Make the interrogation process customizable. (Velocidex#1451)

It is now possible to override the use of Generic.Client.Info with a custom version (Custom.Generic.Client.Info). The custom version will be used when enrolling and viewing the `VQL Drilldown` screen.
gavz · Dec 27, 2021 · 7d78219 · 7d78219
1 parent 63637b3
commit 7d78219
Show file tree

Hide file tree

Showing 15 changed files with 535 additions and 308 deletions.
diff --git a/actions/proto/vql.pb.go b/actions/proto/vql.pb.go
diff --git a/actions/proto/vql.proto b/actions/proto/vql.proto
@@ -168,6 +168,10 @@ message ClientInfo {
 
     string last_interrogate_flow_id = 16;
 
+    // This can be a customized artifact that is compatible with
+    // Generic.Client.Info
+    string last_interrogate_artifact_name = 21;
+
     uint64 last_hunt_timestamp = 17;
     uint64 last_event_table_version = 18;
 }
diff --git a/api/proto/api.pb.gw.go b/api/proto/api.pb.gw.go