Add flow completion e-mail notification artifact #1094
Conversation
Use mail() to send an e-mail when a flow completes (or fails).
|
Job fails due to Velocidex/velociraptor#4368 |
| args=(Title, Summary, Table(Values=TableRowsDict))) | ||
|
|
||
| // Add some CSS to make the table look at least a bit nice: | ||
| LET Body = if( |
There was a problem hiding this comment.
Might be easier to use the new template() function
There was a problem hiding this comment.
Cheers. I was not aware of this new function. The VQL docs were a bit minimal. How much is implemented (from the go docs)? if, else, printf, with, whitespace modifiers,"|", any functions? Are VQL functions from the scope available?
There was a problem hiding this comment.
After further thought I realized that the template feature is only available in the head release and so this makes the artifact not work on older servers. This might be OK for you though?
We should hopefully have an RC out very soon.
This increases readability and does not require escaping '%'.
The reference to the artifact name did not match the actual artifact name.
Refactor use of "useless scope()".
Also remove empty tables if there are no arguments, just like with all other fields.
|
I am going to rename the artifact, export useful functions, and also create another similar artifact that creates e-mails for alerts (Server.Internal.Alerts), hence the draft status. The work put into formatting dicts into HTML tables will be reused to present alert context in e-mails produced by alerts. |
The original artifact has been completely rewritten with mostly the same features, except one can choose to get e-mails for failed flows even if they do not match filters. A new artifact, Server.Monitoring.Alerts, sends e-mails for alerts sent with alert(). Just as the original artifact, it includes a bunch of client and flow context, in addition to the alert context. A parameter lets one extract a severity value from the alert context, since such a concept is not native to alert().
|
The artifact descriptions need a little update, I want to rename the original artifact, and I want to write a knowledge base entry on how to set these up. The KB artifact should include examples on how alerts can be used. |
2 participants
From the artifact description:
If HTML is enabled, the e-mails look something like this:
Rows containing empty information, like in this example "Urgent", "Hunt", "Uploaded files", "Uploaded bytes" and "Error", are left out. For consistency, these can be included even if falsy by setting KeepEmptyRows to true.
In this example, a row called "Computer serial" is a custom line configured by adding the following to the ClientMetadata parameters:
where "serial" is a client metadata field for the client that completed the flow.
The same result looks like this in plain text:
If a flow fails, the output looks as follows: