Managing Artifacts¶

Artifacts are files produced by agents during operations and stored on the server, for example files an agent collects from a target or output it generates while running a capability. Unlike assets, artifacts are not uploaded from the client: they are created by agents, so there is no upload sub-command, only sub-commands to list, inspect, download, rename, describe, and remove them.

Artifacts are one of the three repository resources managed by the asset, artifact, and payload commands, which are available in every connected interpreter under the Resource Management Commands group in help.

Artifact commands¶

Every artifact operation is a sub-command of artifact:

Sub-command names and artifact resource IDs tab complete. Each sub-command carries its own help:

artifact --help            # list the available sub-commands
artifact download --help   # show the arguments and examples for one sub-command

Inspecting an artifact¶

artifact info <resource_id> shows an artifact's details, including the agent that produced it. Pass -v (or --verbose) to additionally display detailed information about that agent:

artifact info 123e4567-e89b-12d3-a456-426614174000       # show artifact details
artifact info 123e4567-e89b-12d3-a456-426614174000 -v    # also show producing agent details

The producing agent recorded on an artifact is a point-in-time reference. If that agent has since been deleted the artifact and its details remain available, but the verbose agent view can no longer be shown.

Downloading an artifact¶

artifact download <resource_id> downloads an artifact from the server to the client machine. Use artifact list to find the resource ID and artifact info <resource_id> to inspect an artifact before downloading it:

artifact download 123e4567-e89b-12d3-a456-426614174000                    # download to the current directory
artifact download 123e4567-e89b-12d3-a456-426614174000 -o ./loot/out.bin  # download to a specific path
artifact download 123e4567-e89b-12d3-a456-426614174000 -w                 # overwrite an existing file
artifact download 123e4567-e89b-12d3-a456-426614174000 -d                 # decompress a downloaded artifact directory

By default an artifact directory is downloaded as a .zip archive. Pass -d (or --decompress) to automatically extract artifact directories after downloading.

An artifact's name is whatever it was created or renamed as, extension included, and it is the name the download is saved under when -o is not given (with .zip appended for an artifact directory). The server stores the file itself under the artifact's resource ID, so the name is free to be anything: it never has to match what is on disk.

Renaming, describing, and removing an artifact¶

artifact rename 123e4567-e89b-12d3-a456-426614174000 "target_hosts.txt"
artifact describe 123e4567-e89b-12d3-a456-426614174000 "collected from the file server"
artifact remove 123e4567-e89b-12d3-a456-426614174000

Artifacts are the counterpart to assets in the agent workflow: task an agent with a capability, then use these sub-commands to retrieve and manage the files it produces. See Tasking Agents.