Velociraptor: read the collection status before the rows

The state is part of the result

A collection is a request that a named artifact run on a client. The result is the state of that request, the log lines, and any rows. Rows without the state are incomplete. A hunt progress count of clients finished is not a count of successful measurements; a client can finish in error and still be tallied as finished.

Write the client id, the hostname the server has for it, the artifact name including any parameters, the start time, the state, and the row count. Those belong in the case note even when you also download a zip.

Zero rows is an answer only after a clean finish

If the state says the artifact finished and the log has no error, zero rows means that artifact’s query returned nothing on that client. That is a real result, and you may write it, naming the artifact so nobody generalises it to “the host had nothing.”

If the log says the artifact failed, the operating system was wrong for it, or the client was offline, zero rows means you did not measure that fact. The note says the measurement failed and quotes the log line. It does not say the thing you were looking for was absent.

What to keep from the download

The zip is the bytes the server stored for that flow. Keep it with a hash, and keep the note that says which flow it was. A notebook cell that filtered the rows is a later question, not a replacement for the zip. If you cite the notebook, say which filter you added.

Do not cite a screenshot of an empty grid when the log tab was never opened. The empty grid is where both a clean zero and a failed artifact end up.

Worked case: a Windows artifact on a Linux client

A lab hunt asked every client for a Windows process list. lab-web-02 is Linux. The hunt marks that client completed, and the downloaded file has a header and no data rows. The collection log says the artifact does not apply to this operating system. A draft says the host has no processes.

The corrected note quotes the client id, the Windows artifact name, the error from the log, and row count zero. It says process state was not measured. A second collection uses the Linux process-list artifact, finishes without log errors, and returns rows. The finding cites that second flow id and does not cite the empty file.

Snippet

client: lab-web-02
artifact: Windows process list
state: finished with log error
rows: 0
log: artifact does not apply to this operating system
cite: no; process state was not measured

Diagram

Read a collection in this order

State
Did this request finish, fail, or never start?
Status
```
finished, error, or still waiting
```
Log
Is there an error line under the empty grid?
Log
```
wrong operating system, or permission
```
Rows
Only then read the count.
Table
```
zero after a clean finish is an answer
```
File
Keep the zip, the flow, and the client id together.
Note
```
the notebook filter is extra
```

Check yourself

1. A hunt says the client completed and the file has no data rows. What do you check next?

2. The artifact finished, the log is clean, and the row count is zero. What may you write?

3. A notebook filter hides every row. What is the source to cite for “what was collected”?