Skip to content

StoreClientInfo/HWInfo: avoid breaking Interrogate on older servers - #1321

Merged
scudette merged 1 commit into
Velocidex:masterfrom
shortstack:fix-interrogate-search-match
Oct 6, 2026
Merged

scudette merged 1 commit into
Velocidex:masterfrom
shortstack:fix-interrogate-search-match

Conversation

@shortstack

@shortstack shortstack commented Oct 6, 2026 •

Copy link
Copy Markdown
Contributor

Problem

On servers before v0.77.1, importing the Artifact Exchange breaks the GUI's Interrogate button:

Unknown artifact Custom.Generic.Client.Info

In those versions, host-info.jsx startInterrogate() calls GetArtifacts with search_term: "Custom.Generic.Client.Info" and, if anything matches, launches Custom.Generic.Client.Info by name. The search is an unanchored regex over artifact names and descriptions (matchDescOrName in api/artifacts.go). The descriptions of Server.Monitor.StoreClientInfo and Server.Monitor.StoreClientHWInfo (added in #1203) contain that literal string, so after import the search hits and the GUI launches an artifact that doesn't exist.

v0.77.1+ is not affected (the GUI now launches Generic.Client.Info with allow_custom_overrides), but v0.76.x and older still are.

Fix

Reword the two descriptions so they no longer contain the string. Parameter defaults (InterrogationArtifact: Custom.Generic.Client.Info) and VQL are unchanged; the search never looks at them.

Testing

On v0.7.1-1 (GUI mode), with the exchange imported via Server.Import.ArtifactExchange using default parameters:

  • Before: the search returned both artifacts; Interrogate failed with Unknown artifact Custom.Generic.Client.Info.
  • After loading these two files: the search returned nothing; Interrogate launched Generic.Client.Info and finished.

Also confirmed v0.77.3 interrogates normally with the current exchange (the bug does not apply there).

Before v0.77.1, the GUI Interrogate button searches artifacts for
"Custom.Generic.Client.Info" (an unanchored regex over names and
descriptions) and, on any hit, launches that artifact by name. Both
descriptions contained the literal string, so importing the exchange
made Interrogate fail with "Unknown artifact Custom.Generic.Client.Info"
on servers without that override.

Reword the descriptions only; the InterrogationArtifact defaults are
unchanged.
@scudette
scudette merged commit 158e7f8 into Velocidex:master Oct 6, 2026
5 checks passed
@scudette

scudette commented Oct 6, 2026

Copy link
Copy Markdown
Collaborator

Thanks! this is a very insidious bug :-) Great sleuthing 👍🏽

@shortstack

Copy link
Copy Markdown
Contributor Author

Thanks! this is a very insidious bug :-) Great sleuthing 👍🏽

YAY thank you mike! 🫶

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants