Velociraptor: the hostname is not the client id

The id is the enrollment

When a client enrolls, the server gives it a client id. Collections, hunts, and rows are tied to that id. The hostname shown beside it is whatever the client reported at the time. A reinstall, a cloned lab image, or two VMs with the same name can report one hostname for two ids.

A note that says “the lab host” without the client id can be read as either enrollment. The rows will not match.

A rename does not move the old rows

If someone renames a VM, new collections may show the new hostname on the same client id. Older collections keep the hostname that was reported then. Cite the id, and quote the hostname as of that collection. Do not rewrite old rows to the new name.

The other direction matters too. A new enrollment that reused the hostname gets a new id. Its rows are not a continuation of the previous id.

What to file

File the client id on every collection you cite. File the hostname as “reported name” with the collection time. If two ids share a name, say so and do not add their row counts together. A hunt progress line that shows only the hostname is incomplete until you have the id.

Worked case: two clients both named lab

The lab server shows client id C.111 and client id C.222, each with reported hostname lab. A process collection on C.111 has 40 rows. C.222 has 12. A draft adds them and says “lab has 52 processes.”

The note lists the two ids separately, each with its own row count and the reported name lab. It does not add the counts. A reader who meant the newer VM can pick C.222. The combined 52 is not a host.

client id: C.111  reported hostname: lab  process rows: 40
client id: C.222  reported hostname: lab  process rows: 12
write: two enrollments
not: one host with 52 processes