https://cybertoolchain.io/tools/grr New releases and features in GRR, tracked by The Cyber Toolchain. en Mon, 15 Dec 2025 17:12:33 GMT https://github.com/google/grr/releases/tag/v.4.0.0.0-release https://github.com/google/grr/releases/tag/v.4.0.0.0-release Mon, 15 Dec 2025 17:12:33 GMT GRR v4 adds RRG (Rust) agent support, APIv2 migration, new ListFlowOutputPluginLogs endpoint and flow debugging UI • Adds a new `ApiListAllFlowOutputPluginLogs` endpoint for retrieving output plugin logs across all flows. • Enables server-side support for the Rust-based `RRG` agent alongside the legacy Python agent for action scheduling. • Introduces `include_metadata` argument to the `ListGRRBinaries` API method, returning binary size, signature validity and timestamp when true. • Extends `/api/clients/<client_id>/flows` with progress data via the `top_flows_only=false` parameter on the ListFlows method. • Changes the Interrogate flow return type from `ClientSummary` to `ClientSnapshot`, providing a superset of client information. • Adds dark mode, nested flow display, and debugging logs for flows and fleet collections in the new UI layout. Breaking changes: • Legacy HTTP API v1 (`/api/...`) is removed; all calls must now use the protocol-buffer-based APIv2 (`/api/v2/...`). • The `GetFile` flow is no longer available. • Variable hunts are no longer supported in Fleet collections. • Custom `OutputPlugin` implementations must be replaced with `OutputPluginProto` implementations due to stateless protocol-buffer migration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grr https://github.com/google/grr/releases/tag/v3.4.9.1-release https://github.com/google/grr/releases/tag/v3.4.9.1-release Wed, 16 Apr 2025 18:19:33 GMT Adds a Google Cloud Storage (GCS) output plugin for exporting artifacts from the GRR server. • Adds a GCS output plugin capability to the GRR server Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grr https://github.com/google/grr/releases/tag/v3.4.9.0-release https://github.com/google/grr/releases/tag/v3.4.9.0-release Thu, 27 Feb 2025 13:05:46 GMT GRR v3.4.9 adds `%SystemDrive%\Users` collection support; renames `restricted_flow_users/groups` to `admin_users/admin_groups`. • Adds listing of `%SystemDrive%\Users` as a supplementary mechanism for collecting Windows user profiles alongside registry data. • Renamed `restricted_flow_users` and `restricted_flow_groups` to `admin_users` and `admin_groups` respectively. Breaking changes: • The APIv1 is removed; you must use the v2 API (URLs containing `/v2/`). • The legacy AngularJS UI (UIv1) is removed. • `ListFlowApplicableParsers` API method removed. • `ListParsedFlowResults` API method removed. • `ApiClient.users` field removed; use `ApiClient.knowledge_base.users` instead. • `GREP` artifact source support removed. • Configuration options `Server.fleetspeak_enabled`, `Client.fleetspeak_enabled`, `Client.server_urls`, `Client.control_urls`, `Client.server_serial_number`, `Client.poll_min`, `Client.poll_max`, `Client.error_poll_min`, `Client.labels`, `Client.rss_max`, `Client.rss_max_hard`, `Frontend.bind_port`, `Frontend.port_max`, `Nanny.child_binary`, `Nanny.child_command_line`, `Nanny.service_name`, `Nanny.service_description`, `Nanny.statusfile`, `Nanny.binary`, `Nanny.service_binary_name` removed. • `restricted_flow_users` and `restricted_flow_groups` configuration keys renamed to `admin_users` and `admin_groups`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grr https://github.com/google/grr/releases/tag/v3.4.7.5-release https://github.com/google/grr/releases/tag/v3.4.7.5-release Thu, 27 Jun 2024 14:31:27 GMT GRR v3.4.7.5 adds `grr_api_client` standalone usage and Windows %SystemDrive%\Users fallback. • `grr-api-client` package no longer has an implicit dependency on `grr-response-core`, allowing standalone installation • Adds listing `%SystemDrive%\Users` as a supplementary mechanism for collecting user profiles on Windows Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grr https://github.com/google/grr/releases/tag/v3.4.7.4-release https://github.com/google/grr/releases/tag/v3.4.7.4-release Tue, 28 May 2024 17:11:13 GMT GRR v3.4.7.4 adds Docker distribution, CrowdStrike file decoding in Python API, and removes several legacy APIs. • Distributes GRR via Docker image and Docker Compose configuration as the primary deployment method • Adds `DecodeCrowdStrikeQuarantineEncoding` function to the Python API for decoding CrowdStrike quarantine files from a `BinaryChunkIterator` • Improves YARA memory scanning with better matching context options and reduced bandwidth consumption Breaking changes: • The `provides` field is removed from the `Artifact` message • Support for Chipsec based flows is removed • ClientArtifactCollector flow and related client actions are removed • Indexing endpoints on snapshot `uname` are removed; search must use individual system name, release and version fields • Support for foreman rules using `uname` of an endpoint is removed; must simulate with 3 rules for system name, release and version • Artifact parsers subsystem is removed; `ArtifactCollector` now works as if `apply_parsers` is False • GetClientLoadStats API method (`/api/clients/<client_id>/load-stats/<metric>`) is removed • ApiReportData definition changed: support for stack, line and pie charts removed, along with all related report plugins • GetFileDecoders API method (`/api/clients/<client_id>/vfs-decoders/<path:file_path>`) is removed • GetDecodedFileBlob API method (`/api/clients/<client_id>/vfs-decoded-blob/`) is removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grr https://github.com/google/grr/releases/tag/v3.4.7.1-release https://github.com/google/grr/releases/tag/v3.4.7.1-release Wed, 25 Oct 2023 21:46:43 GMT New Hunt workflow in UIv2 and Podman dev environment; renamed default_output_plugins config key • Hunts workflow is now available in the new UI: creating hunts from a flow, duplicating existing hunts, monitoring hunt progress and inspecting results • Added `StatMultipleFiles` and `HashMultipleFiles` flows to be used in UIv2 • Podman-based zero-setup development environment • Renamed `AdminUI.new_hunt_wizard.default_output_plugin` to `AdminUI.new_hunt_wizard.default_output_plugins` (note the "s" in the end). The new option accepts a comma-separated list of names Breaking changes: • `AdminUI.new_hunt_wizard.default_output_plugin` is renamed to `AdminUI.new_hunt_wizard.default_output_plugins`; the previous singular key no longer works • The deprecated `use_tsk` flag has been fully removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grr