Velociraptor

https://docs.velociraptor.app
Admin
Velociraptor is an advanced digital forensic and incident response tool that enhances endpoint...
Tokens:1,113,287
Snippets:7,601
Trust Score:7.3
Update:8 months ago
Show doc for...
Tokens:
Raw
### Execute Demo Setup Artifact using VQL

Source: https://docs.velociraptor.app/blog/2021/2021-10-22-a-closer-look-at-the-winning-entry-in-the-2021-velociraptor-contributor-competition-575c387610af

Runs the 'Temp.Setup.Demo' artifact, which installs other necessary artifacts, downloads tools to the server's inventory, and loads server monitoring artifacts. This process may take a few minutes due to binary downloads. The output includes logging information.

```vql
SELECT * from Artifact.Temp.Setup.Demo()
```

--------------------------------

### Example API Server Configuration

Source: https://docs.velociraptor.app/docs/deployment/server/multifrontend

This YAML snippet demonstrates the API server configuration required for a multi-server setup. Setting `bind_address` to `0.0.0.0` allows the API server to listen on all network interfaces, making it accessible to minions. The `hostname` should be set to the public hostname of the master server.

```yaml
API:
  hostname: master.velocidex-training.com
  bind_address: 0.0.0.0
  bind_port: 8001

```

--------------------------------

### Install Process Tracker

Source: https://docs.velociraptor.app/vql_reference/other/process_tracker

Installs a global process tracker with configurable sync and update queries, cache size, and enrichments.

```APIDOC
## POST /websites/velociraptor_app/process_tracker

### Description
Installs a global process tracker. The process tracker is an in-memory cache with a limited size, controlled by the `max_size` argument. It uses a sync query for full updates and an update query for live changes.

### Method
POST

### Endpoint
/websites/velociraptor_app/process_tracker

### Parameters
#### Request Body
- **sync_query** (StoredQuery) - Required - Source for full tracker updates. Query must emit rows with the ProcessTrackerUpdate shape - usually uses pslist() to form a full sync.
- **sync_period** (int64) - Optional - How often to do a full sync (default 5000 msec).
- **update_query** (StoredQuery) - Required - An Event query that produces live updates of the tracker state.
- **max_size** (int64) - Optional - Maximum size of process tracker LRU (default 10k records).
- **enrichments** (list of string) - Optional - One or more VQL lambda functions that can enrich the data for the process.

### Request Example
```json
{
  "sync_query": {
    "query": "SELECT * FROM pslist()"
  },
  "update_query": {
    "query": "SELECT * FROM process_events()"
  },
  "max_size": 20000,
  "enrichments": [
    "lambda(x: x.name + '_enriched')"
  ]
}
```

### Response
#### Success Response (200)
- **status** (string) - Indicates the success of the operation.

#### Response Example
```json
{
  "status": "Process tracker installed successfully."
}
```
```

--------------------------------

### Install Debian Package with Pre-seeding

Source: https://docs.velociraptor.app/artifact_references/pages/linux.utils

This snippet installs a Debian package using apt-get. It first pre-seeds debconf values using `debconf-set-selections` and then proceeds with the installation. It supports options for reinstallation, upgrade-only, and forcing configuration updates. Error logging is included for debconf and apt-get operations.

```velociraptor
LET Tool = SELECT OSPath
  FROM Artifact.Generic.Utils.FetchBinary(ToolName=DebTool,
                                                  TemporaryOnly=true,
                                                  SleepDuration=ToolSleepDuration)
LET Package <= if(
    condition=DebTool,
    then=Tool[0].OSPath,
    else=if(
      condition=DebFile,
      /* apt requires file names to end in an architecture name, so
         create a copy ending in "_amd64.deb". The architecture chosen
         here, amd64, does not need to match the architecture of neither
         the package or the system:
      */
      then=copy(dest=tempdir() + '/package_amd64.deb',
                filename=DebFile),
                      else=DebName))

/* The file name is lost from the uploaded file, so extract it from the
   package instead (apt has certain requirements for the file name):
*/
LET PackageInfo = SELECT Stdout
  FROM execve(argv=['/usr/bin/dpkg-deb', '--field', Package, 'Package'])

LET PackageName = if(condition=DebTool OR DebFile,
                            // remove "\n":
                            then=PackageInfo[0].Stdout[:-1], else=DebName)

/* The file format is "package_name question type answer": */
LET PreSeedLines = SELECT join(sep=' ', 
    array=(PackageName, Key, Type, Value)) AS Line
  FROM DebConfValues

LET PreSeedFile <= tempfile(data=join(sep='\n', array=PreSeedLines.Line))

LET AptEnv = dict(
    DEBIAN_FRONTEND='noninteractive',
    DEBCONF_NOWARNINGS='yes')

LET AptOpts <= ('-f', '-y', '-o', 'Debug::pkgProblemResolver=yes',
                   '--no-install-recommends') +
    if(condition=ForceConfNew,
       then=('-o', 'Dpkg::Options::=--force-confnew'), else=[]) +
    if(condition=Reinstall, then=('--reinstall', ), else=[]) +
    if(condition=UpgradeOnly, then=('--only-upgrade', ), else=[])

LET PreSeed = SELECT 'Pre-seed debconf' AS Step, * 
  FROM if(condition=DebConfValues, then={
      SELECT * 
      FROM execve(argv=['/usr/bin/debconf-set-selections', PreSeedFile, ])
      WHERE log(message='Pre-seeding %v', dedup= -1,
                args=PackageName,
                level='INFO')
       AND (NOT ReturnCode OR log(level='ERROR',
               message='%v failed: %v', args=(Step, Stderr)))
    })

/* Install regardless of whether package is installed or not, handing all
   the (arch-specific) version comparison logic to apt:
 */
LET Install <= SELECT * FROM chain(
    a_update={
      SELECT 'Updating index' AS Step, * 
      FROM if(condition=UpdateSources, then={
          SELECT * 
          FROM execve(argv=['/usr/bin/apt-get', '-y', 'update'])
          WHERE log(message='Updating package index before installing',
                    level='INFO')
        })
    },
    b_debconf=PreSeed,
    c_install={
      SELECT 'Installing package' AS Step, * 
      FROM execve(
        argv=('/usr/bin/apt-get', ) + AptOpts +
        if(condition=Package = DebName,
           then=('install', ) + split(sep='''\s+''', string=Package),
           else=('install', Package)),
        env=AptEnv)
      WHERE log(message='Installing deb package %v',
                args=PackageName,
                dedup= -1,
                level='INFO')
    })
  WHERE NOT ReturnCode OR log(level='ERROR',
                                  message='%v failed: %v',
                                  args=(Step, Stderr))

SELECT * FROM chain(
  a_install=Install,
  b_reconfigure={
    SELECT * FROM if(
      condition=ReconfigureIfInstalled AND (
         Reinstall OR Install.Stdout =~ 'Skipping|already the newest version'),
      then={
        SELECT 'Reconfiguring package' AS Step, * 
        FROM execve(argv=['/usr/sbin/dpkg-reconfigure', PackageName, ],
                    env=AptEnv)
        WHERE log(message='Reconfiguring deb package %v',
                  args=PackageName,
                  dedup= -1,
                  level='INFO')
         AND (NOT ReturnCode OR log(level='ERROR',
                                message='%v failed: %v',
                                args=(Step, Stderr)))
      })
  })

```

--------------------------------

### Install Debian Package using InstallDeb Utility

Source: https://docs.velociraptor.app/exchange/artifacts/pages/linux.event.network

This VQL snippet demonstrates how to leverage the InstallDeb utility to install a Debian package. It checks a condition to determine if the installation should proceed and then executes the InstallDeb command with the specified package name. The output of the installation is then chained with a result.

```vql
LET InstallDeps = SELECT *
          FROM if(
            condition=InstallNethogs,
            then={
              SELECT * 
              FROM Artifact.Linux.Utils.InstallDeb(DebName='nethogs')
            })

         SELECT * 
         FROM chain(a_install=InstallDeps,
                    b_result=Result)
```

--------------------------------

### Start Velociraptor Frontend

Source: https://docs.velociraptor.app/blog/html/2018/12/23/deploying_velociraptor_with_oauth_sso

Command to start the Velociraptor frontend application using a specified configuration file.

```bash
$ velociraptor --config server.config.yaml frontend

```

--------------------------------

### Install Timesketch Client Library

Source: https://docs.velociraptor.app/blog/2024/2024-09-12-timelines

Installs the necessary Python packages for interacting with the Timesketch API. This is a prerequisite for using the TimesketchUpload artifact.

```shell
pip install timesketch-import-client timesketch-cli-client

```

--------------------------------

### Start Instant Velociraptor GUI

Source: https://docs.velociraptor.app/docs/deployment

Starts Velociraptor in 'Instant' mode, launching both the server and a client in a single process for local system interrogation. The datastore location can be specified.

```bash
velociraptor.exe gui --datastore /path/to/datastore

```

--------------------------------

### Start Velociraptor GUI

Source: https://docs.velociraptor.app/docs/notebooks

Command to start the Velociraptor GUI. This command initiates a new server configuration, starts a local server, and connects a local client.

```bash
velociraptor.exe gui
```

--------------------------------

### Glob Plugin Usage Example

Source: https://docs.velociraptor.app/docs/forensic/filesystem/paths

An example VQL query using the glob plugin to search for files on a Windows system. It demonstrates the use of globs, root directory, and the auto accessor.

```VQL
SELECT OSPath
FROM glob(globs="*", root="C:\\Windows", accessor="auto")
```

--------------------------------

### Velociraptor get Function Example

Source: https://docs.velociraptor.app/vql_reference/popular/get

Demonstrates how to use the 'get' function to retrieve a nested field from a dictionary within an array. The 'member' parameter is used to specify the path to the desired field.

```velociraptor
select get(item=[dict(foo=3), 2, 3, 4], member='0.foo') AS Foo from scope()
```

--------------------------------

### Load Demo Setup Artifact using VQL

Source: https://docs.velociraptor.app/blog/2021/2021-10-22-a-closer-look-at-the-winning-entry-in-the-2021-velociraptor-contributor-competition-575c387610af

Adds the 'Temp.Setup.Demo' artifact to the server's artifact repository. This VQL query fetches the artifact definition from a remote URL using the http_client function and loads it with a specified prefix. The result indicates the success of the artifact loading.

```vql
SELECT artifact_set(prefix="Temp.", definition=Content) AS LoadResponse FROM http_client(url="https://raw.githubusercontent.com/predictiple/VelociraptorCompetition/main/artifacts/Temp.Setup.Demo.yaml")
```

--------------------------------

### GET /offset

Source: https://docs.velociraptor.app/docs/vql/vql_reference

Allows reading from another file starting at a specific offset.

```APIDOC
## GET /offset

### Description
Allow reading another file from a specific offset.

### Method
GET

### Endpoint
/offset

### Parameters
#### Query Parameters
- **file_path** (OSPath) - Required - The path to the file to read from.
- **offset** (int64) - Required - The starting offset in bytes.
- **length** (int64) - Optional - The number of bytes to read.

### Request Example
```json
{
  "file_path": "/var/log/syslog",
  "offset": 1024,
  "length": 512
}
```

### Response
#### Success Response (200)
- **data** (string) - The content read from the specified offset.

#### Response Example
```json
{
  "data": "..."
}
```
```

--------------------------------

### Linux Bind Mount Example

Source: https://docs.velociraptor.app/blog/2022/2022-01-05-searching-for-files-on-linux

This shell command sequence illustrates how to create a bind mount in Linux, which can lead to filesystem loops if not handled properly by search tools. It shows the creation of a directory, mounting the root filesystem onto it, and then attempting a find command that detects the loop.

```bash
# mkdir /root/bount
# mount --bind / /root/bound/
# find /root/
... 
/root/bound/usr/i686-w64-mingw32/lib/libcabinet.a
/root/bound/usr/i686-w64-mingw32/lib/binmode.o
find: File system loop detected; ‘/root/bound/root’ is part of the same file system loop as ‘/root/’.
```

--------------------------------

### Install Velociraptor MSI from Command Line

Source: https://docs.velociraptor.app/docs/deployment/clients

Installs the Velociraptor MSI package using the msiexec command. This requires elevated privileges and installs the binary and configuration to the default Program Files directory, creates the service, and starts it with automatic delayed startup.

```powershell
msiexec /i velociraptor_custom.msi
```

--------------------------------

### Install Velociraptor as a Service (macOS)

Source: https://docs.velociraptor.app/docs/deployment/clients

Installs the Velociraptor client as a persistent, automatically starting service on macOS. Requires root privileges and a configuration file. The service is managed by launchd.

```shell
sudo ./velociraptor service install --config client.config.yaml -v
```

--------------------------------

### Install Velociraptor Service using EXE

Source: https://docs.velociraptor.app/docs/deployment/clients

Installs the Velociraptor executable as a Windows service directly. This method is not recommended due to potential complications with uninstalls and upgrades. It requires elevated privileges and installs the binary and configuration to Program Files, creating and starting the service.

```powershell
velociraptor.exe service install --config client.config.yaml -v
```

--------------------------------

### process_tracker_install

Source: https://docs.velociraptor.app/docs/vql/vql_reference

Installs a global process tracker to monitor process activity.

```APIDOC
## POST /process_tracker_install

### Description
Installs a global process tracker that monitors process creation, termination, and other events. It can be configured with queries for full syncs and live updates.

### Method
POST

### Endpoint
/process_tracker_install

### Parameters
#### Request Body
- **sync_query** (StoredQuery) - Required - A query that provides full tracker updates, typically using `pslist()`.
- **sync_period** (int64) - Optional - How often to perform a full sync in milliseconds (default: 5000).
- **update_query** (StoredQuery) - Required - An event query that produces live updates of the tracker state.
- **max_size** (int64) - Optional - The maximum size of the process tracker's Least Recently Used (LRU) cache.
- **enrichments** (repeated string) - Optional - VQL lambda functions to enrich the process data.

### Request Example
```json
{
  "sync_query": "SELECT * FROM pslist()",
  "update_query": "SELECT * FROM process_tracker_update()",
  "sync_period": 10000,
  "max_size": 1000
}
```

### Response
#### Success Response (200)
- **message** (string) - Confirmation message that the process tracker has been installed.

#### Response Example
```json
{
  "message": "Global process tracker installed successfully."
}
```
```

--------------------------------

### Start Velociraptor Frontend

Source: https://docs.velociraptor.app/knowledge_base/tips/cloudflare_tunnel

Starts the Velociraptor frontend server using a specified configuration file. This command initiates the Velociraptor service, making it accessible via the configured ports.

```bash
velociraptor -c /etc/velociraptor/server.config.yaml frontend -v
```

--------------------------------

### Start MinIO Server (Linux)

Source: https://docs.velociraptor.app/knowledge_base/tips/dropbox_server

Starts a MinIO server instance on Linux. It requires setting root user credentials and a root password, specifying a directory for data storage, and defining ports for the console and API. Ensure to use strong credentials in production.

```bash
MINIO_ROOT_USER=admin MINIO_ROOT_PASSWORD=password ./minio server /tmp/minio --console-address ":9001" --address ":4566"
```

--------------------------------

### Example Minion Frontend Configuration

Source: https://docs.velociraptor.app/docs/deployment/server/multifrontend

This YAML snippet illustrates the configuration for an additional frontend, typically used for a minion server. It includes the minion's hostname, bind address, and port. The `dyn_dns` section shows how to configure dynamic DNS settings for automatic updates.

```yaml
ExtraFrontends:
- hostname: minion.velocidex-training.com
  bind_address: 0.0.0.0
  bind_port: 8100
  dyn_dns:
      ddns_username: ZWLfJ7InGAB1PcoC
      ddns_password: ufNrxN95HKhRjutM

```

--------------------------------

### Query for Notepad++ Installation (Velociraptor)

Source: https://docs.velociraptor.app/exchange/artifacts/pages/chrysalis

This Velociraptor query retrieves information about Notepad++ installations on Windows systems. It filters programs by 'DisplayName' matching 'notepad++' and 'DisplayVersion' matching versions starting with '8.8.' followed by a digit from 2 to 9.

```velociraptor
sources:
  - query: |
        SELECT * 
          FROM Artifact.Windows.Sys.Programs()
          WHERE DisplayName =~ '''notepad++'''
            AND DisplayVersion =~ "8\.8\.[2-9]"
```

--------------------------------

### RECmd Batch Rule Example

Source: https://docs.velociraptor.app/blog/2024/2024-04-12-registry-hunter

An example of a rule written in the RECmd Batch format. This rule targets Sysinternals software EULA acceptance, categorizing it as 'Installed Software' and providing a description and comment for the investigator.

```yaml
- 
    Description: Sysinternals
    HiveType: NTUSER
    Category: Installed Software
    KeyPath: SOFTWARE\Sysinternals\*
    ValueName: EulaAccepted
    Recursive: false
    Comment: |
       Displays all SysInternals Tools that had the EULA accepted,
       indicating either execution of the tool or the Registry values
       were added intentionally prior to execution

```

--------------------------------

### help

Source: https://docs.velociraptor.app/docs/vql/vql_reference

Dumps information about all VQL functions and plugins.

```APIDOC
## GET /websites/velociraptor_app/help

### Description
Dump information about all VQL functions and plugins.

### Method
GET

### Endpoint
/websites/velociraptor_app/help

### Parameters
(No parameters)

### Request Example
(No request body for GET request)

### Response
#### Success Response (200)
- **help_text** (string) - Detailed information about VQL functions and plugins.

#### Response Example
```json
{
  "help_text": "VQL Functions:\n  - gcs_pubsub_publish: Publish a message to Google PubSub...\nPlugins:\n  - glob: Retrieve files based on a list of glob expressions..."
}
```
```

--------------------------------

### Remap Registry Accessor for Installed Programs

Source: https://docs.velociraptor.app/blog/2022/2022-08-04-post-processing

This example shows how to map the 'raw_reg' accessor to the 'registry' accessor to parse registry hives from collected files. It specifically remaps the SOFTWARE hive, enabling the Windows.Sys.Programs artifact to enumerate installed programs by reading from the specified file path.

```vql
LET _ <= remap(clear=TRUE, config=regex_transform(source='''
    remappings:
        - type: mount
          from:
            accessor: raw_reg
            prefix: |-
              {
                "Path": "/",
                "DelegateAccessor": "fs",
                "DelegatePath": "/clients/ClientId/collections/FlowId/uploads/auto/C:/Windows/System32/config/SOFTWARE"
              }
            path_type: registry
          "on":
            accessor: registry
            prefix: HKEY_LOCAL_MACHINE\Software
            path_type: registry
''', map=dict(FlowId=FlowId, ClientId=ClientId)))

SELECT * FROM Artifact.Windows.Sys.Programs()
```

--------------------------------

### OSPath Drive Swap Example

Source: https://docs.velociraptor.app/docs/forensic/filesystem/paths

A VQL query demonstrating how to manipulate OSPaths to swap the drive letter. It constructs a new OSPath for the 'D:' drive and appends all components from an existing OSPath except the first one.

```VQL
SELECT pathspec(Path="D:", path_type="windows") + OSPath[1:]
FROM glob(globs="C:/Windows/*")
```

--------------------------------

### Access Memoized Data using Get Function

Source: https://docs.velociraptor.app/vql_reference/popular/memoize

After memoizing a query, its results can be accessed using the 'get()' function. This function takes the memoized object and the desired field as arguments, retrieving the corresponding row from the cache. This example retrieves the 'Name' of a process based on its 'Pid'.

```velociraptor
SELECT get(item=m, field=str(str=Pid)).Name AS ProcessName
FROM source()
```

--------------------------------

### VQL Basic Syntax Examples

Source: https://docs.velociraptor.app/docs/vql/fundamentals

Demonstrates the basic SELECT...FROM...WHERE syntax of VQL, highlighting its similarity to SQL but with key differences like the absence of JOIN and HAVING clauses. It also shows how whitespace is handled and that semicolons are not required.

```vql
-- This query is all on the same line - not very readable but valid.
LET X = SELECT * FROM info() SELECT * FROM X

-- We prefer well indented queries but VQL does not mind.
LET X= SELECT * FROM info()
SELECT * FROM X
```

--------------------------------

### Velociraptor Event Query for Service Installations (watch_evtx)

Source: https://docs.velociraptor.app/blog/html/2018/11/09/event_queries_and_endpoint_monitoring

An example of a Velociraptor event query using the `watch_evtx()` plugin to monitor service installation events in real-time from 'system.evtx'. Unlike `parse_evtx()`, this query does not terminate and continuously watches for new events. The `max_wait` flag controls batching of results.

```vql
SELECT EventData, System.TimeCreated.SystemTime from
   watch_evtx(filename='c:/windows/system32/winevt/logs/system.evtx') where
   System.EventId.value = '7045'
```

--------------------------------

### Clone and Run Open-Source Web Shell Server

Source: https://docs.velociraptor.app/presentations/2023_everything_open

This snippet demonstrates how to clone an open-source web shell from GitHub, compile it, and run it as a server. It specifies the port, username, and password for authentication, and the command to execute (e.g., bash).

```bash
$ git clone https://github.com/JiangKlijna/web-shell
$ cd web-shell
$ make
$ ./web-shell -s -P 2020 -u admin -p admin -cmd bash
```

--------------------------------

### VQL Dereferencing Field Reference to Get Value

Source: https://docs.velociraptor.app/golang/vtypes

Shows how to dereference a field reference using '.Value' to obtain the actual data of the field. This example calculates 'Field2' by adding 1 to the dereferenced value of 'Field1'.

```vql
[
  ["TestStruct", 0, [
     ["Field1", 2, "uint8"],
     ["Field2", 0, Value, {
         value: "x=>x.`@Field1`.Value + 1"
     }]
  ]]
]
```

--------------------------------

### Configure Autoexec for Velociraptor Client

Source: https://docs.velociraptor.app/knowledge_base/tips/online_collector

This configuration snippet defines the command-line arguments for the Velociraptor client when it starts. It includes the '-v' flag for verbose output and '--require_admin' to ensure the client runs with elevated privileges, similar to an installed client.

```yaml
autoexec:
  argv: ["client", "-v", "--require_admin"]

```

--------------------------------

### Example Client Configuration for Multi-Server

Source: https://docs.velociraptor.app/docs/deployment/server/multifrontend

This YAML snippet shows an example of the client configuration for a multi-server Velociraptor deployment. The `server_urls` list includes endpoints for both the master and minion servers, allowing clients to connect to either. This enables load balancing and failover capabilities.

```yaml
Client:
  server_urls:
    - https://master.velocidex-training.com:8000/
    - https://minion.velocidex-training.com:8100/

```

--------------------------------

### Fetch Client's External IP using http_client

Source: https://docs.velociraptor.app/vql_reference/popular/http_client

This example demonstrates how to retrieve the client's external IP address by making a simple GET request to an external service using the http_client plugin. It selects the 'Content' column and renames it to 'IP'.

```vql
SELECT Content as IP from http_client(url='http://www.myexternalip.com/raw')
```

--------------------------------

### Create MinIO User and Policy (JSON)

Source: https://docs.velociraptor.app/knowledge_base/tips/dropbox_server

Demonstrates creating a new user ('uploader') with specific access and secret keys for MinIO, and defining a JSON policy to grant this user `s3:PutObject` permissions on the 'uploads' bucket. This policy is then applied to the user via the `mc` tool.

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::uploads/*"
        }
    ]
}
```

```bash
# Add a new uploader user with specific access key and secret key
./mc admin user add uploader access_key_123 secret_key_123

# Create the policy from the JSON file
./mc admin policy create myminio uploader /tmp/uploader.policy.json
```

--------------------------------

### Install Atomic Red Team PowerShell Module

Source: https://docs.velociraptor.app/exchange/artifacts/pages/windows.attacksimulation

Installs the Invoke-AtomicRedTeam PowerShell module from GitHub. It ensures the NuGet package provider is installed and then fetches and installs the Atomic Red Team module. This is a prerequisite for running Atomic Red Team tests.

```velociraptor
LET InstallART <= if(condition=InstallART, then={
    SELECT * FROM execve(argv=[
        'powershell.exe',
        '-exec',
        'bypass',
        '-Command',
        "IEX (IWR https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1 -UseBasicParsing); Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser; Install-AtomicRedTeam -getAtomics -F"
    ])
})
```

--------------------------------

### Install Nethogs Package using InstallDeb

Source: https://docs.velociraptor.app/exchange/artifacts/pages/linux.network

This snippet demonstrates how to install the 'nethogs' package on a Linux system using the InstallDeb utility. It checks a condition 'InstallNethogs' before proceeding with the installation. The result of the installation is then chained with another result.

```vql
LET InstallDeps = SELECT *
  FROM if(
    condition=InstallNethogs,
    then={
      SELECT * FROM Artifact.Linux.Utils.InstallDeb(DebName='nethogs')
    })

SELECT * FROM chain(a_install=InstallDeps,
                   b_result=Result)
```
Tokens:
Raw