GRR client action

grr_config_updater → grr_client_action <a>

Execute remote actions on endpoints with GRR (Google Rapid Response), launching collection and response from the server.

Run it when you want remote response with GRR: client actions (artifact collection, file search, flow execution) are launched from the server (or console) on endpoints with the agent — collection and response without touching each host. It's Google's remote response platform (the same as 171): the IR flow across the fleet. In SOC/DFIR, GRR is remote response: the action launched on the endpoint (collection, interrogation) with results in the console.

Don't use it without deployment: GRR requires agents on endpoints and the server — infrastructure is the requirement. And watch out: remote actions generate activity on the endpoint (and artifacts): IR order is respected (volatile first) and scope (hosts, actions) is defined. For modern platform, Velociraptor (172) is the alternative with less infrastructure; GRR is Google's reference. Client management (grr_config_updater for configuration) is part of deployment.