You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
velociraptor: get_client_flow_results raises IndexError for multi-source artifacts #458
get_client_flow_results raises IndexError: list index out of range for any artifact that has more
than one source, for example Generic.Client.Info (BasicInformation, DetailedInfo, LinuxInfo).
query="SELECT * FROM flow_results(flow_id='"+flow_id+"', client_id='"+client_id+"')"results=self.request(api_config, query)
returnresults[0]
Without an artifact= argument, flow_results() returns no rows for a multi-source artifact, so results[0] fails.
Reproduce
Collect Generic.Client.Info on a client and wait for the flow to finish.
Call get_client_flow_results with that client and flow id. The action fails with IndexError.
The same flow returns rows with flow_results(..., artifact='Generic.Client.Info/BasicInformation').
A single-source artifact (e.g. Linux.Sys.Users) works.
Tested with app velociraptor/1.0.0 at b264148 against Velociraptor 0.77.3.
Suggested fix
Add an optional artifact parameter (artifact or Artifact/Source) and pass it to flow_results().
Return the full result list, or [], instead of results[0], so an empty result does not raise.
Activity