Feature Summary
I would like the option to set the agent_id inside the corresponding settings.yaml for the collector for each c2
Problem / Use Case
Currently, the system only identifies the C2 framework type (e.g., Cobalt Strike, Outflank C2, or Mythic) as the source of a file.
However, this becomes insufficient when multiple instances of the same C2 framework are deployed. For example:
cobalt_strike_inital
cobalt_strike_post
In such cases, it should be possible to determine which specific C2 instance the file originated from, not just the framework type.
The CLI version of the collector currently supports this but not the ingester for the specific c2s..... (hardcoded here)
Proposed Solution
Outflank C2
metadata = FileMetadata(
agent_id="stage1",
Cobalt Strike
metadata = FileMetadata(
agent_id="Cobalt Strike",
Mythic C2
metadata = FileMetadata(
agent_id="mythic",
Repalce this with "agent_id" and expose the settings to the settings.yaml for each c2.
Alternatives Considered
No response
Additional Context
Pull request coming :D