directories. (#1493)
  * Set ACE completers per editor to avoid global state. (#1492)
  * Add HttpOnly flag to all cookies. (#1491)
  * Refactor completion routine calls (#1490)
  * fix: upgrade react-bootstrap from 1.3.0 to 1.6.4 (#1486)
  * fix: upgrade http-proxy-middleware from 1.0.5 to 1.3.1 (#1485)
  * fix: upgrade react-ace from 9.1.3 to 9.5.0 (#1487)
  * fix: upgrade recharts from 2.0.9 to 2.1.8 (#1488)
  * fix: upgrade react-datetime-picker from 3.0.4 to 3.4.3 (#1489)
  * Limit size of cached directories. (#1483)
  * Add more instrumentation to memory caches. (#1482)
  * Fixed chart resizing bug (#1481)
  * Removed the old queries: list from artifacts. (#1480)
  * [Snyk] Fix for 9 vulnerabilities (#1479)
  * Remove lock around critical section. (#1478)
  * Added MacOS.Forensics.AppleDoubleZip (#1476)
  * Update Windows.Persistence.PermanentWMIEvents to add blind custom namespace detection (#13) (#1475)
  * Make index snapshot frequency configurable
  * fix APIConfigLoader not applying command line args (#1463)
  * Flush index from memory to disk  (#1470)
  * Prepare RC2 (#1473)
  * Bugfix: Setting notebook index did not escape username (#1471)
  * Fixed 2 bugs with the memcache file store (#1469)
  * Update flow active time when the result set is completed (#1468)
  * Tag artifacts as built ins (#1467)
  * Fixed bug in the pathspec() VQL function. (#1465)
  * Update PrivateKeys.yaml (#1459)
  * Added recursion_callback option to the glob plugin (#1461)
  * Added config wizard for multi-frontend configuration (#1460)
  * Calculate the sha256 hash of the offline container. (#1458)
  * Artifact inspection GUI now allows pivot. (#1457)
  * Client certs can now be specified in the config file. (#1456)
  * New Upload File Form element (#1455)
  * Added a sparse accessor (#1453)
  * Hunt wizard estimates clients affected (#1452)
  * Make the interrogation process customizable. (#1451)
  * Update Info.yaml (#1427)
  * Improved Lnk parser to include additional fields. (#1449)
  * Added a Yara GUI element editor. (#1447)
  * Added patch and merge to `config show` and `config generate` (#1445)
  * Remove usage of FatalIfError from main module (#1443)
  * Introduced a dedicated pathspec object (#1440)
  * Bump is-svg from 4.2.2 to 4.3.0 in /gui/velociraptor (#1437)
  * Only pass client config in the client VQL scope. (#1436)
  * rework protobuf message generator (#1435)
  * Update Autoruns.yaml
  * Added test for filefinder (#1431)
  * fix filters in filefinder artifact (#1430)
  * Add Artifact to collect KapeFile targets on Linux (#1426)
  * Enabled lazy quotes on csv parser (#1424)
  * Fixed bug in client comms. (#1423)
  * Add document filter for better usability (#1421)
  * Added resource information to the output of parse_pe() (#1420)
  * Low latency client connectivity discovery (#1419)
  * Add RecentDocs collection (#1416)
  * Update Amcache artifact for clarity (#1415)
  * Added extra parameters to parse_csv() (#1413)
  * Added netcat plugin to read from socket (#1412)
  * Updated SRUM with Network Usage and Upload option (#1408)
  * Synced darwin and freebsd file accessor with the linux one. (#1409)
  * Added Windows.Forensics.SAM artifact (#1404)
  * Initial artifacts can be specified in config (#1403)
  * Add conhost.exe to binary rename (#1402)
  * Add update Prefetch Btime execution fix (#1398)
  * Update Prefetch timeline (#1397)
  * Cleanup search API (#1396)
  * Update protobuf dependencies. (#1394)
  * More multi-frontend optimizations (#1393)
  * Client info manager now keeps track of scheduled tasks. (#1392)
  * add sid and lookupsid plugin (#1388)
  * Add Mutant whitelist (#1387)
  * Notify currently connected clients on new hunts (#1386)
  * Index rebuild command loads new index service. (#1385)
  * Changes to support distributed architecture. (#1384)
  * Added procdump and procdump64 (#1382)
  * Fixed heavy mutex contention in the labeler. (#1375)
  * Add shellcode to CobaltStrike carver (#10) (#1373)
  * Added an index rebuild command. (#1369)
  * GUI artifact form was ignoring the friendly name attribute (#1368)
  * Added a specialized form element for regex parameters. (#1367)
  * Added a gRPC based remote datastore (#1366)
  * Display all subauthorities for GUID in SRUM (#1365)
  * Verify all gRPC peer certificates were signed by the Velociraptor CA (#1362)
  * Implemented MemcacheFileDatastore - memory caching with file backend (#1361)
  * Added new plugins to manipulate event tables easier. (#1355)
  * Refactored in memory datastore to be more efficient. (#1353)
  * Sync vfilter (#1351)
  * Add both fqdn and hostname to the client search table (#1350)
  * BUGFIX: Datastore on windows is unable to represent files with . (#1348)
  * Added buffer_size parameter to parse_records_with_regex() (#1347)
  * Propagate column types from artifact to flow notebook. (#1346)
  * Cobalt parser update (#1345)
  * Allow listener to not use file buffer. (#1344)
  * Fix Deployment documentation link in README (#1343)
  * Preserve uint64 types across Listener (#1341)
  * Fix spelling (#1339)
  * Refactored queue listener to preserve order. (#1340)
  * Added a magic() VQL function (#1338)
  * Fixed bug in CSS (#1337)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1643803200">- Add client service file</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1643803201">- Resolved some rpmlint warnings and added client config placeholder.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1644494400">- Add simple default config and provide /var/lib/velociraptor-client.</changelog>
  <changelog author="jeffm@suse.com" date="1645185600">- Update to version 0.6.3~git6.d95ed32e:
  * Update the Linux.Events.SSHLogin artifact to scan the systemd journal
  * Update the Linux.Syslog.SSHLogin artifact to scan the systemd journal
  * Add parser to read systemd journal on Linux
  * Add an artifact to enumerate immutable files under a path
  * Add chattr function support for linux
  * Make GitHub actions more flexible on Windows</changelog>
  <changelog author="jeffm@suse.com" date="1647345600">- Update to version 0.6.3~git13.af7fdb00:
  * SUSE: Add SSHLogin artifacts
  * Add a Kafka export plugin
  * SUSE: Do build tests on every pull request
  * Add systemd-dev as build dependency for github workflow</changelog>
  <changelog author="jeffm@suse.com" date="1647345601">- Update to version 0.6.3~git17.741ebb59:
  * kafka-humio-gateway: update README.md
  * kafka-humio-gateway: Fix missing variable rename
  * Add Kafka-Humio Gateway [Depends on PR#10] (#8)</changelog>
  <changelog author="jeffm@suse.com" date="1647604800">- Update to version 0.6.3~git19.640f7a1c:
  * Add tcpsnoop plugin</changelog>
  <changelog author="jeffm@suse.com" date="1651492800">- Resync with git repository:
  * Add artifact to monitor user group updates (#24)
  * Add dnssnoop plugin (#15)
  * Log Sudo/root command by auditd
  * Add custom artifacts for login and logout attempts recorded by auditd</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1651579200">- Rebase on 0.6.4:
  * Updated dependencies
  * Bugfix: startup bugs (#1680)
  * bugfix: Server event notebook not correctly created (#1737)
  * Bugfix: Start a dummy indexing service (#1736)
  * Add bugfix which would return no rows if the user removed whitelist (#1735)
  * Fixed bug in read_reg_key (#1734)
  * BUGFIX: Do not include config flag when darwin installer is repacked (#1733)
  * Refactored index into its own service. (#1730)
  * Bugfix: Write one index item per JSONL record. (#1727)
  * Bugfix: Estimating client impact should consider last active status (#1726)
  * Add complete ntfs metadata option to MFT output (#1725)
  * Various bugfixes. (#1724)
  * Update Usn.yaml (#1723)
  * Fixed a bug in hunt download preparation. (#1722)
  * Add Windows.Forensics.Usn filter and presentation updates (#1720)
  * Optimize writing event monitoring records (#1721)
  * Add Generic.Detection.Yara.Zip (#1718)
  * Fixed crash on master-pong response. (#1719)
  * Remove _type option from elastic. (#1715)
  * Opportunistically update directly connected client's ping times (#1713)
  * Fixed a bug in hunt download preparation. (#1722)
  * Add Windows.Forensics.Usn filter and presentation updates (#1720)
  * Optimize writing event monitoring records (#1721)
  * Add Generic.Detection.Yara.Zip (#1718)
  * Fixed crash on master-pong response. (#1719)
  * Remove _type option from elastic. (#1715)
  * Opportunistically update directly connected client's ping times (#1713)
  * Fixed bug in VQL cell splitting. (#1712)
  * artifact for parsing macos packages (#1706)
  * Bugfix: Create a cell for each collected source (#1710)
  * artifact for parsing macos packages (#1706)
  * Bugfix: Create a cell for each collected source (#1710)
  * Added Server.Utils.CollectClient to simplify direct collections (#1708)
  * fix: gui/velociraptor/package.json &amp; gui/velociraptor/package-lock.json to reduce vulnerabilities (#1705)
  * Fix build on Go 1.18 (#1704)
  * build(deps): bump minimist from 1.2.5 to 1.2.6 in /gui/velociraptor (#1703)
  * Mft update - add uSecZeros (#1701)
  * Server monitoring service will reload if an artifact is modified (#1702)
  * Refactor client info manager (#1700)
  * A number of bugfixes (#1699)
  * Update Windows.NTFS.MFT (#1698)
  * Actually export HumanString attribute on OSPath (#1689)
  * RHEL/CentOS/Fedora dnf packages (#1684)
  * Implemented Human Readable OSPath method. (#1688)
  * Added lazy MFT attributes (#1685)
  * Maintain OSPath in mft artifacts (#1683)
  * Fix bug in deaddisk remapping of directories. (#1682)
  * Bugfix: startup bugs (#1680)
  * Updated SQLECmd artifacts (#1677)
  * Artifact repository needs to watch for changes across nodes. (#1676)
  * Update auto accessor to re-open file with ntfs if read failed (#1674)
  * Fix MacOS.System.Plist artifact (#1673)
  * Error collection based on VQL logs (#1672)
  * Add memory limiting to offline collector (#1666)
  * Allow mount overlays (#1664)
  * build(deps): bump node-forge from 1.2.1 to 1.3.0 in /gui/velociraptor (#1661)
  * Fixed bugs in remapping logic. (#1660)
  * Fixed bug in the windows auto accessor. (#1658)
  * Elastic.Events.Clients: synchronize parameters with Elastic.Flows.Upload (#1657)
  * Add initial commit for Windows.NTFS.ExtendedAttributes (#1656)
  * Added a shadow remapping type (#1655)
  * Implemented an event notebook (#1654)
  * Add Windows.System.WMIQuery (#1651)
  * Fixed data race in progress throttler. (#1653)
  * Implemented timeout and cpu limits on offline collector. (#1650)
  * Added an rpm server command. (#1647)
  * Artifacts can now define suggestions for notebook cells. (#1646)
  * Allow multiple OIDC authenticators to be specified. (#1645)
  * Added a multi authenticator. (#1644)
  * Add HashHunter hash() update for performance (#1643)
  * Change the DNSCache Artifact to WMI (#1640)
  * Added an uploader for notebooks.  (#1639)
  * Added hashselect arg option to hash() (#1637)
  * Add Generic.Detection.HashHunter and tests (#1638)
  * Added Generic.Collectors.SQLECmd (#1635)
  * Add BinaryHunter (#1634)
  * String artifact parameters can now have validator regex (#1628)
  * Implemented CPU rate limited for better control (#1622)
  * Added a client nanny to detect deadlocks (#1621)
  * Linux.Sys.Services artifact, parse services from systemctl (#1619)
  * Collect MAC addresses during interrogation and index them (#1611)
  * Allow parse_ntfs() to operate on an image file. (#1610)
  * Fix regression in VFSGetBuffer (#1605)
  * Added rekey() VQL function (#1604)
  * switch to uninstall string (#1603)
  * freebsd /etc/rc.d/velociraptor service script (#1602)
  * Add Windows.Registry.BackupRestore (#1601)
  * Optimized NTFS code for better speed and added more fields to parse_mft (#1599)
  * Update BinaryRename.yaml (#1598)
  * Added LinuxM1 (#1597)
  * Add explicit check of sticky keys (#1592)
  * Remote data store should identify retryable errors (#1590)
  * fix: gui/velociraptor/package.json &amp; gui/velociraptor/package-lock.json to reduce vulnerabilities (#1588)
  * Add test improvement clear system log (#18) (#1586)
  * Modified Windows.Forensics.Prefetch to use VQL binary parser (#1585)
  * add Windows.NTFS.ADSHunter first commit (#17) (#1583)
  * Resolves Velocidex/velociraptor#1543 Create new VQL entropy() function (#1574)
  * Remove C time and updating naming (#1546)
  * fix: gui/velociraptor/package.json &amp; gui/velociraptor/package-lock.json to reduce vulnerabilities (#1568)
  * Update OSPath protocols to support slices. (#1575)
  * Implement array slice notation in VQL and Server.Import.PreviousReleases (#1573)
  * add rtf TemplateInjection to Windows.Detection.TemplateInjection  (#1572)
  * Change accessors API to deal with OSPath objects directly.  (#1570)
  * Bump follow-redirects from 1.14.4 to 1.14.8 in /gui/velociraptor (#1567)
  * Added a deaddisk command to generate config (#1564)
  * Fix bug in Windows.System.Services (#1565)
  * Fixed glob expand braces order of operations. (#1560)
  * Added an offset and raw_file accessors (#1559)
  * Update CertUtil.yaml (#1558)
  * remove users to include the system path (#1536)
  * Implement remap() VQL function and remapping config (#1555)
  * Make GitHub actions more flexible on Windows (#1549)
  * Bump normalize-url from 4.5.0 to 4.5.1 in /gui/velociraptor (#1548)
  * Fix typo (#1547)
  * Refractor of accessors and path manipulations (#1545)
  * Dns etw update (#1544)
  * add PowershellProfile (#1542)
  * Added dynamic pubsub attributes (#1540)
  * Fix Windows.Applications.Chrome.History (#1539)
  * windows.application to windows.applications merge. New firefox history artefact (#1534)
  * Fixed race condition in zip accessor reference counting. (#1531)
  * Added Windows.Persistence.SilentProcessExit (#1530)
  * Add limitations section and lastwrite timestamp (#1529)
  * Offline collector FetchBinary should respect the IsExecutable flag (#1528)
  * update description, order by, and hidden keypath (#1527)
  * add limitations section (#1520)
  * Avoid holding index lock for too long. (#1519)
  * re-introduce Windows.Collectors.File with deprecation note (#1516)
  * add limitations to description and key path to query (#1514)
  * Retry remote datastore connections (#1513)
  * Write minion log files and autocert in its own dir.  (#1512)
  * Synced KapeFiles artifacts (#1511)
  * Added data retention server artifacts (#1510)
  * Set an upper limit for ttl in memcache (#1508)
  * Add updates to Windows.System.Services (#15) (#1509)
  * Ensure collector container is properly closed when interrupted. (#1507)
  * Continually rebuild the index at runtime. (#1506)
  * Harder vacuum - directly move client task directories to the attic. (#1505)
  * add limitation disclaimer (#1504)
  * Reduce critial section to avoid deadlock in repository manager (#1503)
  * Implemented a vacuum command to remove old tasks from client queues. (#1501)
  * Better format profile metrics output. (#1495)
  * Cap size of directories and report large directories. (#1493)
  * Set ACE completers per editor to avoid global state. (#1492)
  * Add HttpOnly flag to all cookies. (#1491)
  * Refactor completion routine calls (#1490)
  * Limit size of cached directories. (#1483)
  * Add more instrumentation to memory caches. (#1482)
  * Fixed chart resizing bug (#1481)
  * Removed the old queries: list from artifacts. (#1480)
  * [Snyk] Fix for 9 vulnerabilities (#1479)
  * Remove lock around critical section. (#1478)
  * Added MacOS.Forensics.AppleDoubleZip (#1476)
  * Update Windows.Persistence.PermanentWMIEvents to add blind custom namespace detection (#13) (#1475)
  * Make index snapshot frequency configurable (#1474)
  * Bugfix: Setting notebook index did not escape username (#1471)
  * Flush index from memory to disk  (#1470)
  * Fixed 2 bugs with the memcache file store (#1469)
  * Update flow active time when the result set is completed (#1468)
  * Tag artifacts as built ins (#1467)
  * Fixed bug in the pathspec() VQL function. (#1465)
  * fix APIConfigLoader not applying command line args (#1463)</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1651579201">- Fix error handling in tcpsnoop and dnssnoop.
  * If BTF information is unavailable, there is no indication that the
    query has failed.</changelog>
</package>
<package pkgid="5db179cc65fcd7367e7a2a31e7b243822477f4fed2264e1c01ddf14997b40efc" name="velociraptor-client" arch="x86_64">
  <version epoch="0" ver="0.6.4~git17.cb7dfd49" rel="lp154.4.3"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1638446400">- Initial packaging.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1639656000">- Switch to using master branch via service files.
  - Added update-vendoring.sh to update the nodejs and go dependencies
    after version update.
  - Now building with linux_bare target that disables the GUI for
    endpoint usage.
  - Patch the version string to reflect the package version instead
    of an indistinguishable &lt;next-tag&gt;-dev.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1640088000">- Disable Windows artifacts.  We don't target Windows endpoints and
  the queries clutter the GUI.</changelog>
  <changelog author="jeffm@suse.com" date="1641470400">- Update to version 0.6.2~git73.dc02b45e:
  * Update PrivateKeys.yaml (#1459)
  * Added recursion_callback option to the glob plugin (#1461)
  * Added config wizard for multi-frontend configuration (#1460)
  * Calculate the sha256 hash of the offline container. (#1458)
  * Artifact inspection GUI now allows pivot. (#1457)
  * Client certs can now be specified in the config file. (#1456)
  * New Upload File Form element (#1455)
  * Added a sparse accessor (#1453)
  * Hunt wizard estimates clients affected (#1452)
  * Make the interrogation process customizable. (#1451)</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1641470401">- Remove dependencies on nodejs since we don't use it in client mode.</changelog>
  <changelog author="jeffm@suse.com" date="1643284800">- Update to version 0.6.2~git0.8dd598b2:
  * Update ese parser to fix timestamp bug
  * Prepare final 0.6.2 release (#1363)
  * Verify all gRPC peer certificates were signed by the Velociraptor CA
  * Removed search index parallelism (#1358)
  * Added new plugins to manipulate event tables easier. (#1355)
  * Sync vfilter (#1351)
  * Add both fqdn and hostname to the client search table (#1350)
  * BUGFIX: Datastore on windows is unable to represent files with . (#1348)
  * Added buffer_size parameter to parse_records_with_regex() (#1347)
  * Propagate column types from artifact to flow notebook. (#1346)</changelog>
  <changelog author="jeffm@suse.com" date="1643284801">- Update to version 0.6.3~git0.69e0fffa:
  * Prepare for 0.6.3 release (#1515)
  * add limitations to description and key path to query (#1514)
  * Retry remote datastore connections (#1513)
  * Write minion log files and autocert in its own dir.  (#1512)
  * Synced KapeFiles artifacts (#1511)
  * Added data retention server artifacts (#1510)
  * Set an upper limit for ttl in memcache (#1508)
  * Add updates to Windows.System.Services (#15) (#1509)
  * Ensure collector container is properly closed when interrupted. (#1507)
  * Continually rebuild the index at runtime. (#1506)
  * Harder vacuum - directly move client task directories to the attic. (#1505)
  * add limitation disclaimer (#1504)
  * Reduce critial section to avoid deadlock in repository manager (#1503)
  * Implemented a vacuum command to remove old tasks from client queues. (#1501)
  * Better format profile metrics output. (#1495)
  * Cap size of directories and report large directories. (#1493)
  * Set ACE completers per editor to avoid global state. (#1492)
  * Add HttpOnly flag to all cookies. (#1491)
  * Refactor completion routine calls (#1490)
  * fix: upgrade react-bootstrap from 1.3.0 to 1.6.4 (#1486)
  * fix: upgrade http-proxy-middleware from 1.0.5 to 1.3.1 (#1485)
  * fix: upgrade react-ace from 9.1.3 to 9.5.0 (#1487)
  * fix: upgrade recharts from 2.0.9 to 2.1.8 (#1488)
  * fix: upgrade react-datetime-picker from 3.0.4 to 3.4.3 (#1489)
  * Limit size of cached directories. (#1483)
  * Add more instrumentation to memory caches. (#1482)
  * Fixed chart resizing bug (#1481)
  * Removed the old queries: list from artifacts. (#1480)
  * [Snyk] Fix for 9 vulnerabilities (#1479)
  * Remove lock around critical section. (#1478)
  * Added MacOS.Forensics.AppleDoubleZip (#1476)
  * Update Windows.Persistence.PermanentWMIEvents to add blind custom namespace detection (#13) (#1475)
  * Make index snapshot frequency configurable
  * fix APIConfigLoader not applying command line args (#1463)
  * Flush index from memory to disk  (#1470)
  * Prepare RC2 (#1473)
  * Bugfix: Setting notebook index did not escape username (#1471)
  * Fixed 2 bugs with the memcache file store (#1469)
  * Update flow active time when the result set is completed (#1468)
  * Tag artifacts as built ins (#1467)
  * Fixed bug in the pathspec() VQL function. (#1465)
  * Update PrivateKeys.yaml (#1459)
  * Added recursion_callback option to the glob plugin (#1461)
  * Added config wizard for multi-frontend configuration (#1460)
  * Calculate the sha256 hash of the offline container. (#1458)
  * Artifact inspection GUI now allows pivot. (#1457)
  * Client certs can now be specified in the config file. (#1456)
  * New Upload File Form element (#1455)
  * Added a sparse accessor (#1453)
  * Hunt wizard estimates clients affected (#1452)
  * Make the interrogation process customizable. (#1451)
  * Update Info.yaml (#1427)
  * Improved Lnk parser to include additional fields. (#1449)
  * Added a Yara GUI element editor. (#1447)
  * Added patch and merge to `config show` and `config generate` (#1445)
  * Remove usage of FatalIfError from main module (#1443)
  * Introduced a dedicated pathspec object (#1440)
  * Bump is-svg from 4.2.2 to 4.3.0 in /gui/velociraptor (#1437)
  * Only pass client config in the client VQL scope. (#1436)
  * rework protobuf message generator (#1435)
  * Update Autoruns.yaml
  * Added test for filefinder (#1431)
  * fix filters in filefinder artifact (#1430)
  * Add Artifact to collect KapeFile targets on Linux (#1426)
  * Enabled lazy quotes on csv parser (#1424)
  * Fixed bug in client comms. (#1423)
  * Add document filter for better usability (#1421)
  * Added resource information to the output of parse_pe() (#1420)
  * Low latency client connectivity discovery (#1419)
  * Add RecentDocs collection (#1416)
  * Update Amcache artifact for clarity (#1415)
  * Added extra parameters to parse_csv() (#1413)
  * Added netcat plugin to read from socket (#1412)
  * Updated SRUM with Network Usage and Upload option (#1408)
  * Synced darwin and freebsd file accessor with the linux one. (#1409)
  * Added Windows.Forensics.SAM artifact (#1404)
  * Initial artifacts can be specified in config (#1403)
  * Add conhost.exe to binary rename (#1402)
  * Add update Prefetch Btime execution fix (#1398)
  * Update Prefetch timeline (#1397)
  * Cleanup search API (#1396)
  * Update protobuf dependencies. (#1394)
  * More multi-frontend optimizations (#1393)
  * Client info manager now keeps track of scheduled tasks. (#1392)
  * add sid and lookupsid plugin (#1388)
  * Add Mutant whitelist (#1387)
  * Notify currently connected clients on new hunts (#1386)
  * Index rebuild command loads new index service. (#1385)
  * Changes to support distributed architecture. (#1384)
  * Added procdump and procdump64 (#1382)
  * Fixed heavy mutex contention in the labeler. (#1375)
  * Add shellcode to CobaltStrike carver (#10) (#1373)
  * Added an index rebuild command. (#1369)
  * GUI artifact form was ignoring the friendly name attribute (#1368)
  * Added a specialized form element for regex parameters. (#1367)
  * Added a gRPC based remote datastore (#1366)
  * Display all subauthorities for GUID in SRUM (#1365)
  * Verify all gRPC peer certificates were signed by the Velociraptor CA (#1362)
  * Implemented MemcacheFileDatastore - memory caching with file backend (#1361)
  * Added new plugins to manipulate event tables easier. (#1355)
  * Refactored in memory datastore to be more efficient. (#1353)
  * Sync vfilter (#1351)
  * Add both fqdn and hostname to the client search table (#1350)
  * BUGFIX: Datastore on windows is unable to represent files with . (#1348)
  * Added buffer_size parameter to parse_records_with_regex() (#1347)
  * Propagate column types from artifact to flow notebook. (#1346)
  * Cobalt parser update (#1345)
  * Allow listener to not use file buffer. (#1344)
  * Fix Deployment documentation link in README (#1343)
  * Preserve uint64 types across Listener (#1341)
  * Fix spelling (#1339)
  * Refactored queue listener to preserve order. (#1340)
  * Added a magic() VQL function (#1338)
  * Fixed bug in CSS (#1337)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1643803200">- Add client service file</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1643803201">- Resolved some rpmlint warnings and added client config placeholder.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1644494400">- Add simple default config and provide /var/lib/velociraptor-client.</changelog>
  <changelog author="jeffm@suse.com" date="1645185600">- Update to version 0.6.3~git6.d95ed32e:
  * Update the Linux.Events.SSHLogin artifact to scan the systemd journal
  * Update the Linux.Syslog.SSHLogin artifact to scan the systemd journal
  * Add parser to read systemd journal on Linux
  * Add an artifact to enumerate immutable files under a path
  * Add chattr function support for linux
  * Make GitHub actions more flexible on Windows</changelog>
  <changelog author="jeffm@suse.com" date="1647345600">- Update to version 0.6.3~git13.af7fdb00:
  * SUSE: Add SSHLogin artifacts
  * Add a Kafka export plugin
  * SUSE: Do build tests on every pull request
  * Add systemd-dev as build dependency for github workflow</changelog>
  <changelog author="jeffm@suse.com" date="1647345601">- Update to version 0.6.3~git17.741ebb59:
  * kafka-humio-gateway: update README.md
  * kafka-humio-gateway: Fix missing variable rename
  * Add Kafka-Humio Gateway [Depends on PR#10] (#8)</changelog>
  <changelog author="jeffm@suse.com" date="1647604800">- Update to version 0.6.3~git19.640f7a1c:
  * Add tcpsnoop plugin</changelog>
  <changelog author="jeffm@suse.com" date="1651492800">- Resync with git repository:
  * Add artifact to monitor user group updates (#24)
  * Add dnssnoop plugin (#15)
  * Log Sudo/root command by auditd
  * Add custom artifacts for login and logout attempts recorded by auditd</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1651579200">- Rebase on 0.6.4:
  * Updated dependencies
  * Bugfix: startup bugs (#1680)
  * bugfix: Server event notebook not correctly created (#1737)
  * Bugfix: Start a dummy indexing service (#1736)
  * Add bugfix which would return no rows if the user removed whitelist (#1735)
  * Fixed bug in read_reg_key (#1734)
  * BUGFIX: Do not include config flag when darwin installer is repacked (#1733)
  * Refactored index into its own service. (#1730)
  * Bugfix: Write one index item per JSONL record. (#1727)
  * Bugfix: Estimating client impact should consider last active status (#1726)
  * Add complete ntfs metadata option to MFT output (#1725)
  * Various bugfixes. (#1724)
  * Update Usn.yaml (#1723)
  * Fixed a bug in hunt download preparation. (#1722)
  * Add Windows.Forensics.Usn filter and presentation updates (#1720)
  * Optimize writing event monitoring records (#1721)
  * Add Generic.Detection.Yara.Zip (#1718)
  * Fixed crash on master-pong response. (#1719)
  * Remove _type option from elastic. (#1715)
  * Opportunistically update directly connected client's ping times (#1713)
  * Fixed a bug in hunt download preparation. (#1722)
  * Add Windows.Forensics.Usn filter and presentation updates (#1720)
  * Optimize writing event monitoring records (#1721)
  * Add Generic.Detection.Yara.Zip (#1718)
  * Fixed crash on master-pong response. (#1719)
  * Remove _type option from elastic. (#1715)
  * Opportunistically update directly connected client's ping times (#1713)
  * Fixed bug in VQL cell splitting. (#1712)
  * artifact for parsing macos packages (#1706)
  * Bugfix: Create a cell for each collected source (#1710)
  * artifact for parsing macos packages (#1706)
  * Bugfix: Create a cell for each collected source (#1710)
  * Added Server.Utils.CollectClient to simplify direct collections (#1708)
  * fix: gui/velociraptor/package.json &amp; gui/velociraptor/package-lock.json to reduce vulnerabilities (#1705)
  * Fix build on Go 1.18 (#1704)
  * build(deps): bump minimist from 1.2.5 to 1.2.6 in /gui/velociraptor (#1703)
  * Mft update - add uSecZeros (#1701)
  * Server monitoring service will reload if an artifact is modified (#1702)
  * Refactor client info manager (#1700)
  * A number of bugfixes (#1699)
  * Update Windows.NTFS.MFT (#1698)
  * Actually export HumanString attribute on OSPath (#1689)
  * RHEL/CentOS/Fedora dnf packages (#1684)
  * Implemented Human Readable OSPath method. (#1688)
  * Added lazy MFT attributes (#1685)
  * Maintain OSPath in mft artifacts (#1683)
  * Fix bug in deaddisk remapping of directories. (#1682)
  * Bugfix: startup bugs (#1680)
  * Updated SQLECmd artifacts (#1677)
  * Artifact repository needs to watch for changes across nodes. (#1676)
  * Update auto accessor to re-open file with ntfs if read failed (#1674)
  * Fix MacOS.System.Plist artifact (#1673)
  * Error collection based on VQL logs (#1672)
  * Add memory limiting to offline collector (#1666)
  * Allow mount overlays (#1664)
  * build(deps): bump node-forge from 1.2.1 to 1.3.0 in /gui/velociraptor (#1661)
  * Fixed bugs in remapping logic. (#1660)
  * Fixed bug in the windows auto accessor. (#1658)
  * Elastic.Events.Clients: synchronize parameters with Elastic.Flows.Upload (#1657)
  * Add initial commit for Windows.NTFS.ExtendedAttributes (#1656)
  * Added a shadow remapping type (#1655)
  * Implemented an event notebook (#1654)
  * Add Windows.System.WMIQuery (#1651)
  * Fixed data race in progress throttler. (#1653)
  * Implemented timeout and cpu limits on offline collector. (#1650)
  * Added an rpm server command. (#1647)
  * Artifacts can now define suggestions for notebook cells. (#1646)
  * Allow multiple OIDC authenticators to be specified. (#1645)
  * Added a multi authenticator. (#1644)
  * Add HashHunter hash() update for performance (#1643)
  * Change the DNSCache Artifact to WMI (#1640)
  * Added an uploader for notebooks.  (#1639)
  * Added hashselect arg option to hash() (#1637)
  * Add Generic.Detection.HashHunter and tests (#1638)
  * Added Generic.Collectors.SQLECmd (#1635)
  * Add BinaryHunter (#1634)
  * String artifact parameters can now have validator regex (#1628)
  * Implemented CPU rate limited for better control (#1622)
  * Added a client nanny to detect deadlocks (#1621)
  * Linux.Sys.Services artifact, parse services from systemctl (#1619)
  * Collect MAC addresses during interrogation and index them (#1611)
  * Allow parse_ntfs() to operate on an image file. (#1610)
  * Fix regression in VFSGetBuffer (#1605)
  * Added rekey() VQL function (#1604)
  * switch to uninstall string (#1603)
  * freebsd /etc/rc.d/velociraptor service script (#1602)
  * Add Windows.Registry.BackupRestore (#1601)
  * Optimized NTFS code for better speed and added more fields to parse_mft (#1599)
  * Update BinaryRename.yaml (#1598)
  * Added LinuxM1 (#1597)
  * Add explicit check of sticky keys (#1592)
  * Remote data store should identify retryable errors (#1590)
  * fix: gui/velociraptor/package.json &amp; gui/velociraptor/package-lock.json to reduce vulnerabilities (#1588)
  * Add test improvement clear system log (#18) (#1586)
  * Modified Windows.Forensics.Prefetch to use VQL binary parser (#1585)
  * add Windows.NTFS.ADSHunter first commit (#17) (#1583)
  * Resolves Velocidex/velociraptor#1543 Create new VQL entropy() function (#1574)
  * Remove C time and updating naming (#1546)
  * fix: gui/velociraptor/package.json &amp; gui/velociraptor/package-lock.json to reduce vulnerabilities (#1568)
  * Update OSPath protocols to support slices. (#1575)
  * Implement array slice notation in VQL and Server.Import.PreviousReleases (#1573)
  * add rtf TemplateInjection to Windows.Detection.TemplateInjection  (#1572)
  * Change accessors API to deal with OSPath objects directly.  (#1570)
  * Bump follow-redirects from 1.14.4 to 1.14.8 in /gui/velociraptor (#1567)
  * Added a deaddisk command to generate config (#1564)
  * Fix bug in Windows.System.Services (#1565)
  * Fixed glob expand braces order of operations. (#1560)
  * Added an offset and raw_file accessors (#1559)
  * Update CertUtil.yaml (#1558)
  * remove users to include the system path (#1536)
  * Implement remap() VQL function and remapping config (#1555)
  * Make GitHub actions more flexible on Windows (#1549)
  * Bump normalize-url from 4.5.0 to 4.5.1 in /gui/velociraptor (#1548)
  * Fix typo (#1547)
  * Refractor of accessors and path manipulations (#1545)
  * Dns etw update (#1544)
  * add PowershellProfile (#1542)
  * Added dynamic pubsub attributes (#1540)
  * Fix Windows.Applications.Chrome.History (#1539)
  * windows.application to windows.applications merge. New firefox history artefact (#1534)
  * Fixed race condition in zip accessor reference counting. (#1531)
  * Added Windows.Persistence.SilentProcessExit (#1530)
  * Add limitations section and lastwrite timestamp (#1529)
  * Offline collector FetchBinary should respect the IsExecutable flag (#1528)
  * update description, order by, and hidden keypath (#1527)
  * add limitations section (#1520)
  * Avoid holding index lock for too long. (#1519)
  * re-introduce Windows.Collectors.File with deprecation note (#1516)
  * add limitations to description and key path to query (#1514)
  * Retry remote datastore connections (#1513)
  * Write minion log files and autocert in its own dir.  (#1512)
  * Synced KapeFiles artifacts (#1511)
  * Added data retention server artifacts (#1510)
  * Set an upper limit for ttl in memcache (#1508)
  * Add updates to Windows.System.Services (#15) (#1509)
  * Ensure collector container is properly closed when interrupted. (#1507)
  * Continually rebuild the index at runtime. (#1506)
  * Harder vacuum - directly move client task directories to the attic. (#1505)
  * add limitation disclaimer (#1504)
  * Reduce critial section to avoid deadlock in repository manager (#1503)
  * Implemented a vacuum command to remove old tasks from client queues. (#1501)
  * Better format profile metrics output. (#1495)
  * Cap size of directories and report large directories. (#1493)
  * Set ACE completers per editor to avoid global state. (#1492)
  * Add HttpOnly flag to all cookies. (#1491)
  * Refactor completion routine calls (#1490)
  * Limit size of cached directories. (#1483)
  * Add more instrumentation to memory caches. (#1482)
  * Fixed chart resizing bug (#1481)
  * Removed the old queries: list from artifacts. (#1480)
  * [Snyk] Fix for 9 vulnerabilities (#1479)
  * Remove lock around critical section. (#1478)
  * Added MacOS.Forensics.AppleDoubleZip (#1476)
  * Update Windows.Persistence.PermanentWMIEvents to add blind custom namespace detection (#13) (#1475)
  * Make index snapshot frequency configurable (#1474)
  * Bugfix: Setting notebook index did not escape username (#1471)
  * Flush index from memory to disk  (#1470)
  * Fixed 2 bugs with the memcache file store (#1469)
  * Update flow active time when the result set is completed (#1468)
  * Tag artifacts as built ins (#1467)
  * Fixed bug in the pathspec() VQL function. (#1465)
  * fix APIConfigLoader not applying command line args (#1463)</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1651579201">- Fix error handling in tcpsnoop and dnssnoop.
  * If BTF information is unavailable, there is no indication that the
    query has failed.</changelog>
</package>
<package pkgid="320c20cf0bd069b274cd16d4403ee513de8be97fbe0c9611cad391851d2b478f" name="velociraptor-kafka-humio-gateway" arch="x86_64">
  <version epoch="0" ver="0.6.4~git17.cb7dfd49" rel="lp154.4.4"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1638446400">- Initial packaging.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1639656000">- Switch to using master branch via service files.
  - Added update-vendoring.sh to update the nodejs and go dependencies
    after version update.
  - Patch the version string to reflect the package version instead
    of an indistinguishable &lt;next-tag&gt;-dev.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1640088000">- Disable Windows artifacts.  We don't target Windows endpoints and
  the queries clutter the GUI.</changelog>
  <changelog author="jeffm@suse.com" date="1641470400">- Update to version 0.6.2~git73.dc02b45e:
  * Update PrivateKeys.yaml (#1459)
  * Added recursion_callback option to the glob plugin (#1461)
  * Added config wizard for multi-frontend configuration (#1460)
  * Calculate the sha256 hash of the offline container. (#1458)
  * Artifact inspection GUI now allows pivot. (#1457)
  * Client certs can now be specified in the config file. (#1456)
  * New Upload File Form element (#1455)
  * Added a sparse accessor (#1453)
  * Hunt wizard estimates clients affected (#1452)
  * Make the interrogation process customizable. (#1451)</changelog>
  <changelog author="jeffm@suse.com" date="1643284800">- Update to version 0.6.2~git0.8dd598b2:
  * Update ese parser to fix timestamp bug
  * Prepare final 0.6.2 release (#1363)
  * Verify all gRPC peer certificates were signed by the Velociraptor CA
  * Removed search index parallelism (#1358)
  * Added new plugins to manipulate event tables easier. (#1355)
  * Sync vfilter (#1351)
  * Add both fqdn and hostname to the client search table (#1350)
  * BUGFIX: Datastore on windows is unable to represent files with . (#1348)
  * Added buffer_size parameter to parse_records_with_regex() (#1347)
  * Propagate column types from artifact to flow notebook. (#1346)</changelog>
  <changelog author="jeffm@suse.com" date="1643284801">- Update to version 0.6.3~git0.69e0fffa:
  * Prepare for 0.6.3 release (#1515)
  * add limitations to description and key path to query (#1514)
  * Retry remote datastore connections (#1513)
  * Write minion log files and autocert in its own dir.  (#1512)
  * Synced KapeFiles artifacts (#1511)
  * Added data retention server artifacts (#1510)
  * Set an upper limit for ttl in memcache (#1508)
  * Add updates to Windows.System.Services (#15) (#1509)
  * Ensure collector container is properly closed when interrupted. (#1507)
  * Continually rebuild the index at runtime. (#1506)
  * Harder vacuum - directly move client task directories to the attic. (#1505)
  * add limitation disclaimer (#1504)
  * Reduce critial section to avoid deadlock in repository manager (#1503)
  * Implemented a vacuum command to remove old tasks from client queues. (#1501)
  * Better format profile metrics output. (#1495)
  * Cap size of directories and report large directories. (#1493)
  * Set ACE completers per editor to avoid global state. (#1492)
  * Add HttpOnly flag to all cookies. (#1491)
  * Refactor completion routine calls (#1490)
  * fix: upgrade react-bootstrap from 1.3.0 to 1.6.4 (#1486)
  * fix: upgrade http-proxy-middleware from 1.0.5 to 1.3.1 (#1485)
  * fix: upgrade react-ace from 9.1.3 to 9.5.0 (#1487)
  * fix: upgrade recharts from 2.0.9 to 2.1.8 (#1488)
  * fix: upgrade react-datetime-picker from 3.0.4 to 3.4.3 (#1489)
  * Limit size of cached directories. (#1483)
  * Add more instrumentation to memory caches. (#1482)
  * Fixed chart resizing bug (#1481)
  * Removed the old queries: list from artifacts. (#1480)
  * [Snyk] Fix for 9 vulnerabilities (#1479)
  * Remove lock around critical section. (#1478)
  * Added MacOS.Forensics.AppleDoubleZip (#1476)
  * Update Windows.Persistence.PermanentWMIEvents to add blind custom namespace detection (#13) (#1475)
  * Make index snapshot frequency configurable
  * fix APIConfigLoader not applying command line args (#1463)
  * Flush index from memory to disk  (#1470)
  * Prepare RC2 (#1473)
  * Bugfix: Setting notebook index did not escape username (#1471)
  * Fixed 2 bugs with the memcache file store (#1469)
  * Update flow active time when the result set is completed (#1468)
  * Tag artifacts as built ins (#1467)
  * Fixed bug in the pathspec() VQL function. (#1465)
  * Update PrivateKeys.yaml (#1459)
  * Added recursion_callback option to the glob plugin (#1461)
  * Added config wizard for multi-frontend configuration (#1460)
  * Calculate the sha256 hash of the offline container. (#1458)
  * Artifact inspection GUI now allows pivot. (#1457)
  * Client certs can now be specified in the config file. (#1456)
  * New Upload File Form element (#1455)
  * Added a sparse accessor (#1453)
  * Hunt wizard estimates clients affected (#1452)
  * Make the interrogation process customizable. (#1451)
  * Update Info.yaml (#1427)
  * Improved Lnk parser to include additional fields. (#1449)
  * Added a Yara GUI element editor. (#1447)
  * Added patch and merge to `config show` and `config generate` (#1445)
  * Remove usage of FatalIfError from main module (#1443)
  * Introduced a dedicated pathspec object (#1440)
  * Bump is-svg from 4.2.2 to 4.3.0 in /gui/velociraptor (#1437)
  * Only pass client config in the client VQL scope. (#1436)
  * rework protobuf message generator (#1435)
  * Update Autoruns.yaml
  * Added test for filefinder (#1431)
  * fix filters in filefinder artifact (#1430)
  * Add Artifact to collect KapeFile targets on Linux (#1426)
  * Enabled lazy quotes on csv parser (#1424)
  * Fixed bug in client comms. (#1423)
  * Add document filter for better usability (#1421)
  * Added resource information to the output of parse_pe() (#1420)
  * Low latency client connectivity discovery (#1419)
  * Add RecentDocs collection (#1416)
  * Update Amcache artifact for clarity (#1415)
  * Added extra parameters to parse_csv() (#1413)
  * Added netcat plugin to read from socket (#1412)
  * Updated SRUM with Network Usage and Upload option (#1408)
  * Synced darwin and freebsd file accessor with the linux one. (#1409)
  * Added Windows.Forensics.SAM artifact (#1404)
  * Initial artifacts can be specified in config (#1403)
  * Add conhost.exe to binary rename (#1402)
  * Add update Prefetch Btime execution fix (#1398)
  * Update Prefetch timeline (#1397)
  * Cleanup search API (#1396)
  * Update protobuf dependencies. (#1394)
  * More multi-frontend optimizations (#1393)
  * Client info manager now keeps track of scheduled tasks. (#1392)
  * add sid and lookupsid plugin (#1388)
  * Add Mutant whitelist (#1387)
  * Notify currently connected clients on new hunts (#1386)
  * Index rebuild command loads new index service. (#1385)
  * Changes to support distributed architecture. (#1384)
  * Added procdump and procdump64 (#1382)
  * Fixed heavy mutex contention in the labeler. (#1375)
  * Add shellcode to CobaltStrike carver (#10) (#1373)
  * Added an index rebuild command. (#1369)
  * GUI artifact form was ignoring the friendly name attribute (#1368)
  * Added a specialized form element for regex parameters. (#1367)
  * Added a gRPC based remote datastore (#1366)
  * Display all subauthorities for GUID in SRUM (#1365)
  * Verify all gRPC peer certificates were signed by the Velociraptor CA (#1362)
  * Implemented MemcacheFileDatastore - memory caching with file backend (#1361)
  * Added new plugins to manipulate event tables easier. (#1355)
  * Refactored in memory datastore to be more efficient. (#1353)
  * Sync vfilter (#1351)
  * Add both fqdn and hostname to the client search table (#1350)
  * BUGFIX: Datastore on windows is unable to represent files with . (#1348)
  * Added buffer_size parameter to parse_records_with_regex() (#1347)
  * Propagate column types from artifact to flow notebook. (#1346)
  * Cobalt parser update (#1345)
  * Allow listener to not use file buffer. (#1344)
  * Fix Deployment documentation link in README (#1343)
  * Preserve uint64 types across Listener (#1341)
  * Fix spelling (#1339)
  * Refactored queue listener to preserve order. (#1340)
  * Added a magic() VQL function (#1338)
  * Fixed bug in CSS (#1337)</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1643803200">- Added systemd unit file and placeholder config file.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1644235200">- Temporarily re-enable Windows artifacts (LSS#4).</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1644494400">- Add simple default configs and provide dirs in /var/lib for client
  and server.</changelog>
  <changelog author="jeffm@suse.com" date="1645185600">- Update to version 0.6.3~git6.d95ed32e:
  * Update the Linux.Events.SSHLogin artifact to scan the systemd journal
  * Update the Linux.Syslog.SSHLogin artifact to scan the systemd journal
  * Add parser to read systemd journal on Linux
  * Add an artifact to enumerate immutable files under a path
  * Add chattr function support for linux
  * Make GitHub actions more flexible on Windows</changelog>
  <changelog author="jeffm@suse.com" date="1647345600">- Update to version 0.6.3~git13.af7fdb00:
  * SUSE: Add SSHLogin artifacts
  * Add a Kafka export plugin
  * SUSE: Do build tests on every pull request
  * Add systemd-dev as build dependency for github workflow</changelog>
  <changelog author="jeffm@suse.com" date="1647345601">- Update to version 0.6.3~git17.741ebb59:
  * kafka-humio-gateway: update README.md
  * kafka-humio-gateway: Fix missing variable rename
  * Add Kafka-Humio Gateway [Depends on PR#10] (#8)</changelog>
  <changelog author="jeffm@suse.com" date="1647604800">- Update to version 0.6.3~git19.640f7a1c:
  * Add tcpsnoop plugin</changelog>
  <changelog author="jeffm@suse.com" date="1651492800">- Resync with git repository:
  * Add artifact to monitor user group updates (#24)
  * Add dnssnoop plugin (#15)
  * Log Sudo/root command by auditd
  * Add custom artifacts for login and logout attempts recorded by auditd</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1651579200">- Rebase on 0.6.4:
  * Updated dependencies
  * Bugfix: startup bugs (#1680)
  * bugfix: Server event notebook not correctly created (#1737)
  * Bugfix: Start a dummy indexing service (#1736)
  * Add bugfix which would return no rows if the user removed whitelist (#1735)
  * Fixed bug in read_reg_key (#1734)
  * BUGFIX: Do not include config flag when darwin installer is repacked (#1733)
  * Refactored index into its own service. (#1730)
  * Bugfix: Write one index item per JSONL record. (#1727)
  * Bugfix: Estimating client impact should consider last active status (#1726)
  * Add complete ntfs metadata option to MFT output (#1725)
  * Various bugfixes. (#1724)
  * Update Usn.yaml (#1723)
  * Fixed a bug in hunt download preparation. (#1722)
  * Add Windows.Forensics.Usn filter and presentation updates (#1720)
  * Optimize writing event monitoring records (#1721)
  * Add Generic.Detection.Yara.Zip (#1718)
  * Fixed crash on master-pong response. (#1719)
  * Remove _type option from elastic. (#1715)
  * Opportunistically update directly connected client's ping times (#1713)
  * Fixed a bug in hunt download preparation. (#1722)
  * Add Windows.Forensics.Usn filter and presentation updates (#1720)
  * Optimize writing event monitoring records (#1721)
  * Add Generic.Detection.Yara.Zip (#1718)
  * Fixed crash on master-pong response. (#1719)
  * Remove _type option from elastic. (#1715)
  * Opportunistically update directly connected client's ping times (#1713)
  * Fixed bug in VQL cell splitting. (#1712)
  * artifact for parsing macos packages (#1706)
  * Bugfix: Create a cell for each collected source (#1710)
  * artifact for parsing macos packages (#1706)
  * Bugfix: Create a cell for each collected source (#1710)
  * Added Server.Utils.CollectClient to simplify direct collections (#1708)
  * fix: gui/velociraptor/package.json &amp; gui/velociraptor/package-lock.json to reduce vulnerabilities (#1705)
  * Fix build on Go 1.18 (#1704)
  * build(deps): bump minimist from 1.2.5 to 1.2.6 in /gui/velociraptor (#1703)
  * Mft update - add uSecZeros (#1701)
  * Server monitoring service will reload if an artifact is modified (#1702)
  * Refactor client info manager (#1700)
  * A number of bugfixes (#1699)
  * Update Windows.NTFS.MFT (#1698)
  * Actually export HumanString attribute on OSPath (#1689)
  * RHEL/CentOS/Fedora dnf packages (#1684)
  * Implemented Human Readable OSPath method. (#1688)
  * Added lazy MFT attributes (#1685)
  * Maintain OSPath in mft artifacts (#1683)
  * Fix bug in deaddisk remapping of directories. (#1682)
  * Bugfix: startup bugs (#1680)
  * Updated SQLECmd artifacts (#1677)
  * Artifact repository needs to watch for changes across nodes. (#1676)
  * Update auto accessor to re-open file with ntfs if read failed (#1674)
  * Fix MacOS.System.Plist artifact (#1673)
  * Error collection based on VQL logs (#1672)
  * Add memory limiting to offline collector (#1666)
  * Allow mount overlays (#1664)
  * build(deps): bump node-forge from 1.2.1 to 1.3.0 in /gui/velociraptor (#1661)
  * Fixed bugs in remapping logic. (#1660)
  * Fixed bug in the windows auto accessor. (#1658)
  * Elastic.Events.Clients: synchronize parameters with Elastic.Flows.Upload (#1657)
  * Add initial commit for Windows.NTFS.ExtendedAttributes (#1656)
  * Added a shadow remapping type (#1655)
  * Implemented an event notebook (#1654)
  * Add Windows.System.WMIQuery (#1651)
  * Fixed data race in progress throttler. (#1653)
  * Implemented timeout and cpu limits on offline collector. (#1650)
  * Added an rpm server command. (#1647)
  * Artifacts can now define suggestions for notebook cells. (#1646)
  * Allow multiple OIDC authenticators to be specified. (#1645)
  * Added a multi authenticator. (#1644)
  * Add HashHunter hash() update for performance (#1643)
  * Change the DNSCache Artifact to WMI (#1640)
  * Added an uploader for notebooks.  (#1639)
  * Added hashselect arg option to hash() (#1637)
  * Add Generic.Detection.HashHunter and tests (#1638)
  * Added Generic.Collectors.SQLECmd (#1635)
  * Add BinaryHunter (#1634)
  * String artifact parameters can now have validator regex (#1628)
  * Implemented CPU rate limited for better control (#1622)
  * Added a client nanny to detect deadlocks (#1621)
  * Linux.Sys.Services artifact, parse services from systemctl (#1619)
  * Collect MAC addresses during interrogation and index them (#1611)
  * Allow parse_ntfs() to operate on an image file. (#1610)
  * Fix regression in VFSGetBuffer (#1605)
  * Added rekey() VQL function (#1604)
  * switch to uninstall string (#1603)
  * freebsd /etc/rc.d/velociraptor service script (#1602)
  * Add Windows.Registry.BackupRestore (#1601)
  * Optimized NTFS code for better speed and added more fields to parse_mft (#1599)
  * Update BinaryRename.yaml (#1598)
  * Added LinuxM1 (#1597)
  * Add explicit check of sticky keys (#1592)
  * Remote data store should identify retryable errors (#1590)
  * fix: gui/velociraptor/package.json &amp; gui/velociraptor/package-lock.json to reduce vulnerabilities (#1588)
  * Add test improvement clear system log (#18) (#1586)
  * Modified Windows.Forensics.Prefetch to use VQL binary parser (#1585)
  * add Windows.NTFS.ADSHunter first commit (#17) (#1583)
  * Resolves Velocidex/velociraptor#1543 Create new VQL entropy() function (#1574)
  * Remove C time and updating naming (#1546)
  * fix: gui/velociraptor/package.json &amp; gui/velociraptor/package-lock.json to reduce vulnerabilities (#1568)
  * Update OSPath protocols to support slices. (#1575)
  * Implement array slice notation in VQL and Server.Import.PreviousReleases (#1573)
  * add rtf TemplateInjection to Windows.Detection.TemplateInjection  (#1572)
  * Change accessors API to deal with OSPath objects directly.  (#1570)
  * Bump follow-redirects from 1.14.4 to 1.14.8 in /gui/velociraptor (#1567)
  * Added a deaddisk command to generate config (#1564)
  * Fix bug in Windows.System.Services (#1565)
  * Fixed glob expand braces order of operations. (#1560)
  * Added an offset and raw_file accessors (#1559)
  * Update CertUtil.yaml (#1558)
  * remove users to include the system path (#1536)
  * Implement remap() VQL function and remapping config (#1555)
  * Make GitHub actions more flexible on Windows (#1549)
  * Bump normalize-url from 4.5.0 to 4.5.1 in /gui/velociraptor (#1548)
  * Fix typo (#1547)
  * Refractor of accessors and path manipulations (#1545)
  * Dns etw update (#1544)
  * add PowershellProfile (#1542)
  * Added dynamic pubsub attributes (#1540)
  * Fix Windows.Applications.Chrome.History (#1539)
  * windows.application to windows.applications merge. New firefox history artefact (#1534)
  * Fixed race condition in zip accessor reference counting. (#1531)
  * Added Windows.Persistence.SilentProcessExit (#1530)
  * Add limitations section and lastwrite timestamp (#1529)
  * Offline collector FetchBinary should respect the IsExecutable flag (#1528)
  * update description, order by, and hidden keypath (#1527)
  * add limitations section (#1520)
  * Avoid holding index lock for too long. (#1519)
  * re-introduce Windows.Collectors.File with deprecation note (#1516)
  * add limitations to description and key path to query (#1514)
  * Retry remote datastore connections (#1513)
  * Write minion log files and autocert in its own dir.  (#1512)
  * Synced KapeFiles artifacts (#1511)
  * Added data retention server artifacts (#1510)
  * Set an upper limit for ttl in memcache (#1508)
  * Add updates to Windows.System.Services (#15) (#1509)
  * Ensure collector container is properly closed when interrupted. (#1507)
  * Continually rebuild the index at runtime. (#1506)
  * Harder vacuum - directly move client task directories to the attic. (#1505)
  * add limitation disclaimer (#1504)
  * Reduce critial section to avoid deadlock in repository manager (#1503)
  * Implemented a vacuum command to remove old tasks from client queues. (#1501)
  * Better format profile metrics output. (#1495)
  * Cap size of directories and report large directories. (#1493)
  * Set ACE completers per editor to avoid global state. (#1492)
  * Add HttpOnly flag to all cookies. (#1491)
  * Refactor completion routine calls (#1490)
  * Limit size of cached directories. (#1483)
  * Add more instrumentation to memory caches. (#1482)
  * Fixed chart resizing bug (#1481)
  * Removed the old queries: list from artifacts. (#1480)
  * [Snyk] Fix for 9 vulnerabilities (#1479)
  * Remove lock around critical section. (#1478)
  * Added MacOS.Forensics.AppleDoubleZip (#1476)
  * Update Windows.Persistence.PermanentWMIEvents to add blind custom namespace detection (#13) (#1475)
  * Make index snapshot frequency configurable (#1474)
  * Bugfix: Setting notebook index did not escape username (#1471)
  * Flush index from memory to disk  (#1470)
  * Fixed 2 bugs with the memcache file store (#1469)
  * Update flow active time when the result set is completed (#1468)
  * Tag artifacts as built ins (#1467)
  * Fixed bug in the pathspec() VQL function. (#1465)
  * fix APIConfigLoader not applying command line args (#1463)</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1651579201">- Fix error handling in tcpsnoop and dnssnoop.
  * If BTF information is unavailable, there is no indication that the
    query has failed.</changelog>
</package>
</otherdata>