Releases · google/grr

27 Jun 14:31

mbushkov

GRR release 3.4.7.5 Latest

Latest

This is a bugfix release:

grr-api-client package issue is fixed (no implicit dependency on grr-response-core).
Added support for listing %SystemDrive%\Users as a supplementary mechanism for collecting user profiles on Windows (additionally to using data from the registry).

Assets 2

28 May 17:11

mbushkov

GRR release 3.4.7.4

Regular release.

GRR server Debian package. We stopped providing the GRR server Debian
package as the main way of distributing GRR server and client binaries.
Instead we make GRR Docker image a preferred way for running GRR in a
demo or production environment. See the documentation here.
Removed support for Chipsec based flows.
Removed ClientArtifactCollector flow and related client actions.
Removed indexing endpoints on snapshot uname (searching is still possible
by individual and combination of system name, release and version).
Removed support for foreman rules using uname of an endpoint (this can be
simulated by using 3 rules for system name, release and version).
Removed the provides field from the Artifact message. This change has been
done in anticipation of the removal of the same field from the official GitHub
repository (ForensicArtifacts/artifacts#275).
Artifact parsers. ArtifactCollector flow supported parsing collected files
and output of executed commands. Its parsers were not properly maintained,
were often outdated and fragile. We're converted selected parsers
into standalone flows (CollectDistroInfo, CollectInstalledSoftware,
CollectHardwareInfo) and removed the artifact parsing subsystem.
The ArtifactCollector now works as if "apply_parsers" arguments
attribute is set to False. At some point the "apply_parsers" attribute will be
deprecated completely.

GRR docker image which contains all grr server components and client
templates. It is available for every new GRR version for download at
https://github.com/google/grr/pkgs/container/grr
Docker compose configuration file to run all GRR/Fleetspeak components in
separate Docker containers.
Python API was extended by a function (DecodeCrowdStrikeQuarantineEncoding)
to decode a crowdstrike quarantine encoded file, given as a
BinaryChunkIterator.

YARA memory scanning improvements (matching context options, consuming less bandwidth).

GetClientLoadStats API method (/api/clients/<client_id>/load-stats/<metric>).
Client load stats collection functionality was removed from GRR, as
it was rarely used and Fleetspeak already collects basic client stats anyway.
Instead of fixing/maintaining the GRR client load stats logic, we will
better to invest into Fleetspeak's client load stats enhancements.
ApiReportData definition (used by GetReport, /api/stats/reports/<name>)
changed: support for stack, line and pie charts removed. All stack/line/pie
chart report plugins removed (namely: GRRVersion1ReportPlugin,
GRRVersion7ReportPlugin, GRRVersion30ReportPlugin, LastActiveReportPlugin,
OSBreakdown1ReportPlugin, OSBreakdown7ReportPlugin, OSBreakdown14ReportPlugin,
OSBreakdown30ReportPlugin, OSReleaseBreakdown1ReportPlugin,
OSReleaseBreakdown7ReportPlugin, OSReleaseBreakdown14ReportPlugin,
OSReleaseBreakdown30ReportPlugin, SystemFlowsReportPlugin,
UserFlowsReportPlugin, MostActiveUsersReportPlugin, UserActivityReportPlugin).
GetFileDecoders API method
(/api/clients/<client_id>/vfs-decoders/<path:file_path>). Getting file
decoders functionality was removed as it was not used before.
GetDecodedFileBlob API method (/api/clients/<client_id>/vfs-decoded-blob/).
Get decoded file blob functionality was removed as it was unused before. Only
one decoder for decoding crowdstrike quarantine encoded files was implemented,
this functionality is now exposed via the Python API.

Assets 2

25 Oct 21:46

mbushkov

GRR release 3.4.7.1

Note: this is the last release containing the following features:

Artifact parsers. ArtifactCollector flow supports parsing collected files and output of executed commands. Its parsers are not properly maintained, are often outdated and fragile. We're going to convert selected parsers into standalone flows and remove the artifact parsing subsystem: the ArtifactCollector will always work as if "apply_parsers" arguments attribute is set to False. Afterwards the "apply_parsers" attribute will be deprecated completely. We will provide documentation on integrating GRR and ArtifactCollector with well-maintained parsing frameworks like Plaso.
Built-in cron jobs. Built-in cron jobs are primarily used for periodic hunts. We will provide documentation on how to easily replicate the current functionality using external scheduling systems (like Linux cron, for example).

If your workflow depends on GRR built in cron jobs and you anticipate problems when migrating it to external schedulers, please reach out to us via email or GitHub.
GRR server Debian package. We will stop providing the GRR server Debian package as the main way of distributing GRR server and client binaries. Instead we will make GRR Docker image a preferred way for running GRR in a demo or production environment.

If your workflow depends on any of the above, please feel free reach out to us via grr-users Google Group or GitHub.

Renamed AdminUI.new_hunt_wizard.default_output_plugin to AdminUI.new_hunt_wizard.default_output_plugins (note the "s" in the end). The new option accepts a comma-separated list of names.
Newly interrogated clients now pick up active hunts automatically.
Hunts workflow is now available in the new UI: creating hunts from a flow, duplicating existing hunts, monitoring hunt progress and inspecting results.

Fully removed deprecated use_tsk flag.
Removed deprecated plugin_args field from OutputPluginDescriptor.
Removed deprecated flows: FingerprintFile, KeepAlive, FingerprintFile, FindFiles, SendFile, Uninstall, UpdateClient, CollectEfiHashes, DumpEfiImage.
Deprecated GetFile flow in favor of MultiGetFile.
Made FileFinder an alias to ClientFileFinder, using ClientFileFinder by default everywhere. Legacy FileFinder is still available as LegacyFileFinder. Fixed several inconsistencies in ClientFileFinder client action. Same for RegistryFinder.
Removed deprecated client actions: EficheckCollectHashes, EficheckDumpImage, Uninstall, SendFile.
Removed "Checks" functionality.

Deprecated no-op "keep_client_alive" attribute in ApiCreateClientApprovalArgs.
Deprecated ListClientActionRequests API call (was no-op after Fleetspeak migration).

Assets 3