Skip to content

docs: add MSSP guide for deploying Viberails via EDR Payloads#241

Merged
maximelb merged 3 commits into
masterfrom
docs/viberails-mssp-payload-deployment
May 26, 2026
Merged

docs: add MSSP guide for deploying Viberails via EDR Payloads#241
maximelb merged 3 commits into
masterfrom
docs/viberails-mssp-payload-deployment

Conversation

@maximelb
Copy link
Copy Markdown
Contributor

Summary

  • Adds a new tutorial: Viberails Deployment (MSSP) under 2-sensors-deployment/tutorials/.
  • Walks MSSPs through using existing LimaCharlie coverage (Payloads, D&R rules, Payload Manager / Git-Sync) to roll Viberails out to developer workstations across every customer org.
  • Provides ready-to-use D&R rule templates for Windows, macOS, and Linux, plus the user-context caveat (endpoint agent runs as SYSTEM/root, hooks need to land in the developer's profile).
  • Adds the page to the mkdocs nav under Sensors → Tutorials.

Why a draft

This is a first cut that needs review on:

  • The exact CLI/D&R commands used for dropping privileges to the active console user (Windows uses a one-shot scheduled task with /RU INTERACTIVE; macOS uses launchctl asuser + sudo -u; Linux uses who + sudo -u). These are conventional patterns but may need adjustment based on agent capabilities and how MSSPs actually operate in practice.
  • Whether one-shared-team vs one-team-per-customer should be opinionated rather than left as a customer choice.
  • Whether the Viberails README links (e.g. troubleshooting, configuration) should point at docs.viberails.io once that exists.

Test plan

  • npx markdownlint-cli2 passes locally (verified — 0 errors).
  • mkdocs build renders without warnings.
  • Reviewers walk through the D&R rules on a sandbox sensor (Windows + macOS + Linux) and confirm Viberails ends up installed under the right user account.
  • Internal links resolve (payloads.md, payload-manager.md, git-sync.md, sensor-tags.md, mssp-msp-mdr.md, designing-access.md).

🤖 Generated with Claude Code

Explains how MSSPs can use existing LimaCharlie endpoint coverage
(Payloads + D&R rules + Payload Manager / Git-Sync) to roll Viberails
out across developer workstations at scale, including per-OS rule
templates and the user-context caveat.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@github-actions
Copy link
Copy Markdown

Broken Links Detected

The link checker found some issues:

* [ERROR] <file:///home/runner/work/documentation/documentation/site/8-reference/story-tags/asset-tags.md> | Cannot find file: File not found. Check if file exists and path is correct

Please fix these broken links before merging.

Full results

See the uploaded artifact for complete link check results.

maximelb and others added 2 commits May 26, 2026 10:50
- limacharlie payload create -> payload upload (the actual subcommand)
- limacharlie sensors tag -> tag add/mass-add (top-level `tag` group)
- --oid is a global flag, hoist it before the subcommand
- Clarify per-OS config and debug dirs (macOS is ~/Library/Application
  Support/viberails, not ~/.config/viberails — README is wrong about macOS)
- Remove the bogus `op: is arch` suggestion (no such operator); use
  per-arch deploy tags or selectors at tag-time instead
- Rewrite the Windows rule to delegate to a viberails-install.ps1
  helper payload — drops the brittle nested-quote schtasks one-liner
  and detects the interactive user via Win32_Process owner
- Fix USER/UID collision with bash readonly vars in the macOS and Linux
  rules (use TARGET_USER/TARGET_UID instead)
- Correct the verification step about event types: `put` returns RECEIPT,
  `run --shell-command` returns EXEC_OOB (macOS/Linux); explain that the
  Viberails team URL embeds the LimaCharlie OID where audit events land

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Rewrite the guide for the common MSSP case: the customer already runs
LimaCharlie and the goal is to add Viberails coverage onto the existing
org, not to create a separate Viberails team.

- Drop "create a Viberails team" prerequisite; assume customer LC orgs
  with the endpoint agent already deployed
- Add a new Step 1 that provisions a per-customer `viberails` webhook
  adapter via `viberails init-team --existing-org <CUSTOMER_OID>`, with
  a scripted alternative using `installation-key create` and
  `cloud-adapter set` for fully non-interactive setups
- Renumber the rest of the steps and rename the placeholder from
  <YOUR_TEAM_URL> to <CUSTOMER_TEAM_URL> so it's clear the value is
  per-customer
- Replace the architecture diagram to show audit events landing in the
  same customer LC org, no separate MSSP/team org
- Replace the prerequisite permissions with the actual ones needed for
  the new flow: org.get, cloudsensor.get/set, ikey.list/set,
  payload.ctrl/use, dr.list/set/del, sensor.tag
- Add a note that init-team also seeds Viberails primer detection rules
  in the customer's dr-general hive

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@maximelb maximelb requested a review from steveatlc May 26, 2026 19:39
@maximelb maximelb marked this pull request as ready for review May 26, 2026 19:39
@maximelb maximelb added the to-code-review Used to tag PRs that are force-pushed and will need to be reviewed after the fact. label May 26, 2026
@maximelb maximelb merged commit 2612a1e into master May 26, 2026
2 checks passed
@maximelb maximelb deleted the docs/viberails-mssp-payload-deployment branch May 26, 2026 19:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

to-code-review Used to tag PRs that are force-pushed and will need to be reviewed after the fact.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant