> For the complete documentation index, see [llms.txt](https://docs.replicacyber.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.replicacyber.com/admin-guide/butler-admin-guide.md). # Butler Admin Guide This page lists default Butler settings and Butler audit data. ## Clipboard Configuration | Description | Default | | ------------------------------------ | ---------------- | | Enable or disable Clipboard Transfer | Enabled | | User host clipboard operations | Upload, Download | | Environment clipboard operations | Upload, Download | | Clipboard data expiration | 1 hour | ## Translation Configuration | Description | Default | | ---------------------------------- | ------- | | Enable or disable text Translation | Enabled | ## File Configuration These are the default Butler file transfer settings. {% hint style="info" %} Butler data transfers are performed over encrypted channels and Butler Storage encrypts data at rest. {% endhint %} | Description | Default | | ---------------------------------------------- | ---------------------------------------- | | Enable or disable File Transfer | Enabled | | User host file operations | List, Upload, Download, Delete, Copy | | Environment file operations | List, Upload, Download, Delete, Copy | | The maximum file size allowed for upload | 400MB | | The maximum number of files allowed per upload | 10 | | Anti-Virus (AV) scanning | Enabled | | Anti-Virus (AV) ignore | None | | Infected file download | Blocked (Except in malware environments) | | File Encryption at Rest | Enabled | | File Encryption Algorithm | AES-256 | | File Integrity Verification | Disabled | | File Integrity Algorithm | None (options available) | ## Environment Events Butler can send actions into Replica environments. If environment events are enabled, the environment receives and processes event messages. Use the Butler API sample for programmatic access. | Description | Default | | ------------------------------------------- | ----------------------- | | Enable or disable Environment Events | Disabled | | Enable or disable Environment File Autosync | Disabled | | Environment File Autosync directory | Desktop Files directory | ### File Events When file events are enabled, Butler can automatically transfer uploaded files into the environment. ### Browser Events When browser events are enabled, Butler can open a URL inside a Replica environment. ## File History Butler records file activity in its history and logging systems. Each event includes a UTC timestamp. #### Fields Butler resource history entries include the following fields: | Name | Description | | -------------- | ---------------------------------------------------- | | resource\_id | A unique identifier assigned to the Resource | | resource\_path | The Resource path in Butler Storage | | entity\_type | The Entity Type that performed the action | | entity\_id | The Entity Id that performed the action | | accessed | The timestamp of when the action was performed (UTC) | | operation | The action that was performed | #### Entity Types | Name | Description | | ------- | --------------------------------------- | | User | A Replica user plus their User Id | | Group | A Replica group plus their Group Id | | Profile | A Replica profile plus their Profile Id | #### Operation Types | Name | Description | | -------- | --------------------------------------------------------------- | | Delete | The resource was deleted from Butler Storage | | Download | The resource was downloaded from Butler Storage | | Transfer | The resource was transferred between Enclaves in Butler Storage | | Upload | The resource was created or updated in Butler Storage |
Resource History Sample ```json [ { "resource_id": "resource_id", "resource_path": "resource_path", "entity_type": "entity_type", "entity_id": "entity_id", "accessed": "2023-10-30T17:14:08.000Z", "operation": "upload" }, { "resource_id": "resource_id", "resource_path": "resource_path", "entity_type": "entity_type", "entity_id": "entity_id", "accessed": "2023-10-30T17:14:22.415Z", "operation": "download" }, { "resource_id": "resource_id", "resource_path": "resource_path", "entity_type": "entity_type", "entity_id": "entity_id", "accessed": "2023-10-30T17:16:43.501Z", "operation": "delete" } ] ```
*** ### File Event Logging | Name | Description | | ------ | ------------------------------------- | | Get | Get a Resource from Butler Storage | | Put | Save a Resource in Butler Storage | | Delete | Delete a Resource from Butler Storage |
Transfer Sample ```json { "@timestamp": "2023-10-30T17:54:57.925Z", "log.level": "info", "message": "Auth credentials accepted", "ecs": { "version": "8.10.0" }, "event": { "kind": "event", "type": ["allowed"], "category": ["authentication"], "outcome": "success" }, "http": { "version": "1.1", "request": { "method": "PUT", "headers": { "host": "replicacyber.com", "x-request-id": "8709f71e96fd500b5e3433bf0051ef44", "x-real-ip": "1.2.3.4", "x-forwarded-for": "1.2.3.4", "x-forwarded-host": "replicacyber.com", "x-forwarded-port": "443", "x-forwarded-proto": "https", "x-forwarded-scheme": "https", "x-requested-with": "XMLHttpRequest", "x-scheme": "https", "content-type": "multipart/form-data; boundary=---------------------------1804628349855675348442767821", "user-agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/119.0", "accept": "application/json", "accept-language": "en-US,en;q=0.5", "accept-encoding": "gzip, deflate, br", "cookie": "redacted" }, "body": { "bytes": 6165 } }, "response": { "status_code": 200, "headers": { ... } } }, "url": { "path": "/butler/api/v1/transfer/resources/mY9bUtVCxc7F-9R6MHOgA-SQZJMD5Bt0V-pUAG2cVnA/test.txt", "domain": "replicacyber.com" }, "client": { "address": "1.2.3.4", "ip": "1.2.3.4", "port": 36600 }, "user_agent": { "original": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/119.0" }, "user": { "authenticated": true, "id": "a123456-1234-1234-1234-123456789123", "email": "username@replicacyber.com", "full_name": "User Name" } } ```
Auth Sample ```json { "@timestamp": "2023-10-30T17:52:41.164Z", "log.level": "info", "message": "Auth credentials accepted", "ecs": { "version": "8.10.0" }, "event": { "kind": "event", "type": ["allowed"], "category": ["authentication"], "outcome": "success" }, "http": { "version": "1.1", "request": { "method": "GET", "headers": { "host": "replicacyber.com", "x-request-id": "39a4d4d54dd906fdc942a239df23a26a", "x-real-ip": "1.2.3.4", "x-forwarded-for": "1.2.3.4", "x-forwarded-host": "replicacyber.com", "x-forwarded-port": "443", "x-forwarded-proto": "https", "x-forwarded-scheme": "https", "x-scheme": "https", "accept": "application/json", "user-agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36", ... } }, "response": { "status_code": 200, ... } }, "url": { "path": "/butler/api/v1/enclaves", "domain": "replicacyber.com" }, "client": { "address": "1.2.3.4", "ip": "1.2.3.4", "port": 48354 }, "user_agent": { "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" }, "user": { "authenticated": true, "id": "a123456-1234-1234-1234-123456789123", "email": "username@replicacyber.com", "full_name": "User Name" } } ```
Login Sample ```json { "@timestamp": "2023-10-30T17:02:07.450Z", "log.level": "info", "message": "User John Smith logged into butler", "ecs": { "version": "8.10.0" }, "event": { "kind": "event", "type": ["user"], "category": ["authentication"], "outcome": "success" } } ```
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.replicacyber.com/admin-guide/butler-admin-guide.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.