Skip to content

feat(vql): add reformat function#4675

Merged
scudette merged 10 commits intoVelocidex:masterfrom
nullifysecurity:feat/reformat-function
Feb 23, 2026
Merged

feat(vql): add reformat function#4675
scudette merged 10 commits intoVelocidex:masterfrom
nullifysecurity:feat/reformat-function

Conversation

@nullifysecurity
Copy link
Contributor

This change introduces a new reformat function that wraps the existing VQL reformatting logic, allowing artifact authors to call it directly from queries to reformat their artifacts.

It also updates the artifacts reformat command to align with Velociraptor’s general approach, keeping the CLI as a thin layer over the underlying VQL functionality.

Right now, the reformat function accepts the artifact content as a string, similar to how the verify function works. I’m wondering whether it would make more sense to switch this to a file argument instead and let the caller optionally provide an accessor. Would that be a better fit and provide more flexibility?

As always, let me know if there is anything you would like me to clarify or change! 😃

@scudette scudette merged commit d7c0225 into Velocidex:master Feb 23, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants