artifactsA list of artifacts to collect.list of string (required)
outputA path to write the output file on.string
reportA path to write the report on (deprecated and ignored).string
argsOptional parameters.Any
passwordAn optional password to encrypt the collection zip.string
formatOutput format (csv, jsonl, csv_only).string
artifact_definitionsOptional additional custom artifacts.Any
template(Deprecated Ignored).string
levelCompression level between 0 (no compression) and 9.int64
ops_per_secRate limiting for collections (deprecated).int64
cpu_limitSet query cpu_limit valuefloat64
iops_limitSet query iops_limit valuefloat64
progress_timeoutIf no progress is detected in this many seconds, we terminate the query and output debugging informationfloat64
timeoutTotal amount of time in seconds, this collection will take. Collection is cancelled when timeout is exceeded.float64
metadataMetadata to store in the zip archive. Outputs to metadata.json in top level of zip file.StoredQuery
concurrencyNumber of concurrent collections.int64

Required Permissions: FILESYSTEM_WRITE


Collect artifacts into a local file.

This plugin is essentially the same as the velociraptor artifacts collect --output command. It will collect the artifacts into a zip file.