# AttackTracer Ninja V2 Deployment

## Goal

Deploy and update the endpoint client through NinjaOne while hosting release artifacts in GitLab.

## Release assets

Each GitLab release should publish:

- `OCSentinelClient-win-x64.zip`
- `OCSentinelClient-win-x64.zip.sha256`
- `version.json`

Build these locally with:

```powershell
powershell -ExecutionPolicy Bypass -File .\build\build-client-package.ps1
powershell -ExecutionPolicy Bypass -File .\build\build-release-manifest.ps1 `
  -ArtifactUrl "https://gitlab.example.com/group/project/-/releases/v2.0.0/downloads/OCSentinelClient-win-x64.zip"
```

See example manifest:

- [update-channel.example.json](C:/Users/Besitzer/Documents/AttackTracerNinjaVersion/config/update-channel.example.json)

## Endpoint package contents

The installed package should include:

- `app\OCSentinelCli.exe`
- `scripts\run-ocsentinel.ps1`
- `scripts\run-ocsentinel-monitor.ps1`
- `scripts\update-ocsentinel.ps1`
- `scripts\protect-ocsentinel-secret.ps1`
- `config\ocsentinel-settings.json`
- `config\ocsentinel-client.json`

## Initial install through NinjaOne

Recommended NinjaOne task:

```powershell
& "C:\Program Files\OCSentinel\scripts\update-ocsentinel.ps1" `
  -ManifestUrl "https://gitlab.example.com/group/project/-/releases/permalink/latest/downloads/version.json" `
  -Force
```

If the client is not installed yet, you can also first distribute a bootstrap ZIP or setup package, then switch to the updater-only model.

## Routine update task

Recommended scheduled task command:

```powershell
& "C:\Program Files\OCSentinel\scripts\update-ocsentinel.ps1" `
  -ManifestUrl "https://gitlab.example.com/group/project/-/releases/permalink/latest/downloads/version.json"
```

## Behavior

The updater:

1. downloads the manifest
2. compares installed and available version
3. downloads the ZIP only when newer
4. validates SHA-256
5. validates Authenticode signature when present
6. runs the package installer

## Secret bootstrap

After installation, provision the upload secret once:

```powershell
& "C:\Program Files\OCSentinel\scripts\protect-ocsentinel-secret.ps1" `
  -SecretValue "<shared-ingest-secret>"
```

This writes a DPAPI-protected file under:

- `C:\ProgramData\OCSentinel\secrets\ocsentinel-upload-secret.dat`

## Runtime task

Recommended runtime task:

```powershell
& "C:\Program Files\OCSentinel\scripts\run-ocsentinel-monitor.ps1" `
  -Mode status `
  -OutputPath "..\reports\attacktracer-summary.json"
```

Upload is enabled automatically when:

- `config\attacktracer-client.json` exists
- the protected secret file exists

Otherwise the client falls back to local scan behavior.

## Migration guidance

During migration you can keep old share-based logic disabled by default and only enable the new n8n upload path as secrets and webhook config become available.