Ianhelle/velociraptor provider 2023 05 19

[ianhelle]

Velociraptor data provider

The Velociraptor data provider can read Velociraptor log files and provide convenient query functions for each data set in the output logs.

The provider can read files from one or more hosts, stored in in separate folders. The files are read, converted to pandas DataFrames and grouped by table/event. Multiple log files of the same type (when reading in data from multiple hosts) are concatenated into a single DataFrame.

To use the Velociraptor provider, you need to create an QueryProvider instance, passing the string "Velociraptor" (or "VelociraptorLogs") as the data_environment parameter. You also need to add the data_paths parameter to specify specific folders that you want to search for log file (although you can set these paths in msticpyconfig.yaml, if you do this frequently).

You can specify multiple folders to have the logs from different hosts.

    qry_prov = mp.QueryProvider("VelociraptorLogs", data_paths=["~/my_logs"])

Calling the connect method triggers the provider to read the locations of the
log files (although the contents are not read until a query function is run).

    qry_prov.connect()


## Listing Velociraptor tables

```python3
    qry_prov.list_queries()

    ['velociraptor.Custom_Windows_NetBIOS',
    'velociraptor.Custom_Windows_Patches',
    'velociraptor.Custom_Windows_Sysinternals_PSInfo',
    'velociraptor.Custom_Windows_Sysinternals_PSLoggedOn',
   ....

Each query returns the table of data types retrieved from the logs.

    qry_prov.vc_prov.velociraptor.Windows_Forensics_ProcessInfo()

Name	PebBaseAddress	Pid	ImagePathName	CommandLine	CurrentDirectory	Env
LogonUI.exe	0x95bd3d2000	804	C:\Windows\system32\LogonUI.exe	"LogonUI.exe" /flags:0x2 /state0:0xa3b92855 /state1:0x41c64e6d	C:\Windows\system32\	{'ALLUSERSP
dwm.exe	0x6cf4351000	848	C:\Windows\system32\dwm.exe	"dwm.exe"	C:\Windows\system32\	{'ALLUSERSP
svchost.exe	0x6cd64d000	872	C:\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k termsvcs	C:\Windows\system32\	{'ALLUSERSP
svchost.exe	0x7d18e99000	912	C:\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted	C:\Windows\system32\	{'ALLUSERSP
svchost.exe	0x5c762eb000	920	C:\Windows\system32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalService	C:\Windows\system32\	{'ALLUSERSP

[juju4]

Great work @ianhelle and thanks for the multiple reviews.