diff --git a/content/docs/clients/troubleshooting/_index.md b/content/docs/clients/troubleshooting/_index.md index 3742b59ab4e..6324fc0ba4b 100644 --- a/content/docs/clients/troubleshooting/_index.md +++ b/content/docs/clients/troubleshooting/_index.md @@ -8,7 +8,7 @@ weight: 80 ### Debugging a remote client In the section -[Debugging Velociraptor](/docs/deployment/troubleshooting/#debugging-velociraptor) +[Debugging Velociraptor]({{< ref "/docs/deployment/troubleshooting/#debugging-velociraptor" >}}) we explain how to bring up the debug server by providing the `--debug` commandline, but existing clients are not normally already running with this flag. Often we are trying to collect an artifact from a remote client and we diff --git a/content/docs/clients/vfs/_index.md b/content/docs/clients/vfs/_index.md index f1165e96bdd..1c0af012cab 100644 --- a/content/docs/clients/vfs/_index.md +++ b/content/docs/clients/vfs/_index.md @@ -144,5 +144,5 @@ then click over multiple directories searching for these files. To automate collection it is better to write special purpose `VQL Artifacts` to identity the information of interest. -The [Artifacts](/docs/vql/artifacts/) section explores what Velociraptor +The [Artifacts]({{< ref "/docs/vql/artifacts/" >}}) section explores what Velociraptor artifacts are and how we collect them. \ No newline at end of file diff --git a/content/docs/deployment/clients/_index.md b/content/docs/deployment/clients/_index.md index ad60e0fab48..587a263b8fb 100644 --- a/content/docs/deployment/clients/_index.md +++ b/content/docs/deployment/clients/_index.md @@ -15,7 +15,7 @@ however this amounts to running the Velociraptor binary and providing it with a client configuration file. The configuration file provides the client with cryptographic material and settings. We saw how to generate the client configuration file in -[this previous section](/docs/deployment/self-signed/#generate-the-configuration-file). +[this previous section]({{< ref "/docs/deployment/self-signed/#generate-the-configuration-file" >}}). On this page we explain how to run, and optionally install, clients on the most common platforms. There is no single "correct" way to deploy and use @@ -97,7 +97,7 @@ the section [Agentless deployment](#agentless-deployment). ### Windows The recommended way to install Velociraptor as a client on Windows is via the -release MSI which you can find on our [Downloads](/downloads/) page. Previous +release MSI which you can find on our [Downloads]({{< ref "/downloads/" >}}) page. Previous releases can be found on the [Releases page at Github](https://github.com/Velocidex/velociraptor/releases). An MSI is a standard Windows installer package. The benefit of using this @@ -138,7 +138,7 @@ identify the location of *your* server, we can't package the configuration file in the official release. Therefore, the official MSI does not include a valid configuration file. You will need to modify the release MSI to include your client configuration file, which you -[generated earlier](/docs/deployment/self-signed/#generate-the-configuration-file), +[generated earlier]({{< ref "/docs/deployment/self-signed/#generate-the-configuration-file" >}}), and this is done through a process we call "repacking". The official release installs the Velociraptor executable into @@ -151,7 +151,7 @@ will be upgraded and the client configuration file will be overwritten. The easiest way to repack the MSI package so that it includes your client config file is by using the -[`Server.Utils.CreateMSI`](/artifact_references/pages/server.utils.createmsi/) +[`Server.Utils.CreateMSI`]({{< ref "/artifact_references/pages/server.utils.createmsi/" >}}) server artifact. 1. In the Velociraptor web GUI, simply switch to the relevant Organization, then @@ -191,7 +191,7 @@ To repack the MSI with a custom config on the command line we use the `config` command, and the `repack` subcommand, with the `--msi` flag. In all cases we need to tell Velociraptor which MSI we want to repack (usually -it's the [official release MSI](/downloads/): either 64-bit or 32-bit) and what +it's the [official release MSI]({{< ref "/downloads/" >}}): either 64-bit or 32-bit) and what the output file should be named. {{< tabs >}} {{% tab name="Linux" %}} @@ -211,7 +211,7 @@ velociraptor.exe config repack --msi velociraptor-windows.msi client.config.yaml {{% /tab %}} {{< /tabs >}} -If you are using Velociraptor [organizations](/docs/deployment/orgs/) ("orgs") +If you are using Velociraptor [organizations]({{< ref "/docs/deployment/orgs/" >}}) ("orgs") then you can obtain the client configuration file for each org from the Home page in the GUI. Ensure that you are in the `root` org so that the configs for all orgs are accessible. @@ -452,7 +452,7 @@ provide specific advice or step-by-step instructions for these tools. Some of the additional considerations and complexities with deployments in macOS environments are described in -[this presentation](/presentations/2022_velocon/#mac-response--the-good-the-bad-and-the-ugly). +[this presentation]({{< ref "/presentations/2022_velocon/#mac-response--the-good-the-bad-and-the-ugly" >}}). ### Linux @@ -623,7 +623,7 @@ the Go 1.20 release. This means that Windows XP, Windows server 2003, and Windows 7/Vista can no longer be built using a supported version of Go. We may make occasional (depending on demand for it) builds for Windows 7 using an old unsupported version of Go, but these will not be supported and may not be the -latest version. Please see [our Support Policy](/docs/overview/support/). +latest version. Please see [our Support Policy]({{< ref "/docs/overview/support/" >}}). We also distribute 32-bit binaries for Windows but not for Linux. If you need 32-bit Linux builds you will need to build from source. You can do this easily @@ -655,7 +655,7 @@ reboot. So this method is suitable for quick hunts on corporate (non roaming) assets. #### Create a network share diff --git a/content/docs/deployment/security/_index.md b/content/docs/deployment/security/_index.md index 5bb71f4f586..1b7dda909b0 100644 --- a/content/docs/deployment/security/_index.md +++ b/content/docs/deployment/security/_index.md @@ -681,7 +681,7 @@ way regardless of who launched the collection in the first place. However this may give lower privilege users a lot of power over the entire network. For example the artifact -[Windows.System.PowerShell](/artifact_references/pages/windows.system.powershell/) allows +[Windows.System.PowerShell]({{< ref "/artifact_references/pages/windows.system.powershell/" >}}) allows running arbitrary shell commands on the endpoint. While this is a useful capability in limited situations it may lead to severe compromise if misused! diff --git a/content/docs/gui/hunting/_index.md b/content/docs/gui/hunting/_index.md index 5d21731f41c..5b410daef0b 100644 --- a/content/docs/gui/hunting/_index.md +++ b/content/docs/gui/hunting/_index.md @@ -153,7 +153,7 @@ into the hunt. Note that I can use this technique to automatically schedule clients into various hunts using the VQL -[label()](/vql_reference/server/label/) function. Therefore I can use +[label()]({{< ref "/vql_reference/server/label/" >}}) function. Therefore I can use this technique to automatically add clients to various hunts based on previous findings. @@ -208,7 +208,7 @@ to keep the old collection around or just delete it. ![Hunt with additional collection](manual_hunt_3.png) You can add collections to a hunt using the -[hunt_add()](/vql_reference/server/hunt_add/) VQL function which +[hunt_add()]({{< ref "/vql_reference/server/hunt_add/" >}}) VQL function which allows unlimited automation around which flows are added to hunt (and can also automate the relaunching of the collections). diff --git a/content/docs/server_automation/server_api/_index.md b/content/docs/server_automation/server_api/_index.md index 5c01b236904..c848013e09a 100644 --- a/content/docs/server_automation/server_api/_index.md +++ b/content/docs/server_automation/server_api/_index.md @@ -319,7 +319,7 @@ will use that api configuration file to connect remotely to the API server and run the query there. Running VQL queries through the API client is equivalent to running them in a -[notebook](/docs/vql/notebooks/) on the server. +[notebook]({{< ref "/docs/vql/notebooks/" >}}) on the server. This can be chained to other tools and automation orchestrated with a simple bash script: