104 lines
2.8 KiB
Markdown
104 lines
2.8 KiB
Markdown
# AttackTracer Ninja V2 Deployment
|
|
|
|
## Goal
|
|
|
|
Deploy and update the endpoint client through NinjaOne while hosting release artifacts in GitLab.
|
|
|
|
## Release assets
|
|
|
|
Each GitLab release should publish:
|
|
|
|
- `OCSentinelClient-win-x64.zip`
|
|
- `OCSentinelClient-win-x64.zip.sha256`
|
|
- `version.json`
|
|
|
|
Build these locally with:
|
|
|
|
```powershell
|
|
powershell -ExecutionPolicy Bypass -File .\build\build-client-package.ps1
|
|
powershell -ExecutionPolicy Bypass -File .\build\build-release-manifest.ps1 `
|
|
-ArtifactUrl "https://gitlab.example.com/group/project/-/releases/v2.0.0/downloads/OCSentinelClient-win-x64.zip"
|
|
```
|
|
|
|
See example manifest:
|
|
|
|
- [update-channel.example.json](C:/Users/Besitzer/Documents/AttackTracerNinjaVersion/config/update-channel.example.json)
|
|
|
|
## Endpoint package contents
|
|
|
|
The installed package should include:
|
|
|
|
- `app\OCSentinelCli.exe`
|
|
- `scripts\run-ocsentinel.ps1`
|
|
- `scripts\run-ocsentinel-monitor.ps1`
|
|
- `scripts\update-ocsentinel.ps1`
|
|
- `scripts\protect-ocsentinel-secret.ps1`
|
|
- `config\ocsentinel-settings.json`
|
|
- `config\ocsentinel-client.json`
|
|
|
|
## Initial install through NinjaOne
|
|
|
|
Recommended NinjaOne task:
|
|
|
|
```powershell
|
|
& "C:\Program Files\OCSentinel\scripts\update-ocsentinel.ps1" `
|
|
-ManifestUrl "https://gitlab.example.com/group/project/-/releases/permalink/latest/downloads/version.json" `
|
|
-Force
|
|
```
|
|
|
|
If the client is not installed yet, you can also first distribute a bootstrap ZIP or setup package, then switch to the updater-only model.
|
|
|
|
## Routine update task
|
|
|
|
Recommended scheduled task command:
|
|
|
|
```powershell
|
|
& "C:\Program Files\OCSentinel\scripts\update-ocsentinel.ps1" `
|
|
-ManifestUrl "https://gitlab.example.com/group/project/-/releases/permalink/latest/downloads/version.json"
|
|
```
|
|
|
|
## Behavior
|
|
|
|
The updater:
|
|
|
|
1. downloads the manifest
|
|
2. compares installed and available version
|
|
3. downloads the ZIP only when newer
|
|
4. validates SHA-256
|
|
5. validates Authenticode signature when present
|
|
6. runs the package installer
|
|
|
|
## Secret bootstrap
|
|
|
|
After installation, provision the upload secret once:
|
|
|
|
```powershell
|
|
& "C:\Program Files\OCSentinel\scripts\protect-ocsentinel-secret.ps1" `
|
|
-SecretValue "<shared-ingest-secret>"
|
|
```
|
|
|
|
This writes a DPAPI-protected file under:
|
|
|
|
- `C:\ProgramData\OCSentinel\secrets\ocsentinel-upload-secret.dat`
|
|
|
|
## Runtime task
|
|
|
|
Recommended runtime task:
|
|
|
|
```powershell
|
|
& "C:\Program Files\OCSentinel\scripts\run-ocsentinel-monitor.ps1" `
|
|
-Mode status `
|
|
-OutputPath "..\reports\attacktracer-summary.json"
|
|
```
|
|
|
|
Upload is enabled automatically when:
|
|
|
|
- `config\attacktracer-client.json` exists
|
|
- the protected secret file exists
|
|
|
|
Otherwise the client falls back to local scan behavior.
|
|
|
|
## Migration guidance
|
|
|
|
During migration you can keep old share-based logic disabled by default and only enable the new n8n upload path as secrets and webhook config become available.
|