I miss you, KAPE

[secure-cake]

I completely get the logic of breaking out "triage artifacts," but I really, REALLY miss the ease of use and integration of KAPE into the Collector. My "Rapid Triage Workflow" (used by a lot of businesses, municipalities, etc.) relies heavily on the KAPE Targets artifacts, especially the granularity of controlling/configuring the artifact selection directly via the GUI. I want to see and select the artifacts from the GUI, not reference dynamic YAML files managed by someone else.

Anyhow...maybe it's just me. Regardless, obviously a huge fan of the project and understand that my utilization of the tool (offline collector only) is not "normal." My "Rapid Triage Workflow" is however, the best 'open-source' rapid triage I have ever seen or used, which is entirely creditable to the Velocidex team!

[scudette]

You only need to import the Extra artifacts to have it available.

[secure-cake]

I imported the Windows.Triage.Targets, assuming that was the "path forward," and do not have the previous granularity of selection/configuration (as above)?

[scudette]

After installing the new version you will see in the welcome page:

Second option on the left "Import Extra artifacts" - click then launch .

This is described here
https://docs.velociraptor.app/docs/gui/artifacts/#importing-artifacts-from-velociraptors-specialized-artifact-projects

[secure-cake]

Makes sense/understood! Sure appreciate your responsiveness...you are a rock star!

I'll kick the proverbial tires. At first test, the offline collector output compression improvements are stellar!!! Sincerely, thank you!