Butler Admin Guide

This page lists default Butler settings and Butler audit data.

Clipboard Configuration

Description	Default
Enable or disable Clipboard Transfer	Enabled
User host clipboard operations	Upload, Download
Environment clipboard operations	Upload, Download
Clipboard data expiration	1 hour

Translation Configuration

Description	Default
Enable or disable text Translation	Enabled

File Configuration

These are the default Butler file transfer settings.

Butler data transfers are performed over encrypted channels and Butler Storage encrypts data at rest.

Description	Default
Enable or disable File Transfer	Enabled
User host file operations	List, Upload, Download, Delete, Copy
Environment file operations	List, Upload, Download, Delete, Copy
The maximum file size allowed for upload	400MB
The maximum number of files allowed per upload	10
Anti-Virus (AV) scanning	Enabled
Anti-Virus (AV) ignore	None
Infected file download	Blocked (Except in malware environments)
File Encryption at Rest	Enabled
File Encryption Algorithm	AES-256
File Integrity Verification	Disabled
File Integrity Algorithm	None (options available)

Environment Events

Butler can send actions into Replica environments. If environment events are enabled, the environment receives and processes event messages. Use the Butler API sample for programmatic access.

Description	Default
Enable or disable Environment Events	Disabled
Enable or disable Environment File Autosync	Disabled
Environment File Autosync directory	Desktop Files directory

File Events

When file events are enabled, Butler can automatically transfer uploaded files into the environment.

Browser Events

When browser events are enabled, Butler can open a URL inside a Replica environment.

File History

Butler records file activity in its history and logging systems. Each event includes a UTC timestamp.

Fields

Butler resource history entries include the following fields:

Name	Description
resource_id	A unique identifier assigned to the Resource
resource_path	The Resource path in Butler Storage
entity_type	The Entity Type that performed the action
entity_id	The Entity Id that performed the action
accessed	The timestamp of when the action was performed (UTC)
operation	The action that was performed

Entity Types

Name	Description
User	A Replica user plus their User Id
Group	A Replica group plus their Group Id
Profile	A Replica profile plus their Profile Id

Operation Types

Name	Description
Delete	The resource was deleted from Butler Storage
Download	The resource was downloaded from Butler Storage
Transfer	The resource was transferred between Enclaves in Butler Storage
Upload	The resource was created or updated in Butler Storage

Resource History Sample

[
  {
    "resource_id": "resource_id",
    "resource_path": "resource_path",
    "entity_type": "entity_type",
    "entity_id": "entity_id",
    "accessed": "2023-10-30T17:14:08.000Z",
    "operation": "upload"
  },
  {
    "resource_id": "resource_id",
    "resource_path": "resource_path",
    "entity_type": "entity_type",
    "entity_id": "entity_id",
    "accessed": "2023-10-30T17:14:22.415Z",
    "operation": "download"
  },
  {
    "resource_id": "resource_id",
    "resource_path": "resource_path",
    "entity_type": "entity_type",
    "entity_id": "entity_id",
    "accessed": "2023-10-30T17:16:43.501Z",
    "operation": "delete"
  }
]

---

File Event Logging

Name	Description
Get	Get a Resource from Butler Storage
Put	Save a Resource in Butler Storage
Delete	Delete a Resource from Butler Storage

Transfer Sample

{
  "@timestamp": "2023-10-30T17:54:57.925Z",
  "log.level": "info",
  "message": "Auth credentials accepted",
  "ecs": { "version": "8.10.0" },
  "event": {
    "kind": "event",
    "type": ["allowed"],
    "category": ["authentication"],
    "outcome": "success"
  },
  "http": {
    "version": "1.1",
    "request": {
      "method": "PUT",
      "headers": {
        "host": "replicacyber.com",
        "x-request-id": "8709f71e96fd500b5e3433bf0051ef44",
        "x-real-ip": "1.2.3.4",
        "x-forwarded-for": "1.2.3.4",
        "x-forwarded-host": "replicacyber.com",
        "x-forwarded-port": "443",
        "x-forwarded-proto": "https",
        "x-forwarded-scheme": "https",
        "x-requested-with": "XMLHttpRequest",
        "x-scheme": "https",
        "content-type": "multipart/form-data; boundary=---------------------------1804628349855675348442767821",
        "user-agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/119.0",
        "accept": "application/json",
        "accept-language": "en-US,en;q=0.5",
        "accept-encoding": "gzip, deflate, br",
        "cookie": "redacted"
      },
      "body": { "bytes": 6165 }
    },
    "response": {
      "status_code": 200,
      "headers": {
        ...
      }
    }
  },
  "url": {
    "path": "/butler/api/v1/transfer/resources/mY9bUtVCxc7F-9R6MHOgA-SQZJMD5Bt0V-pUAG2cVnA/test.txt",
    "domain": "replicacyber.com"
  },
  "client": { 
    "address": "1.2.3.4", 
    "ip": "1.2.3.4", 
    "port": 36600 
  },
  "user_agent": {
    "original": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/119.0"
  },
  "user": {
    "authenticated": true,
    "id": "a123456-1234-1234-1234-123456789123",
    "email": "[e-mail]",
    "full_name": "User Name"
  }
}

Auth Sample

{
  "@timestamp": "2023-10-30T17:52:41.164Z",
  "log.level": "info",
  "message": "Auth credentials accepted",
  "ecs": {
    "version": "8.10.0"
  },
  "event": {
    "kind": "event",
    "type": ["allowed"],
    "category": ["authentication"],
    "outcome": "success"
  },
  "http": {
    "version": "1.1",
    "request": {
      "method": "GET",
      "headers": {
        "host": "replicacyber.com",
        "x-request-id": "39a4d4d54dd906fdc942a239df23a26a",
        "x-real-ip": "1.2.3.4",
        "x-forwarded-for": "1.2.3.4",
        "x-forwarded-host": "replicacyber.com",
        "x-forwarded-port": "443",
        "x-forwarded-proto": "https",
        "x-forwarded-scheme": "https",
        "x-scheme": "https",
        "accept": "application/json",
        "user-agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36",
        ...
      }
    },
    "response": {
      "status_code": 200,
      ...
    }
  },
  "url": {
    "path": "/butler/api/v1/enclaves",
    "domain": "replicacyber.com"
  },
  "client": {
    "address": "1.2.3.4",
    "ip": "1.2.3.4",
    "port": 48354
  },
  "user_agent": {
    "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36"
  },
  "user": {
    "authenticated": true,
    "id": "a123456-1234-1234-1234-123456789123",
    "email": "[e-mail]",
    "full_name": "User Name"
  }
}

Login Sample

{
  "@timestamp": "2023-10-30T17:02:07.450Z",
  "log.level": "info",
  "message": "User John Smith logged into butler",
  "ecs": {
    "version": "8.10.0"
  },
  "event": {
    "kind": "event",
    "type": ["user"],
    "category": ["authentication"],
    "outcome": "success"
  }
}