Update DetectRaptor.yaml (#679)

added asset timestamp improvement to only update content if checks pass
Velocidex · Sep 10, 2023 · 93dd53f · 93dd53f
1 parent a7c87bf
commit 93dd53f
Showing 1 changed file with 43 additions and 16 deletions.
diff --git a/content/exchange/artifacts/DetectRaptor.yaml b/content/exchange/artifacts/DetectRaptor.yaml
@@ -40,8 +40,8 @@ required_permissions:
 - SERVER_ADMIN
 
 parameters:
-   - name: TargetURL
-     default: https://github.com/mgreen27/DetectRaptor/releases/download/DetectRaptor/DetectRaptorVQL.zip
+   - name: ReleaseURL
+     default: https://api.github.com/repos/mgreen27/DetectRaptor/releases
    - name: Prefix
      default: DetectRaptor.
      description: Prefix to append to all imported artifacts.
@@ -51,25 +51,49 @@ parameters:
 
 sources:
   - query: |
-      -- get content return a row if new content or UpdateAnyway
-      LET get_content = SELECT Content as ZipPath, 
-            hash(path=Content,hashselect='SHA1').SHA1 as ZipSHA1 
-        FROM http_client(remove_last=TRUE, 
-            tempfile_extension=".zip", url=TargetURL)
-        WHERE NOT if(condition= UpdateAnyway,
-                    then= False,
-                    else= ZipSHA1 = server_metadata().DetectRaptorSHA )
+      -- first check for version timestamp and find zip url
+      LET content <= SELECT parse_json_array(data=Content)[0].assets[0] as Content 
+        FROM http_client(url=ReleaseURL)
+      LET check_version = SELECT Content.browser_download_url as TargetUrl,
+            Content.updated_at as ZipTimestamp,
+            if(condition= server_metadata().DetectRaptor,
+                        then= parse_json(data=server_metadata().DetectRaptor).Timestamp
+                            ) as InstalledTimestamp
+        FROM content
+        WHERE if(condition= UpdateAnyway 
+                        OR NOT server_metadata().DetectRaptor
+                        OR NOT InstalledTimestamp 
+                        OR InstalledTimestamp < ZipTimestamp,
+                then= True,
+                else= False )
                 
+      -- get content return a row if new content or UpdateAnyway
+      LET get_content = SELECT ZipPath,ZipTimestamp,ZipSHA1
+        FROM foreach(row= check_version,
+            query={ 
+                SELECT Content as ZipPath, 
+                    ZipTimestamp,
+                    hash(path=Content,hashselect='SHA1').SHA1 as ZipSHA1 ,
+                    if(condition= server_metadata().DetectRaptor,
+                        then= parse_json(data=server_metadata().DetectRaptor).SHA1
+                            ) as InstalledZipSHA1
+                FROM http_client(remove_last=TRUE, 
+                    tempfile_extension=".zip", url=TargetUrl)
+                WHERE NOT if(condition= UpdateAnyway,
+                            then= False,
+                            else= ZipSHA1 = InstalledZipSHA1 )
+            })
+                        
       -- extract and set artifacts
       LET set_artifacts <= SELECT 
             artifact_set(prefix=Prefix, definition=Definition) AS Definition,
             SHA1,
-            ZipSHA1
+            ZipTimestamp,ZipSHA1
         FROM foreach(row=get_content, 
             query={
               SELECT read_file(accessor="zip", filename=OSPath) AS Definition,
                 hash(path=OSPath,accessor='zip',hashselect='SHA1').SHA1 as SHA1,
-                ZipSHA1
+                ZipTimestamp,ZipSHA1
               FROM glob(
                  globs='/**/*.yaml',
                  root=pathspec(
@@ -79,12 +103,15 @@ sources:
             })
             
       -- Add new sha1 if set_artifacts
-      LET add_new_sha1 <= SELECT ZipSHA1,
-            server_set_metadata(metadata=dict(DetectRaptorSHA=ZipSHA1)) as SetSha1
+      LET add_new_metadata <= SELECT ZipSHA1,ZipTimestamp,
+            server_set_metadata(
+                metadata=dict(DetectRaptor=dict(
+                    Timestamp=ZipTimestamp,
+                    SHA1=ZipSHA1 ))) as SetMeta
         FROM set_artifacts
         WHERE log(level='INFO',
-                message='Server MetaData added: DetectRaptorSHA=%v',
-                args=ZipSHA1 )
+                message='DetectRaptor Server MetaData added: Timestamp=%v,SHA1=%v',
+                args=[ZipTimestamp,ZipSHA1] )
         GROUP BY ZipSHA1
 
       SELECT Definition.name AS Name,