docs: add MSSP guide for deploying Viberails via EDR Payloads#241
Merged
Conversation
Explains how MSSPs can use existing LimaCharlie endpoint coverage (Payloads + D&R rules + Payload Manager / Git-Sync) to roll Viberails out across developer workstations at scale, including per-OS rule templates and the user-context caveat. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Broken Links DetectedThe link checker found some issues: Please fix these broken links before merging. Full resultsSee the uploaded artifact for complete link check results. |
- limacharlie payload create -> payload upload (the actual subcommand) - limacharlie sensors tag -> tag add/mass-add (top-level `tag` group) - --oid is a global flag, hoist it before the subcommand - Clarify per-OS config and debug dirs (macOS is ~/Library/Application Support/viberails, not ~/.config/viberails — README is wrong about macOS) - Remove the bogus `op: is arch` suggestion (no such operator); use per-arch deploy tags or selectors at tag-time instead - Rewrite the Windows rule to delegate to a viberails-install.ps1 helper payload — drops the brittle nested-quote schtasks one-liner and detects the interactive user via Win32_Process owner - Fix USER/UID collision with bash readonly vars in the macOS and Linux rules (use TARGET_USER/TARGET_UID instead) - Correct the verification step about event types: `put` returns RECEIPT, `run --shell-command` returns EXEC_OOB (macOS/Linux); explain that the Viberails team URL embeds the LimaCharlie OID where audit events land Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Rewrite the guide for the common MSSP case: the customer already runs LimaCharlie and the goal is to add Viberails coverage onto the existing org, not to create a separate Viberails team. - Drop "create a Viberails team" prerequisite; assume customer LC orgs with the endpoint agent already deployed - Add a new Step 1 that provisions a per-customer `viberails` webhook adapter via `viberails init-team --existing-org <CUSTOMER_OID>`, with a scripted alternative using `installation-key create` and `cloud-adapter set` for fully non-interactive setups - Renumber the rest of the steps and rename the placeholder from <YOUR_TEAM_URL> to <CUSTOMER_TEAM_URL> so it's clear the value is per-customer - Replace the architecture diagram to show audit events landing in the same customer LC org, no separate MSSP/team org - Replace the prerequisite permissions with the actual ones needed for the new flow: org.get, cloudsensor.get/set, ikey.list/set, payload.ctrl/use, dr.list/set/del, sensor.tag - Add a note that init-team also seeds Viberails primer detection rules in the customer's dr-general hive Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
2-sensors-deployment/tutorials/.Why a draft
This is a first cut that needs review on:
/RU INTERACTIVE; macOS useslaunchctl asuser+sudo -u; Linux useswho+sudo -u). These are conventional patterns but may need adjustment based on agent capabilities and how MSSPs actually operate in practice.Test plan
npx markdownlint-cli2passes locally (verified — 0 errors).mkdocs buildrenders without warnings.payloads.md,payload-manager.md,git-sync.md,sensor-tags.md,mssp-msp-mdr.md,designing-access.md).🤖 Generated with Claude Code