Query optimization question

[Magister-Machinis]

Hello all,
Are select statements in a query processed at the endpoint or on the velociraptor server? I was thinking on ways to slim down/ speed up some queries and wasn't sure how much this would help.

[scudette]

They are processed on both - client artifacts on the client and server artifacts on the server.

[Magister-Machinis]

Thanks for the quick response! I'm not sure I understand. If punch in the query:
SELECT OSPATH from Parse_mft()
Is just a list of OSPATH values sent to the server from each client, or are all the data fields sent and the non-selected ones dropped server-side?

[scudette]

You cant just "punch in a query" - In Velociraptor queries must be wrapped in an artifact and the artifact is collected (either on the client or the server) so it is obvious where the VQL is evaluated.

See this for more information https://docs.velociraptor.app/docs/gui/artifacts/

[Magister-Machinis]

Ok, so if I'm reading this right, executing the above query as part of a hunt or in a notebook gathers all the fields specified in parse_mft()'s documentation and sends it to the server, where the undesired fields are dropped before display? A more streamlined artifact would then be needed to improve processing right?