GRR flow

grr_api_shell.py → CreateFlow('Interrogate')

Launches investigation flows on endpoints with GRR, Google's remote incident response platform.

Run it when you need remote response on endpoints: GRR (Google Rapid Response) manages deployed agents and flows (Interrogate, collections, file search) are launched from the API or the console. The Interrogate flow collects the host inventory (processes, network, files, registry) in one pass; search and collection flows answer IR questions: 'what processes are running on all hosts?', 'which hosts have this file?'. In IR, GRR is the distributed response platform: flows across the entire fleet, with results in the console. The grr_api_shell automates flows from scripts.

Don't use it without deployment: GRR needs agents on endpoints and the server — without deployment, there are no flows. The platform (server, database, workers) is infrastructure that requires maintenance; the modern alternative with less infrastructure is Velociraptor. And watch the scope: flows collect data, analysis is the team's job — results are correlated with the rest of the IR. Heavy flows (full collection from many hosts) generate load on endpoints and the server: they are scoped by host and artifact. GRR covers Windows/Linux/macOS with supported clients.