Velociraptor orgs command deprecation?

[FormindALH]

Hi there Velociraptor community,

While working on our Velociraptor automated deployment and upgrading from 0.7.1.1 to 0.73.3, I noticed that the "orgs" command had disappeared.

Is there any chance it might come back or is it gone for good? It was pretty useful in our use-case since the initial_orgs value only works on initial startup, but ours is pre setup and used as a template.

[scudette]

Can you explain how you were using that flag? It's likely that it's not needed any more

[FormindALH]

Hi,

Yes the use-case was for a creation of another Org on deployment, we get the name from an AWS tag on the EC2 instance and create the Org in a pre-execution script of our Velociraptor Service.

I just tried using the probably new preferred way of doing this via a CLI execution of the Server.Orgs.NewOrg artifact but it doesn't seem to work.

I'm new to this type of Velociraptor usage so this might be user error here? Here is what i tried :
/opt/velociraptor/velociraptor artifacts collect --args OrgName=MyOrg Server.Orgs.NewOrg --config /etc/velociraptor/server.config.yml
Output :
[ { "Name": null, "OrgId": null, "AdminUser": null, "_Source": "Server.Orgs.NewOrg" } ]

Then :
/opt/velociraptor/velociraptor artifacts collect --args OrgName="MyOrg" --runas=veloadmin Server.Orgs.NewOrg --config /etc/velociraptor/server.config.yml
Output:
[ { "Name": null, "OrgId": null, "AdminUser": null, "_Source": "Server.Orgs.NewOrg" } ]

The issue might be related to the condition that this Artifact needs to be run in the root Org however there is currently no other Org than root so it should be run in the root one? (There doesn't seem to be an orgs flag too, is the config required a client one to load the Org info from?)

[FormindALH]

The veloadmin account is our "superuser" created on initial velociraptor startup.

I tried with a client Artifact without args Linux.Ssh.AuthorizedKeys, and I got the output expected, but no result in GUI.

With that in mind and the absence of an "--org" flag, I think the problem for my use-case here is that this type of execution just makes a singular collection like a client but in no way connected to an org or the running instance of the Velociraptor server.

Is that correct and would I only be able to execute my use-case via API usage?

[scudette]

We don't support running administrative artifacts using the artifacts collect command. You have to connect to the server via the API to run such artifacts because we need to be communicating with a running server.

You can automatically create new orgs in the config file with

https://docs.velociraptor.app/docs/deployment/references/#GUI.initial_orgs

You can automatically launch server artifacts on initial install with

https://docs.velociraptor.app/docs/deployment/references/#Frontend.initial_server_artifacts

These are normally used for server initialisation by adding administrative vql to a custom artifact.

You can include such custom artifacts directly in the config file

https://docs.velociraptor.app/docs/deployment/references/#autoexec.artifact_definitions

Or in a directory

https://docs.velociraptor.app/docs/deployment/references/#Frontend.artifact_definitions_directory

[FormindALH]

Thanks for the quick reply!

For our use-case both the first two options wouldn't work as the Velociraptor install is done for the image creation and not on deployment.

I knew about the hunt collection import we already make use of it, sadly this wouldn't help in our use-case given the first 2 options aren't available to us🫤

[scudette]

The reason the orgs command was removed is because it's not possible to run vql commands outside the running server any more - previously the command changed the data on disk but there was no way to notify the running server of the changes.

To run administrative vql now you have to make an API call through the velociraptor query command with the --api_config flag.

You can create API keys as described here https://docs.velociraptor.app/docs/server_automation/server_api/

[FormindALH]

Noted !

This was my last hope so we'll be using this then, since everything is doable via CLI this is perfect for our usage.

Thanks again for your fast responses!