Skip to content
Please update to the latest release 0.77.3 to address Multiple CVEs.
Server.Import.PreviousReleases

Server.Import.PreviousReleases

Downloads and installs legacy artifact bundles from a specified older Velociraptor release.

When upgrading the Velociraptor server, the built-in artifacts may change and use newer VQL features that are not present in older clients.

If you have some older clients that cannot be upgraded, sometimes collection of updated built-in artifacts will fail due to incompatibility. In such situations it is necessary to import older VQL artifacts that will work with these older clients.

This server artifact allows you to automatically import all artifacts that came bundled with previous versions. These should be compatible with older clients, but may lack newer features and improvements that the latest artifacts have.


name: Server.Import.PreviousReleases
description: |
  Downloads and installs legacy artifact bundles from a specified
  older Velociraptor release.

  When upgrading the Velociraptor server, the built-in artifacts may
  change and use newer VQL features that are not present in older
  clients.

  If you have some older clients that cannot be upgraded, sometimes
  collection of updated built-in artifacts will fail due to
  incompatibility. In such situations it is necessary to import older
  VQL artifacts that will work with these older clients.

  This server artifact allows you to automatically import all
  artifacts that came bundled with previous versions. These should be
  compatible with older clients, but may lack newer features and
  improvements that the latest artifacts have.

type: SERVER

required_permissions:
- SERVER_ADMIN

parameters:
  - name: VelociraptorRelease
    description: |
      The Velociraptor Release to import.
    type: choices
    default: v0.75
    choices:
      - v0.72
      - v0.73
      - v0.74
      - v0.75

sources:
  - query: |
      LET Prefix <= regex_replace(source=VelociraptorRelease, re='\\.', replace="") + "."
      LET ExchangeURL = "https://docs.velociraptor.app/release_artifacts/release_artifacts_" + VelociraptorRelease + ".zip"

      LET X = SELECT artifact_set(
           prefix=Prefix, tags=VelociraptorRelease,
           definition=Definition) AS Definition
        FROM foreach(row={
          SELECT Content FROM http_client(
             remove_last=TRUE,
             tempfile_extension=".zip", url=ExchangeURL)
        }, query={
          -- Replace internal references to use the same version so
          -- artifacts are still internally consistent.
          SELECT regex_replace(source=read_file(accessor="zip", filename=OSPath),
             re='''(?sm) Artifact\.([a-z0-9._]+?[(])''',
             replace=" Artifact." + Prefix + "$1") AS Definition
          FROM glob(
             globs='/**/*.yaml',
             root=pathspec(
                DelegateAccessor="auto",
                DelegatePath=Content),
             accessor="zip")
          WHERE NOT Definition =~ "(?ms)type: +INTERNAL"
        })

        SELECT Definition.name AS Name,
               Definition.description AS Description,
               Definition.author AS Author
        FROM X