Velociraptor

Support
1

Trying to do a Kape Triage collection using Velociraptor and keep receiving this error - extensions/ext-velociraptor lc_error_code:EXTENSION_ERROR - UNKNOWN ERROR CODE (FE80) : UNKNOWN ERROR CODE (3FFF003E)

2

I’ve never seen that one before :thinking: Can you show the parameters you’re using to launch the extension?

3

Hello Eric, please see below. In the screenshot I didn’t include a sensor ID, but when I ran this I did. I have ran this before with this customer successfully. All of the D&R rules are in place as well.

image
image2020Ă—1124 140 KB

4

Yeah that all checks out… :thinking: might need @maximelb on this one

5

I tried this on a different tenant and see the Velociraptor sensor emitted a job_created event but that was it. No artifact_generated or artifact_uploaded events were emitted.

6

taking a look at this…