Hi Fleet team do we have doc present how to use carve

Question

Kathy Satterlee · Answer

We do <https fleetdm com docs using fleet fleetctl cli file carving> <https fleetdm com docs using fleet rest api file carving>

wennan.he · Answer

and all the files loaded by carve query return by distributed write to fleet side and where does fleet store them

Kathy Satterlee · Answer

Carves are sent to fleet via the carving endpoints ``` carver start endpoint= api v1 osquery carve begin``` This endpoint tells the server the carve is incoming ``` carver continue endpoint= api v1 osquery carve block``` This is where the actual carve is sent By default carves are stored in the Fleet database and removed after 24 hours

wennan.he · Answer

``` api v1 osquery carve begin``` this one is used to send file what about this one ``` carver continue endpoint= api v1 osquery carve block```

Kathy Satterlee · Answer

The first tells the server a carve will be sent The second sends the actual carve blocks

wennan.he · Answer

and the content of file is storing in carve blocks the file meta info is storing in carve metadata right

wennan.he · Answer

and after 24 hrs it will be removed

wennan.he · Answer

how does fleet implement it by starting a goroutine

Kathy Satterlee · Answer

You can set up a different carving backend golf you d like to keep them around longer <https fleetdm com docs using fleet fleetctl cli alternative carving backends|https fleetdm com docs using fleet fleetctl cli alternative carving backends>

Kathy Satterlee · Answer

Here s where that cleanup job is run <https github com fleetdm fleet blob 7d4653baaadce77e83d407195e20f03ea83e55ea cmd fleet cron go L676|https github com fleetdm fleet blob 7d4653baaadce77e83d407195e20f03ea83e55ea cmd fleet cron go L676>

wennan.he · Answer

so the order is 1 begins the carver by calling ``` api v1 osquery carve begin``` 2 the agent will run the distributed query and fetch the file 3 the agent will sent it back to fleet by ``` api v1 osquery carve block``` is that the right order

Kathy Satterlee · Answer

1 The carve is initiated by querying the `carves` table 2 The host receives the query and osquery starts processing 3 When osquery is ready to send the carve it sends a request to the ` begin` endpoint to start the process 4 The actual carve blocks are then sent by osquery to the ` block` endpoint

wennan.he · Answer

1 The carve is initiated by querying the `carves` table this is happened on agent side right but who told agent to activate carves feature

Kathy Satterlee · Answer

When you want to initiate a carve you do so by querying the `carves` table either through `fleetctl` or running a live query in the UI or REST API

Kathy Satterlee · Answer

That s step one above Let me tweak that a little

Kathy Satterlee · Answer

1 The carve is initiated in Fleet by querying the `carves` table through the UI API or `fleetctl`

Kathy Satterlee · Answer

The query looks like this ```SELECT FROM carves WHERE path = lt filepath gt and carve = 1 ```

Kathy Satterlee · Answer

The `and carve = 1` is what tells osquery that this is a new carve

Kathy Satterlee · Answer

I know there are a lot of moving pieces there Just let me know if you want me to put it all together from the beginning again

wennan.he · Answer

no worries i got it every clear ty

Kathy Satterlee · Answer

Great

Kathy Satterlee · Answer

I m really excited about how deeply you re digging in to this stuff Are you thinking about contributing

wennan.he · Answer

maybe on more question if i run a live query for carve because the agent returns the result of live query with distributed write but carve has different endpoints to do it so it means osquery could discriminate the carve from other live query and use different endpoint to transfer it back

Kathy Satterlee · Answer

Exactly

Kathy Satterlee · Answer

I tracked that down in the osquery code just for giggles <https github com osquery osquery blob 613028a6384d4e0b101fe087717c2dfdcde3efbf osquery tables forensic carves cpp L96|https github com osquery osquery blob 613028a6384d4e0b101fe087717c2dfdcde3efbf osquery tables forensic carves cpp L96>