Velociraptor admin

group_machines.vql

-- Tag machines by name, modify for other tagging usecases
LET target_clients = ( 'machinename1','machinename2'... )

SELECT 
    os_info.hostname as Hostname,
    os_info.fqdn as Fqdn,
    os_info.release as OS,
    timestamp(epoch=first_seen_at) as FirstSeen,
    timestamp(epoch=last_seen_at) as LastSeen,
    last_ip,
    client_id,
    labels,
    label(op='set',labels=['in_scope'],client_id=client_id) as SetLabel
FROM clients()
WHERE Hostname in target_clients
    or Fqdn in target_clients