Managing User-Created Objects#

Users can create a variety of objects within the Gravwell system:

  • Resources

  • Saved/backgrounded searches

  • Scheduled searches/scripts

  • Dashboards

  • Templates

  • Userfiles

At this time, there are no GUI utilities for managing these objects as the administrator. However, the Gravwell command-line client can list, delete, and modify all of these object types using options in the admin sub-menu.

To access these management options, run the client, log in as an administrator user, and enter the admin menu:

$ ./client -s
Username:  admin
#>  admin
admin>  help
add_user            Add a new user
impersonate_user    Impersonate an existing users
del_user            Delete an existing user
get_user            Get an existing users details
update_user         Update an existing user
list_users          List all users
lock_user           Lock a user account
user_activity       Show a specific users activity
user_sessions       Show all open sessions
change_user_pwd     Change a users password
change_admin        Set a users admin status
add_group           Create a new group
del_group           Delete an existing group
list_groups         Lists all existing groups
list_group_users    Lists all members of an existing group
update_group        Update an existing group
add_users_group     Add users to an existing group
del_users_group     Delete users from an existing group
add_user_groups     Add user to existing groups
del_user_groups     Delete a user from groups
get_log_level       Get the webservers current logging level
set_log_level       Set the webservers current logging level
all_dashboards      Get all dashboards for all users
del_dashboard       Delete a dashboard owned by another user
license_info        Display license information
license_sku         Display license SKU
license_serial      Display license Serial Number
license_update      Upload a new license
list_queries        List all queries (active and saved) for all users
delete_queries      Delete any query (active or saved) for any user
list_users_storage  List all users current storage usage
add_indexer         Add another indexer to the configuration
list_extractions    List installed autoextractors
add_extraction      Add a new autoextractor
delete_extraction   Delete an installed autoextractor
update_extraction   Update an installed autoextractor
sync_extractions    Force a sync of installed autoextractors to indexers
resource            Create and manage resources
scheduled_search    Manage scheduled searches
templates           Manage templates
pivots              Manage actionables
userfiles           Manage user files
kits                Manage and upload kits

The rest of this section will briefly describe management options for each object type.

Managing Dashboards#

To list all dashboards on the system, from the admin menu run the all_dashboards command.

To delete a dashboard, run the del_dashboard command from the admin menu.

Managing Searches#

To list all searches on the system (saved, backgrounded, or active), run the list_queries command from the admin menu.

To delete a query, run the delete_queries command.

Managing Resources#

The admin sub-menu contains its own sub-menu for managing resources with commands mirroring those available in the regular resource menu:

admin>  resource
resource>  help
list                	List available resources
create              	Create a new resource
update              	Upload new data to a resource
delete              	Delete a resource
updatemeta          	Update resource metadata

From this menu, the administrator can list all resources on the system, modify a resource’s contents, change its name/description/ownership, or delete it.

Managing Scheduled Searches#

The admin sub-menu contains its own sub-menu for managing scheduled searches:

admin>  scheduled_search
scheduled search>  help
list                	List saved searches
listall             	List all saved searches
create              	Create a new scheduled search
createscript        	Create a new scheduled search w/ script
delete              	Delete a scheduled search

From this menu, the administrator can manage all scheduled searches on the system, not just his/her own.

Managing templates/actionables#

Templates and actionables (called “pivots” here) each have a sub-menu within the admin menu (templates and pivots) with an identical set of commands for administrators:

admin>  templates
template>  help
list                	List templates
create              	Create a new template
update              	Upload new contents to a template
delete              	Delete a template
print               	Print template contents
updatemeta          	Update template metadata
template>  quit
admin>  pivots
pivot>  help
list                	List actionables
create              	Create a new actionable
update              	Upload new contents to an actionable
delete              	Delete an actionable
print               	Print actionable contents
updatemeta          	Update actionabl metadata

These commands can be used to affect any template or actionable on the system.

Managing User Files#

As with templates, resources, etc., user files also have a sub-menu within the admin menu for admin management. Commands executed within the admin menu can operate on any user file in the whole system.

admin>  userfiles
userfile>  help
list                	List available userfiles
add                 	Add a new userfile
update              	Update an existing userfile
del                 	Delete a userfile
get                 	Download a userfile