Velociraptor Artifact - Allows pulling in JSON lists from an external URL to perform lookups against

Server.Enrichment.JsonLookup.yaml

name: Server.Enrichment.JsonLookup
description: Allows pulling in JSON lists from an external URL to perform lookups against
author: Whitney Champion (@shortstack)
type: SERVER

parameters:
    - name: LookupUrl
      type: string
      default: 

sources:
  - query: |
  
        // Assumes JSON is formatted like this:
        // {
        //     "list":
        //     [
        //         {"key":"value"},
        //         {"key":"value"}
        //     ]
        // }

        LET Data = SELECT parse_json(data=Content) AS Lookup
            FROM http_client(url=LookupUrl, headers=dict(`Accept`="application/json"), method='GET')

        SELECT 
            Lookup.list AS Lookup
        FROM Data
        
        // 
        // Notebook usage:
        //
        // LET List <= SELECT Lookup from Artifact.Server.Enrichment.JsonLookup(LookupUrl="https://gist.githubusercontent.com/shortstack/0d1dc36acce11e04feea2cf6aa57a436/raw/ac4f8e85069fb5f36e2da479ee9b4b14ac5cc8d4/lookup.json")
        // SELECT * FROM foreach(row=array(array=List.Lookup))
        //