docs: harden Velociraptor-to-BigQuery tutorial#304
Merged
Conversation
- Add prerequisites: billing-enabled project (streaming inserts are not available in the BigQuery free tier) and org policies that can block service account key creation - Document the required IAM role (BigQuery Data Editor) and the exact permission errors seen when it is missing - Clarify the Project field expects the GCP project ID, not display name - Add a section on including the endpoint hostname via the built-in Generic.Client.Info artifact, with schema/transform and SQL examples Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRE5GLZAwpR8zXssiEW6Bd
lcbill
previously approved these changes
Jul 15, 2026
The BigQuery output module has no 'schema' config field — the effective schema is read from the BigQuery table itself, and streamed rows must match the table's columns. Replace the stale output-form 'schema' step with a note on matching the table columns to the Custom Transform, and change the hostname section to ALTER TABLE instead of an output setting. Also clarify which permission each stage of the output needs. Verified against legion_endpoint-go storage/bigquery.go (fetchUpstreamSchema, uploadBatch), the webapp output editor, a live run of the documented Custom Transform through go-essentials NewTransformTemplate, the upstream Generic.Client.Info artifact definition, and a BigQuery dry-run of the JSON_VALUE query. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRE5GLZAwpR8zXssiEW6Bd
lcbill
approved these changes
Jul 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Improvements to the Velociraptor-to-BigQuery tutorial based on real-world setup friction:
iam.disableServiceAccountKeyCreationorg policy that can block service account key creation.bigquery.tables.get+bigquery.tables.updateData) and calls out that Data Viewer + Job User are not sufficient, with the exact permission-denied error.velociraptor_collectionevent only identifies the endpoint bysid(and routing belongs to the extension's webhook adapter, not the endpoint). Documents how to get the hostname by adding the built-inGeneric.Client.Infoartifact to collections, with both a Custom Transform example (dedicatedhostnamecolumn) and a query-timeJSON_VALUEexample.Validation
markdownlint-cli2passes on the edited file.scripts/check-list-numbering.pywarnings on this page pre-exist on master (verified by running against a clean tree); no new breaks introduced./), and the BigQuery output config fields verified against the output implementation.🤖 Generated with Claude Code
https://claude.ai/code/session_01CRE5GLZAwpR8zXssiEW6Bd