Velociraptor: the parameters are part of the request

The result matches the request that ran

Artifacts take parameters: a path, a time bound, a regex. The collection stores the values that were sent. The rows are the answer to that request, not to the artifact’s default text and not to the question you remember asking.

A display name is a label on the hunt. It can say “all scheduled tasks” while the parameter that ran was a narrow pattern. The rows will look small because the request was small.

A default is still a value that was used

If the request did not override a parameter, the artifact’s default was used. Write that default as the value that ran, and say it was the default. Do not write “no filter” unless the request’s value is actually empty and you have read it.

Changing the default in the artifact later does not change a collection that already finished. The old request still has the old value.

What to file

File the client id or the hunt id, the artifact name, and each parameter name with the value from the request. File the row count next to those values. If you cannot find the request’s parameters, write “parameters not opened” and do not summarize the rows as “everything.”

Worked case: a hunt name that overclaimed

A lab hunt is titled “All scheduled tasks.” The request’s PathRegex value is only a Temp folder pattern. The result is three rows, all under Temp. A draft says the lab has three scheduled tasks in total.

The note quotes the hunt id, the artifact name, and PathRegex as that Temp pattern. The three rows are tasks that matched the pattern. The title is a label. Tasks outside Temp were not requested, so they are not in this count.

hunt id: H.lab1
title: All scheduled tasks (label)
artifact: scheduled tasks
PathRegex sent: a Temp-folder pattern
rows: 3, all under that pattern
write: three matches for that request
not: three tasks on the host